Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
365
questions with no upvoted or accepted answers
9
votes
0
answers
361
views
replicate external bank switching in IDA Pro
I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
- 191
6
votes
2
answers
1k
views
Attach Shared Object to android process with IDA
I am:
working with an Android game,
using an Android Emulator,
and trying to attach an android .so library to a process.
I have the whole IDA server set up, I can attach to processes when a classes....
- 61
6
votes
0
answers
746
views
Reliable way to recognize STL template classes?
Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.
But the control flow graph and references to system call of ...
- 428
6
votes
0
answers
546
views
How does my S62 engine utilize MAF sensors to convert voltage to mass flow?
We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
- 111
6
votes
0
answers
2k
views
Why does Hex-rays thinks that 32bit PE is 16bit?
I'm using IDA 6.1 32-bit version.
I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
- 233
5
votes
0
answers
1k
views
I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process
I followed the tutorial IDA Help: Debugging code snippets with QEMU.
It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this:
Should I adjust ...
- 51
5
votes
0
answers
3k
views
Can IDA generate C code for ASM assembly without the binary?
Lets say I have this picture of some assembly:
Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
- 151
5
votes
0
answers
2k
views
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
- 171
5
votes
0
answers
3k
views
Load multiple modules in one IDA database
I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and ...
- 51
4
votes
1
answer
416
views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
- 428
4
votes
0
answers
247
views
IDA memory mirroring
I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF.
How do I setup IDA to recognise memory mirroring.
- 41
4
votes
0
answers
677
views
IDAPRO from command line interface: Exporting IDB file to BINEXPORT file
I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions:
"<path-to-idaq.exe>" -A -OExporterModule:<result-...
- 141
4
votes
0
answers
317
views
funcap not capturing information in IDA debugger
I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
- 1,022
4
votes
0
answers
3k
views
IDA pro and Bochs Debugger
I am debugging a shellcode in IDA Pro
IDA Pro version: 6.1.011 (32-bit)
Bochs version: 2.6.2
I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want ...
- 735
3
votes
0
answers
143
views
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.
Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.
refer:...
- 203
3
votes
0
answers
48
views
Cutter failing to XREF even a simple 1 line 'Hello world'
The disassembler yields 0 reference to the "Hello world" string!
Anyone knows what might be the issue?
IDA 8.2 Free and Ghidra find and shows the XREF as they are supposed to.
3
votes
0
answers
85
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 369
3
votes
0
answers
207
views
Cannot load pdb in IDA Free 7.6
I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach.
I have just installed the last version of free IDA (7.6) ...
- 141
3
votes
0
answers
1k
views
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).
But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
- 51
3
votes
0
answers
230
views
Display open handle ids in IDA Pro
Is there a way to display all the open handles of a process in IDA Pro while debugging it?
I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server.
I want to ...
- 735
3
votes
0
answers
701
views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
3
votes
0
answers
50
views
IDA's debuggers disappeared
Using IDA 7
I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
- 31
3
votes
0
answers
50
views
How to prepend offset to smart names?
So I'm trying to reassemble an PE to ELF so I can debug it with rr.
However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
- 425
3
votes
0
answers
204
views
Telling IDA that all references to an address range belong to the same segment
For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
- 131
3
votes
0
answers
774
views
How does IDA apply its FLIRT signatures and how are they licenced?
I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
- 173
3
votes
2
answers
548
views
Can't trace MIPS embedded device remotely
I'm trying to debug a remote device using gdbserver and IDA Pro.
I'm attached to the correct PID and I'm able to step through instructions until the point where I redirect $pc to my ROP chain. At the ...
- 31
3
votes
0
answers
431
views
Cannot debug some drivers with IDA
For some drivers I can use the following WinDBG command:
bu driver!DriverEntry
However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
- 31
3
votes
0
answers
2k
views
STL map and map entry structures for IDA/HexRays
I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
- 131
3
votes
0
answers
169
views
Anti-debug that can broke programm links (branches)?
I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image:
...
- 31
3
votes
0
answers
477
views
getting the flags of an IDA name
IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc).
So far all is good and ...
- 11.6k
3
votes
0
answers
8k
views
Plugin directory in IDA?
According to IDA docs, we can put a Python plugin into $HOME/.idapro/plugins/ directory. But when I copied my Python plugin there & restart IDA, IDA still do not see that.
What can go wrong, and ...
- 193
3
votes
0
answers
2k
views
IDA LoadLibraryError
I installed IDA Demo today, however I'm having a bit of trouble installing plugins. I'm trying to install a plugin called 'ClassInformer'. I followed all the instructions, editing the plugins.cfg file,...
- 31
3
votes
0
answers
370
views
What does this enum mean (IDA Pro)?
Trying to teach myself how to use IDA Pro, and I'm stuck trying to understand this enum:
enum Input::Action, copyof_42, bitfield
Local type 42 is defined as:
typedef ChunkStatus::Enum
who's enum ...
3
votes
0
answers
95
views
Catch function flags change event in IDA plugin
Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it ...
