Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
2,112
questions
0
votes
0
answers
22
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,083
0
votes
0
answers
27
views
decode lua files cocos2dx and protected from Frida and IDA64 for hooking
I want to decode the lua and other resources files. But i cant find the key when i use frida or ida 64 it crash before the game start.
Game is here https://megamonglobal.com/
https://imgur.com/88Habwu
- 53
0
votes
0
answers
53
views
Import function symbols from a reflection system into IDA
I'd like to import structs and functions from a reflection system into IDA.
The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
- 296
0
votes
1
answer
45
views
When parsing a C header file in IDA, is there a preprocessor symbol I can use to detect it?
IDA has the ability to parse C header files (by now a secondary option based on Clang also exists). It is useful to get structs and enums into your database via the Local Types view.
Question: Aside ...
- 10.9k
1
vote
0
answers
54
views
How to use IDA environment to run python scripts?
I am trying out following technique:
https://github.com/CMUSTRUDEL/DIRTY
This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset.
It ...
- 1,797
0
votes
1
answer
50
views
My ida.reg file got deleted, is there any way to restore ida?
I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed -
Is there any way to restore ida? ...
- 1,797
0
votes
0
answers
44
views
IDA Free Debugger slows down app substantially
I'm using IDA Free to decompile and debug an exectuable (a game, actually).
When starting the debugger, the game runs really, really slow occasionally.
Before, I have used Cheat Engine to debug the ...
- 151
1
vote
0
answers
54
views
How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?
I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
- 11
2
votes
1
answer
142
views
convert a memory location to string in Ghidra
I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well.
I would like to have a decompiled pseudo-code in Ghidra like:
...
0
votes
0
answers
87
views
How to decrypt xxtea encrypt lua file from cocos2D game
I'm trying to decipher this game because it's about to be discontinued
I tried to decompile the apk looking for image resources and lua files. Looking at the received title I guess that the game was ...
- 41
0
votes
1
answer
105
views
Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?
I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game.
The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at.
I was ...
- 69
1
vote
0
answers
24
views
After loading additional files into an IDA database: can I process it, including applying PDB etc?
After loading an additional binary (.dll) file into an IDA database, is there a way to run it through a similar routine as would happen if the DLL had been loaded standalone?
What I am aiming for is ...
- 10.9k
1
vote
0
answers
72
views
DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro
I am having an issue when using the Cutter Reverse Engineering Program,
Here is a Segment of Decompiled Assembly, in Cutter :-
at 0000:4ed5 in the picture I posted the .string line of text is there, ...
- 69
1
vote
1
answer
64
views
IDC script offsets
I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
- 11
1
vote
2
answers
188
views
Using IDA 8.3 Freeware on a Z180 .bin file
The last time I tried my hand at disassembly it was in
1986-1988... a Z80 embedded processor PROM image file...
42K of code turned into 27000+ lines of assembler code...
using a disassembly program ...
- 21
3
votes
2
answers
260
views
Inspect executable binary similarity
I've found a company in China selling a software that is clearly a copy of my own work. For context, this is actually a physical product that comes with a Ubuntu computer and the software pre-...
- 131
0
votes
0
answers
36
views
Getting IDA pro to understand that a "large" push can be two separate arguments?
I am reversing a large 16-bit DOS application compiled with a borland compiler.
This often pushes one 32-bit value to the stack when a function takes two 16-bit arguments.
Is there any way I can get ...
- 1
0
votes
0
answers
35
views
How to force IDA to understand that a given literal value is the bitwise combination of enum members?
I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this:
FFFFFFFF ; ...
- 10.9k
0
votes
0
answers
53
views
IDA python : display not refreshing function parameters after type update
I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :)
The issue :
I have a ...
- 1
0
votes
1
answer
67
views
How to convert variable to struct member in IDA?
I'm working on a windows program which is walking PEB Ldr list. the related types are as follows:
struct LDR_DATA_TABLE_ENTRY {
LIST_ENTRY InLoadOrderLinks; // offset = 0, size = 0x10
...
- 3
0
votes
0
answers
37
views
How to get the byte offset of a type casted pointer in IDA PRO
v6 = v5 + 0x3E;
if ( v5 + 0x1F >= 0 )
v6 = v5 + 0x1F;
v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5);
I want to get the byte offset pointer pointing at.
Is there any way to get ...
- 1
0
votes
0
answers
37
views
How can I map a binary that uses bank switching in IDA Pro?
Is it possible to memory map a binary that uses bank switching in IDA Pro?
I'm trying to reverse engineer a binary for the Motorola 6800 architecture. The full 64Kb binary is mapped to the upper 32Kb ...
