Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

400 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
9 votes
0 answers
393 views

replicate external bank switching in IDA Pro

I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
Sam Hanes's user avatar
  • 191
6 votes
0 answers
870 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
Misty's user avatar
  • 428
6 votes
0 answers
578 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
Zaid's user avatar
  • 111
6 votes
0 answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
crush's user avatar
  • 233
5 votes
0 answers
1k views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed the tutorial IDA Help: Debugging code snippets with QEMU. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: Should I adjust ...
Attila Szasz's user avatar
5 votes
0 answers
3k views

Can IDA generate C code for ASM assembly without the binary?

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
Mo Beigi's user avatar
  • 151
5 votes
0 answers
2k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
vdudouyt's user avatar
  • 171
5 votes
0 answers
3k views

Load multiple modules in one IDA database

I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and ...
Knochove's user avatar
4 votes
0 answers
224 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
R4444's user avatar
  • 1,797
4 votes
0 answers
113 views

How can I generated the function call graph (with API calls) of a .NET executable?

For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
OneAndOnly's user avatar
4 votes
0 answers
154 views

How can I learn VMP analysis?

I am currently interested in learning reverse engineering, and I have a foundation in assembly, PE structure, and the use of Win32Api. And also have some of the foundation for writing Windows drivers;...
Jack Lee's user avatar
4 votes
0 answers
824 views

Finding older IDA files

I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64. On the graph view it is only showing the main ...
securityauditor's user avatar
4 votes
0 answers
508 views

Does IDA Freeware 8.x support plugins?

According to the information I searched, it is not supported in IDA 7.x and before. Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before. refer:...
huang's user avatar
  • 223
4 votes
0 answers
295 views

How to debug windows EFI modules during boot using IDA Pro's windbg?

I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
OneAndOnly's user avatar
4 votes
0 answers
2k views

IDA Free vs IDA Home (to have Lumina)

I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function). I don't found in Google a tool to know for exemple the functions recognized by the ...
Benoit POTIER's user avatar
4 votes
0 answers
822 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
Martin Brooker's user avatar
4 votes
1 answer
541 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
Misty's user avatar
  • 428
4 votes
0 answers
263 views

IDA memory mirroring

I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF. How do I setup IDA to recognise memory mirroring.
dajolelor's user avatar
4 votes
0 answers
836 views

IDAPRO from command line interface: Exporting IDB file to BINEXPORT file

I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions: "<path-to-idaq.exe>" -A -OExporterModule:<result-...
Joyce Sin's user avatar
  • 141
4 votes
0 answers
319 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
Fewmitz's user avatar
  • 1,022
4 votes
0 answers
3k views

IDA pro and Bochs Debugger

I am debugging a shellcode in IDA Pro IDA Pro version: 6.1.011 (32-bit) Bochs version: 2.6.2 I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want ...
Neon Flash's user avatar
3 votes
0 answers
53 views

How can I create an `__m128i` datatype with Frida?

I'm working on reversing a c++ binary and it has a function that I want to call with Frida. Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1); It doesn't seem ...
Myles Hollowed's user avatar
3 votes
0 answers
122 views

IDA Pro debugging an ARM binary on windows with QEMU

I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging&...
IRP_HANDLER's user avatar
3 votes
0 answers
201 views

IDA ATL C++ class reconstruction

I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
short dragon's user avatar
3 votes
0 answers
333 views

How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?

I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
Eugene Muzychenko's user avatar
3 votes
0 answers
52 views

Contents of EAX in IDA Free?

I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges. In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is ...
securityauditor's user avatar
3 votes
0 answers
74 views

Using "map to another variable" in IDA

I am using in IDA. There is a feature which is called "map to another variable". but it asks from me to map from the variable from a list. How do u know the exact variable to map into ? (I ...
hat1bx's user avatar
  • 31
3 votes
0 answers
147 views

IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?

