Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
1
vote
1answer
16 views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, std::...
0
votes
0answers
22 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
0
votes
0answers
16 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
-1
votes
1answer
80 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
0
votes
0answers
21 views

Failed to load .net binary on IDA Pro

I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file: but when I click OK to load the program, the following error occured, and the program can't be loaded: I tried to google ...
0
votes
1answer
22 views

Can't find sequence of bytes in IDA while debugging

While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44: I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
0
votes
0answers
41 views

How to reverse engineer structs

I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
0
votes
0answers
14 views

IDA, wrong jmp operand after patching

I'm writing a python script for IDA to automate the deobfuscation of a binary. After patching with a jmp instruction ida provides the following disassembly: .text:008FD01E jmp ...
-1
votes
1answer
44 views

IDA decompile binary file

how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,
1
vote
1answer
49 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
0answers
21 views

in ida pro 7+, what is the way to get a list of applied functions by signature?

I can only see the number of applied functions, but not the full list. In the function window, there is no way to differentiate which signature lib is applied
0
votes
1answer
38 views

Packer changed memory in IDA?

I'm trying to analyze one binary protected by HASP. Since it is pretty old binary (2008) I managed to run it in IDA and it unpacked in memory. When I do tracing + take memory snapshot and reanalyze it,...
0
votes
0answers
22 views

IDA - tracing strings

Is it possible for IDA to save string/memory content pointed by one of the registers during run-time?
-3
votes
1answer
124 views

The C166 family code meaning

What the meaning of this code with an explanation? sub_37C2: mov r5, r4 shr r5, #14 shl r5, #1 mov r5, [r5+0FE00h] ; DPP0 bmov r4.14, r5.0 bmov r4.15, r5.1 shr r5, #2 rets ; ...
0
votes
1answer
56 views

What is the meaning of ARM LDAXR/STLXR instructions?

Often while disassembling ARM files, I see some code snippet with the following pattern: loc_BB30: .text:C0 FE 5F 88 LDAXR WZR, W0, [X22] .text:00 04 00 51 SUB W0, W0, #1 .text:...
2
votes
1answer
45 views

Structure of operand bytes in .NET call and data access IL instructions?

I tried googling but couldn't find any good source that explains the structure of memory access instructions like ldstr and call instructions for example based on experience, the last byte of API/...
-1
votes
1answer
61 views

What does xchg means when accessing array element?

I have ASM code of some Windows *.exe in IDA: mov rax, [rbx+10h] mov ecx, edx xor edx, edx xchg rdx, [rax+rcx*8] Which is decompiled to pseudocode to _RAX = this->m_someMemoryPool; ...
0
votes
0answers
23 views

C166 Memory and Addressing mode

Here I think I have some wrong in base concepts, In the code shown below as you have seen, r4 is input argument for sub_37C2 where r4 is r0 + 6. And probably this function return r4 and r5. So, we ...
0
votes
1answer
30 views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...
0
votes
0answers
21 views

How does Andriod .so files Reverse Engineering with a dissasembler like IDA pro and Cutter work

So few days ago going through youtube Reverse Engineering videos, i came across a particular video where an android application was modified using IDA pro by disassembling it's .so file found in /lib ...
0
votes
0answers
27 views

Doubts about a pointer in a DLL

I am working with the dll of a software in which I am not with access at the moment, analyzing the source code in static analysis tools, I realized that it receives a pointer as one of the parameters, ...
0
votes
1answer
54 views

Cant recognise where is my targeted function executed

Im trying to recognise where is my targeted function int64 __fastcall sub_1400CE4F0(__int64 a1, const char *a2)executed. When stepping through this function, after return it's redirecting me here: if (...
0
votes
0answers
13 views

How to get the color of a operand in IDApython?

Lets say there is a instruction, and the operand is pink, is there any API call that i can use to get the color of the operand? i searched in their documentation but only found GetColor API which ...
0
votes
1answer
54 views

What is the use of moving a variable 3 times only to pass it back to the original register, with no calculations in between?

I'm reverse engineering a C++ binary using IDA, and there's one function that I don't quite understand. x = dword ptr -8 var_4 = dword ptr -4 push rbp movss rbp, rsp sub rsp, 10h movss [...
0
votes
0answers
73 views

C166/C167 code analyzing

Recently I try to reverse piece of assembly code that written for C166/C167 Arch. But I have a problem with some places for convert to C code, such as: loc_1892: mov r9, #4 add r9, r0 mov ...
0
votes
0answers
15 views

Get the string usage sequence in each function with Idapython?

The only function i know for this task is idautils.Strings() but the problem is i need to get the sequence of string usage in each function, meaning that if string 1 was first referenced then string ...
0
votes
0answers
28 views

Checking if a call is a API/Library call in IDApython?

I asked the question a while ago but found no answer so I'm trying my luck again the only solution is this : Finding all API calls in a function but it doesn't work when the library call is a .NET ...
0
votes
0answers
27 views

IDA debug Android native app receive SIGPWR signal cannot resume

I'm trying to debug an Unity game app mono. First i use frida to spawn app launch and attach app pid, second i pause app process,and then i run android_server with IDA take breakpoints in, finally ...
2
votes
1answer
83 views

Can I use python3 with IDA 7.0?