1
vote
1
answer
140
views
How to run exe program loaded into IDA Pro or Ghidra
I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
- 11
0
votes
0
answers
61
views
Debug the DLL of an EXE using IDA Freeware
I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
- 1
1
vote
1
answer
261
views
How to decode lua files and resource files that are protected from Frida and IDA64?
I am trying to decrypt Lua files from an Android game "The Sea Road: Fate Assembly" (APK download link). It uses Cocos2d-x, but it's encrypted, maybe with AES encryption.
With Frida, the ...
- 53
0
votes
1
answer
65
views
IDA Pro: JDWP error: ABSENT_INFORMATION - Desired information is not available
I am trying to debug a dex file from an APK file in IDA Pro. I set some breakpoints when launching the activity. When I start the process, the application waits for the debugger. After some time, IDA ...
0
votes
0
answers
43
views
Using __usercall convention in IDA with non-x86 architecture
I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
1
vote
1
answer
135
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
- 33
1
vote
0
answers
40
views
Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?
My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing
From my research, I have come to the understanding that in order to extract the ipa ...
- 21
0
votes
1
answer
60
views
IDA Pro Debugging GDB SendDbgCommand
I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging.
Setting up the debug environment with IDA Pro using ...
- 49
0
votes
1
answer
68
views
IDA python API set function chunk end
I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
1
vote
1
answer
130
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
- 21
0
votes
1
answer
121
views
NameError: name 'ScreenEA' is not defined
Part of Practical malware analysis Lab5, is to run a python script in IDA Pro
I have tried by going to Files-->Script command then I have pasted my python code:
sea = ScreenEA()
for i in range(...
- 1
0
votes
0
answers
64
views
What to expect from a Reverse Engineering technical test with IDA for a junior position? Experiences?
I'm excited about the prospect of taking a technical Reverse Engineering test for a junior position that I've been trying to secure. The test is expected to last around 3 hours, and I've been informed ...
- 1
1
vote
0
answers
127
views
Trying To Understand DOS Game Assembly Instructions
I am trying to understand assembly language instructions, for a DOS Game.
I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html
reading about how VGA Graphics work in ...
- 69
0
votes
2
answers
97
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
0
votes
0
answers
43
views
How to load correctly a SPC56AP54 dump in Ghidra or IDA?
I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
- 51
0
votes
1
answer
69
views
Tool to analyze .obj files (not COFF) created with /LTCG
This Microsoft article states that:
When building with LTCG, the compiler front end doesn't invoke the
back end. Instead, it emits an OBJ file with IL in it. It bears
repeating: this IL is not the ...
- 1,550
2
votes
2
answers
209
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
1
vote
2
answers
91
views
how to access the initialized data in windbg through offset from IDA
In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the ...
- 313
2
votes
1
answer
105
views
Problems with the display of constants in IDA Pro pseudocode
There is an elf x64 file, the pseudocode of IDA Pro 7.6 shows that a constant is 0xFFFFFFFD, but in fact it is "3" in the source code, how can I change it to show "3" in the ...
- 411
0
votes
1
answer
61
views
How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?
Is there an API which lets me programmatically:
set the default string type (Setup) and
rebuild the string list (Rebuild)
???
- 10.9k
0
votes
1
answer
93
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
1
vote
0
answers
64
views
Log functions called in IDA Pro?
When I run an exe in IDA how could I log which functions were called into a text file?
log.txt:
call func1
call func2
call func1
call func1
Not worried about indirect calls.
This is for differential ...
- 11
1
vote
1
answer
103
views
Why I can't decompile this ARM function?
I have an ARM (thumb) function from Nokia's firmware:
ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p
ROM:10A5409C
ROM:10A5409C var_18 = -0x18
ROM:...
- 249
0
votes
0
answers
86
views
How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. Compression is RLE
The game is from 1988 ...
0
votes
0
answers
77
views
read params of int variable in ida?
I have located a known int variable that belongs to a tls library, the variable has parameters I need to look at to find the name of another variable I need. Is it possible to read the parameters?
- 1
0
votes
1
answer
86
views
idat.exe -S, path with spaces
I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so
But I get an error. Among the logs is present the error:
home\mypath: ...
- 1
0
votes
1
answer
41
views
idat.exe -S -A close without error
I have developed a idapython script and I run it using the following command:
idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so
In myscript.py I appended the exit(0) in order to ...
- 1
0
votes
1
answer
82
views
split function argument from IDA's hints
Suppose I have a function, I know that the first 4 arguments come with fixed registers.
_BYTE *__fastcall foo(__int64 a1, _QWORD *a2, unsigned int a3, char a4, _QWORD *a5)
For the fifth one, if I ...
- 313