I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
none32's user avatar
  • 111
3 votes
0 answers
77 views

Where can I find documentation for IDA Freeware?

I have looked at the official documentation page and it doesn't have an entry for IDA Freeware. Is it available at all? Is there a popular unofficial one? Do I just read the one for IDA Pro?
edddd's user avatar
  • 131
3 votes
0 answers
37 views

How to view a QJsonValue while debuging exe with IDA

I'm step by step debugging a program in IDA. The program uses the Qt-toolkit. The function that I'm stepping through is handling a json document. For example here it is accessing the key workgroup and ...
user42984's user avatar
3 votes
0 answers
61 views

IDA remote GDB debugger cannot suspend linux machine

I am starting Debugging Linux Virtual Machine by IDA GDB debugger. I can say I am able to connect to process (0) and start the machine (by using IDA 32bit, IMO it has something to do with bios! or I ...
MrG_1900's user avatar
3 votes
0 answers
233 views

What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?

I’m disassembling binaries in IDA Pro. It usually takes 15+ minutes just to pre-process/open one binary, Then another 20-30 min before IDA is fully done disassembling and finally becomes idle. ...
Jacob Wheeler's user avatar
3 votes
0 answers
79 views

purpose for using a == &a

I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file WPP_GLOBAL_Control == &WPP_GLOBAL_Control Actually, I have seen this kind of ...
anonymous bear's user avatar
3 votes
0 answers
100 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
the_endian's user avatar
  • 1,830
3 votes
0 answers
39 views

Find location to override PC by stack frame with stackoverflow

I have stackoverflow in MIPS arch (without ASLR/canary) In Ida I see that the buffer that has the overflow located in SP+200 In the beginning if function I can see the stack size because I see the ...
Kokomelom's user avatar
  • 281
3 votes
0 answers
869 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
hanan's user avatar
  • 309
3 votes
0 answers
257 views

Disable IDA Downloading Symbols Automatically

How can I disable IDA Downloading symbols? It pops up everytime I attach to a remote process. It is really annoying.
n0n4meRE's user avatar
3 votes
0 answers
324 views

How to print a manually defined struct in IDA pro while debugging?

Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members. Now if i have the variables'...
OneAndOnly's user avatar
3 votes
0 answers
392 views

Cannot load pdb in IDA Free 7.6

I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach. I have just installed the last version of free IDA (7.6) ...
cactuschibre's user avatar
3 votes
0 answers
304 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
jafarlihi's user avatar
  • 131
3 votes
0 answers
145 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
Kolopoi's user avatar
  • 31
3 votes
0 answers
61 views

Is there a way to resume execution of a process for a given amount of time then suspend it?

I am using the following IDC script in IDA: #include <idc.idc> static main() { for (i=0; i<10; i++) { PauseProcess(); ...
tigrou's user avatar
  • 371
3 votes
0 answers
138 views

How to go to the variable's stored location directly in decompiler mode of IDA?

When i'm debugging a code in decompiler mode, one problem i face is that when i double click on a variable, it goes to "stack locations" instead of the actual address that the variable/...
Notoriouss's user avatar
3 votes
0 answers
2k views

how to get all "called functions" in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
R4444's user avatar
  • 1,797
3 votes
0 answers
1k views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
xiaoyao Don's user avatar
3 votes
0 answers
282 views

Display open handle ids in IDA Pro

Is there a way to display all the open handles of a process in IDA Pro while debugging it? I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server. I want to ...
Neon Flash's user avatar
3 votes
0 answers
51 views

IDA's debuggers disappeared

Using IDA 7 I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
Tom Young's user avatar
3 votes
0 answers
51 views

How to prepend offset to smart names?

So I'm trying to reassemble an PE to ELF so I can debug it with rr. However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
rec's user avatar
  • 475
3 votes
0 answers
292 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
nitro2k01's user avatar
  • 131
3 votes
0 answers
914 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
solumnant's user avatar
  • 173

1
2 3 4 5
8