Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

348 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6
votes
0answers
244 views

replicate external bank switching in IDA Pro

I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
6
votes
0answers
625 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
6
votes
0answers
443 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
5
votes
0answers
924 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
5
votes
1answer
2k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
4
votes
0answers
478 views

IDAPRO from command line interface: Exporting IDB file to BINEXPORT file

I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions: "<path-to-idaq.exe>" -A -OExporterModule:<result-...
4
votes
1answer
831 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
4
votes
0answers
1k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
4
votes
0answers
2k views

Load multiple modules in one IDA database

I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and ...
4
votes
0answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
3
votes
0answers
356 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
3
votes
0answers
297 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
3
votes
0answers
41 views

IDA's debuggers disappeared

Using IDA 7 I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
3
votes
0answers
44 views

How to prepend offset to smart names?

So I'm trying to reassemble an PE to ELF so I can debug it with rr. However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
3
votes
1answer
208 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
3
votes
0answers
642 views

loading memory dump into ida pro?

I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
3
votes
0answers
223 views

How do I resolve addresses relative to a register in IDA?

I am reversing an x86 ELF shared object library. Perhaps because of position independence, all functions begin with loading a constant offset into a register: [... function prologue ...] call $+5 ...
3
votes
0answers
939 views

Obtaining the decryption keys for Super Mario Run (Android/iOS Game)

Super Mario Run is a il2cpp Unity game. Most of its assets are downloaded in-game through http requests. I particularly want the OGG files of the music. I can see the list of their names comes from ...
3
votes
0answers
936 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
3
votes
0answers
2k views

IDA LoadLibraryError

I installed IDA Demo today, however I'm having a bit of trouble installing plugins. I'm trying to install a plugin called 'ClassInformer'. I followed all the instructions, editing the plugins.cfg file,...
3
votes
0answers
284 views

What does this enum mean (IDA Pro)?

Trying to teach myself how to use IDA Pro, and I'm stuck trying to understand this enum: enum Input::Action, copyof_42, bitfield Local type 42 is defined as: typedef ChunkStatus::Enum who's enum ...
3
votes
0answers
90 views

Catch function flags change event in IDA plugin

Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it ...
3
votes
0answers
2k views

Can IDA generate C code for ASM assembly wihtout the binary

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
3
votes
0answers
279 views

IDA: How to automatically resolve references to Imports in modules loaded manually?

every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
3
votes
0answers
551 views

Sharing IDC file between versions 5 and 6 of IDA pro

I am using version 6 of IDA because it is the only one that works on Mac. My colleague is using IDA 5. We would like to collaborate by sending the an IDC file back and forth. However, the IDC file ...
3
votes
0answers
356 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
3
votes
0answers
516 views

Where is uni.inc file?

In the IDA Pro generated asm code, I see this line: include uni.inc ; see unicode subdir of ida for info on unicode I don't find unicode subdir nor do I find uni.inc file... Could any one give me ...
3
votes
0answers
302 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
2
votes
0answers
35 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
2
votes
0answers
74 views

How to find “in degree” of chunks divided by ida pro?

I am working on IDA pro. I am splitting an executable in multiple chunks. My purpose is to calculate the possible ways any chunk can be traversed. There might be multiple ways that any particular ...
2
votes
0answers
42 views

Is there a way to resume execution of a process for a given amount of time then suspend it?

I am using the following IDC script in IDA: #include <idc.idc> static main() { for (i=0; i<10; i++) { PauseProcess(); ...
2
votes
0answers
45 views

How to go to the variable's stored location directly in decompiler mode of IDA?

When i'm debugging a code in decompiler mode, one problem i face is that when i double click on a variable, it goes to "stack locations" instead of the actual address that the variable/...
2
votes
0answers
40 views

IDA stack depth differences when branching

I'm decompiling some Direct3D code that makes a lot of indirect calls to __stdcall functions. For example: call dword ptr [edx+0xC8h] which is really: pD3DDevice->SetRenderState(); IDA doesn't ...
2
votes
1answer
233 views

How to extract information from a binary file knowing the target info

I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
2
votes
0answers
49 views

Display open handle ids in IDA Pro

Is there a way to display all the open handles of a process in IDA Pro while debugging it? I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server. I want to ...
2
votes
1answer
413 views

Decrypting some possibly XXTEA encrypted lua/game files

I am trying to extract assets from a Chinese game, I downloaded the apk file and unzipped it. I looked through the files and they are encrypted in some ways, the PNGs and LUAs are unviewable. The ...
2
votes
0answers
574 views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
2
votes
0answers
56 views

IDA pro 7… how do you tell which module each string is in?

In IDA pro 7, when you generate the list of stirngs in the strings window, it gives you an "address" which starts with something like "debug12x"... is there any way to tell which module that is in? Or ...
2
votes
0answers
96 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
2
votes
0answers
71 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
2
votes
0answers
107 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
2
votes
0answers
336 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
2
votes
2answers
311 views

Bochs x86 16bit and IDA dissasembly

I have been trying a figure out how to get Bochs to run an x86 embeded firmware rom so I can disassemble while emulating. When I start the debug in ida bochs just says "wrong segmentation". Loading in ...
2
votes
0answers
112 views

How to return a list of vtable methods?

I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
2
votes
0answers
186 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
2
votes
1answer
175 views

IDA memory mirroring

I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF. How do I setup IDA to recognise memory mirroring.
2
votes
0answers
99 views

SIGBUS when trying to trace functions?

I am working on a crackme (Mach-O, mac app). Now, the app itself is weird and I honestly don't really know where to start. There are multiple threads and the main function doesn't really tell me ...
2
votes
0answers
270 views

Unable to figure out how to map segments in IDA

I have a 2 MB executable that I'm attempting to reverse engineer. It's executed on a 16-bit 8086 CPU. The segments go from 4000 (0x140000) to F000 (0x1F0000). I'm attempting to map the segments in ...
2
votes
0answers
190 views

IDA rename argument in all xrefs to function

I have a function of the format: sub_ABCDEF(&global, "stringName", unimportantValue) push offset string mov ecx, offset global call sub_410010 That is called in several places, each ...
2
votes
2answers
427 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...

1
2 3 4 5
7