- 131
3
votes
0
answers
297
views
IDA: How to automatically resolve references to Imports in modules loaded manually?
every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
- 31
3
votes
0
answers
848
views
Sharing IDC file between versions 5 and 6 of IDA pro
I am using version 6 of IDA because it is the only one that works on Mac. My colleague is using IDA 5. We would like to collaborate by sending the an IDC file back and forth.
However, the IDC file ...
- 161
3
votes
0
answers
384
views
Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA
I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
- 516
3
votes
0
answers
580
views
Where is uni.inc file?
In the IDA Pro generated asm code, I see this line:
include uni.inc ; see unicode subdir of ida for info on unicode
I don't find unicode subdir nor do I find uni.inc file...
Could any one give me ...
- 2,475
3
votes
0
answers
4k
views
Fixing the stackpointer in IDA when exception handlers are used
The code that I'm looking at uses exception handlers and it seems that the stack pointer is misscalculated in the case of the exception handler. I posted this function as an exmple in full, so that ...
- 963
2
votes
0
answers
29
views
IDA Pro 7, idc script to copy 8KB ROM to F000 Segment?
I updated an old .idc script so it will now copy 64kb of a 512kb BIOS file to the F000: Segment under IDA Pro (Free) 7 :
#include <idc.idc>
// The script relocates a copy of the highest 64 ...
- 21
2
votes
0
answers
27
views
Please help with striped binary reverse
Not so long ago I was engaged in reverse and pwn, I came across such a task
This is a normal task with a vulnerability on the heap, but it is striped and I don’t understand where which functions are
I ...
- 21
2
votes
0
answers
29
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
- 91
2
votes
0
answers
45
views
Why isn't IDA Freeware using my .idt file?
I'm trying to learn my way around IDA and using the IDA Free package. I've been trying to analyse a program that imports mfc140 which IDA Free doesn't ship signatures for.
I've loaded the .dll myself ...
- 121
2
votes
1
answer
81
views
Disassembling MS DOS code
cseg01:0001F4D8 mov Disk_Letter, 43h ; 'C'
cseg01:0001F4DF
cseg01:0001F4DF loc_1F4DF: ; CODE XREF: sub_1F4C8+60j
cseg01:0001F4DF xor ...
- 181
2
votes
0
answers
54
views
Where can I find documentation for IDA Freeware?
I have looked at the official documentation page and it doesn't have an entry for IDA Freeware. Is it available at all? Is there a popular unofficial one? Do I just read the one for IDA Pro?
- 121
2
votes
0
answers
29
views
How to view a QJsonValue while debuging exe with IDA
I'm step by step debugging a program in IDA.
The program uses the Qt-toolkit.
The function that I'm stepping through is handling a json document.
For example here it is accessing the key workgroup and ...
- 21
2
votes
0
answers
38
views
IDA remote GDB debugger cannot suspend linux machine
I am starting Debugging Linux Virtual Machine by IDA GDB debugger. I can say I am able to connect to process (0) and start the machine (by using IDA 32bit, IMO it has something to do with bios! or I ...
- 21
2
votes
0
answers
59
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 119
2
votes
0
answers
26
views
Find location to override PC by stack frame with stackoverflow
I have stackoverflow in MIPS arch (without ASLR/canary)
In Ida I see that the buffer that has the overflow located in SP+200
In the beginning if function I can see the stack size because I see the ...
- 151
2
votes
1
answer
748
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6.
I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
- 121
Hot Network Questions
- Are you supposed to paint the spoke nipples?
- How can I properly plot this region, with some filling too?
- For SOQL queries, can "WITH USER_MODE" safely replace "WITH SECURITY_ENFORCED"?
- What is the difference between text alignment, text justification, and quadding?
- How to implement logical or for existence of one of a list of member functions in requires expression?
- I was asked to reimburse the flight ticket after I cancelled the on-site interview
- Which SQL Server Manager should I use: C:\Windows\System32 or C:\Windows\SysWOW64?
- Non-dairy Substitute for meat to protect from tomato acid
- Why is the ICC focusing on the transfer of war orphans to Russia rather than Russia's much more obvious crimes in Ukraine?
- Gotham episode where the term 'black market' was taken literally
- Two polynomials which are "completely" coprime
- How can I signal to others on my flight that I want to make friends and chat?
- Do casters become experts with Class DC?
- Does this downspout design make sense?
- Does the NEC allow a sub panel to be powered by a generator and an automatic transfer switch?
- What is the textual source for the original ending of Austen's Persuasion?
- Issues to avoid when writing military sci-fi?
- Sorting a list by a single particular element in a specified order
- How does quantum mechanics explain the color of macroscopic objects?
- what’s the difference between errands and shopping?
- How to check if QGIS is using RPC or not or on my image?
- Post-apocalyptic sci-fi book about a man with metal spikes in his head, like a crown of thorns, who is worshipped by rats
- Is there a way to rehearse being in a stressful performance situation?
- Did Russia communicate President Vladimir Putin's planned Mariupol visit to Ukraine for deconfliction purposes?