Got IDA Pro 7.0 (I can't update at the moment), I'm currently unable to use idapython. I have python3.8 installed on my machine and nothing else (I dont want any collisions). How can I use make ...
1
vote
2answers
173 views

Batch decompile using IDA Pro 7.5

I am trying to batch disassemble and decompile 500 binaries using the IDA Pro 7.5 disassember and Hex rays decompiler. I can get the .i64 output from the disassembler, but I do not have a way to batch ...
0
votes
0answers
29 views

Data XREF in IDAPro (C166/167 Arch)

try to reverse some algo in c167 arch. in a part of the file i saw a variable that located in XRAM mov to accumulator registers and finally xor with other registers. as below: mov r1, word_E1C4 ...
2
votes
3answers
2k views

Why can't you edit pseudo code?

Dabbler in re here, so potentially a stupid question... I know ida, binary ninja, and ghidra are really powerful at generating pseudo code. From everything I've read pseudo code can't be edited in ...
0
votes
0answers
43 views

Access to variable never stored to

I'm disassembling a Microsoft dll in IDA Pro, and there's one point where a value is loaded to a register from a location that has never been written to (it's the first location on the variables stack)...
0
votes
0answers
22 views

How to check in IDApython that if a call is an API/Library call or not?

I want to check for every call instruction whether its an API call or library call (statically linked that flirt recognized) The only solution i found is this : Finding all API calls in a function but ...
0
votes
0answers
33 views

Using IDAPython Problem in finding string avalilable in .idata section

I am new to ida pro and idapython In the following case i want to find the string reference "x is less than zero" while processing a block. Tested with following script but doesn't seems to ...
0
votes
1answer
66 views

IDA hex != String

, Hello. to learn reverse engineering, I would like to simply change a string via IDA. I select my string, get the adress, and select Change Bytes to get the Hex value : After That, I try to convert ...
1
vote
1answer
184 views

How to extract information from a binary file knowing the target info

I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
0
votes
0answers
37 views

Debug dll file used in python script IDA

I am fairly new to RE on windows. I have a python script which via ctypes uses functions from a dll. I don't know if it's possible, but I would like to debug the dll used in the python script (the dll ...
0
votes
0answers
75 views

Fix bad calling conventions in IDA

A binary I am studying puts the this pointer in rcx, followed by the rest of its arguments as its default convention. For some reason, IDA defaults to fastcall, but ignores the this pointer. This ...
0
votes
2answers
76 views

How does an executable’s static API differ from it’s dynamic API?

Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
0
votes
0answers
31 views

N64 ROM file index hacking issue

Alright, I downloaded the N64 SDK and compiled one of the samples provided by the SDK and dissembled the ROM with IDA and found the asset data is stored some way using index's so my question is. What ...
1
vote
0answers
39 views

Frida not able to trace sub_XXXXX which must have been called

I have the following pseudocode generated by IDA Pro decompiler: __int64 *__usercall sub_155B5@<X0>(__int64 *a1@<X0>, unsigned int a2@<W1>, char **a3@<X8>) { ... result = ...
2
votes
1answer
64 views

Reconstructing a PE from unpacked memory in IDA

I’m trying to byte patch a 12 year old program written in MS Visual C++ V9. However, some of its code has been packed with ‘Lock Express V2.0’. I’ve loaded the executable in IDA and run the Universal ...
0
votes
0answers
49 views

strange results with IDA (some function different Pseudo Code)

After show the pseudo code in IDA I see different results: The function 4436C0 show different pseudo code. For example: result = sub_4376C0("vvcbb3.wav",v8,0); and result = sub_4376C0((int)...
0
votes
0answers
22 views

How to paint running code with Ida gdb-server

I running IDA that is connected to gdb-server and I am using idapython with sark. I want to paint all lines that are running (while debug) in IDA. How can I do that?
0
votes
0answers
28 views

Finding RAM value in IDA Pro

At line #9 of a function, I have a variable that points to a RAM Cell. Actually I have a WORD at address E1C4. I would like to know how can I get value of this variable? I find a location where used ...
0
votes
2answers
61 views

Decode xor data in IDA

I have code that looks like this: byte_100031BA4 = v41; byte_100031BA5 ^= 0x3Eu; byte_100031BA6 ^= 0x47u; LOBYTE(a1) = -9; byte_100031BA7 ^= 0xF7u; byte_100031BA8 ^= 0xA9u; byte_100031BA9 ^= 0xE8u; ...
0
votes
1answer
51 views

How to run another IDA script using IDApython?

I'm using IDA batch scripting to run a script on a dataset of malware the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
0
votes
0answers
45 views

Can I reverse engineer a DLL file and add SEH or some error handing codes to it?

I am using some DLL files in my Java application using JNI library. The dlls are not written by me and I do not have access to their source codes. They are so buggy and throw lots of exceptions. ...
0
votes
1answer
38 views

ARM7 32-bit Branch Offset Calculator

I need to patch an arm7 program by replacing this fopen function by another function. .text:00018D68 52 D7 FF EB BL fopen ... .plt:0000EAB8 ; FILE *fopen(const ...

1
2 3 4 5
33