Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

344 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
7 votes
0 answers
328 views

replicate external bank switching in IDA Pro

I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
user avatar
  • 171
6 votes
0 answers
666 views

Reliable way to recognize STL template classes?

Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns. But the control flow graph and references to system call of ...
user avatar
  • 378
6 votes
0 answers
497 views

How does my S62 engine utilize MAF sensors to convert voltage to mass flow?

We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
user avatar
  • 111
6 votes
1 answer
2k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
user avatar
5 votes
2 answers
939 views

Attach Shared Object to android process with IDA

I am: working with an Android game, using an Android Emulator, and trying to attach an android .so library to a process. I have the whole IDA server set up, I can attach to processes when a classes....
user avatar
5 votes
0 answers
1k views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed the tutorial IDA Help: Debugging code snippets with QEMU. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: Should I adjust ...
user avatar
5 votes
0 answers
3k views

Load multiple modules in one IDA database

I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and ...
user avatar
4 votes
0 answers
226 views

IDA memory mirroring

I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF. How do I setup IDA to recognise memory mirroring.
user avatar
4 votes
0 answers
586 views

IDAPRO from command line interface: Exporting IDB file to BINEXPORT file

I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions: "<path-to-idaq.exe>" -A -OExporterModule:<result-...
user avatar
  • 141
4 votes
0 answers
2k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
user avatar
  • 161
4 votes
0 answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
user avatar
  • 213
3 votes
0 answers
105 views

Cannot load pdb in IDA Free 7.6

I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach. I have just installed the last version of free IDA (7.6) ...
user avatar
3 votes
0 answers
787 views

disassembly - bad results generated with ghidra but not with objdump and IDA

I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors). But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
user avatar
3 votes
0 answers
564 views

IDA Hex-Rays structure inline functions recognition

I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve. I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
user avatar
3 votes
0 answers
45 views

IDA's debuggers disappeared

Using IDA 7 I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
user avatar
3 votes
0 answers
49 views

How to prepend offset to smart names?

So I'm trying to reassemble an PE to ELF so I can debug it with rr. However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
user avatar
  • 383
3 votes
0 answers
149 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
user avatar
  • 131
3 votes
0 answers
565 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
user avatar
  • 153
3 votes
0 answers
372 views

Cannot debug some drivers with IDA

For some drivers I can use the following WinDBG command: bu driver!DriverEntry However there are some drivers that cannot be debugged this way. IDA output window displays the following error message:...
user avatar
  • 31
3 votes
0 answers
1k views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
user avatar
  • 131
3 votes
0 answers
165 views

Anti-debug that can broke programm links (branches)?

I met the unknown (for me) method of anti-debugging today, while debugging in IDA Pro. This method delete fast all branches in file and the programm will look similar like on the image: ...
user avatar
  • 31
3 votes
0 answers
2k views

IDA LoadLibraryError

I installed IDA Demo today, however I'm having a bit of trouble installing plugins. I'm trying to install a plugin called 'ClassInformer'. I followed all the instructions, editing the plugins.cfg file,...
user avatar
3 votes
0 answers
330 views

What does this enum mean (IDA Pro)?

Trying to teach myself how to use IDA Pro, and I'm stuck trying to understand this enum: enum Input::Action, copyof_42, bitfield Local type 42 is defined as: typedef ChunkStatus::Enum who's enum ...
user avatar
3 votes
0 answers
93 views

Catch function flags change event in IDA plugin

Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it ...
user avatar
  • 131
3 votes
0 answers
3k views

Can IDA generate C code for ASM assembly wihtout the binary

Lets say I have this picture of some assembly: Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
user avatar
  • 131
3 votes
0 answers
291 views

IDA: How to automatically resolve references to Imports in modules loaded manually?

every time a program is loaded manually (allocating memory for the PE image, copying sections, resolving imports, relocations, etc ) I need to use C ( define code ) and P (create procedure/function) ...
user avatar
  • 31
3 votes
0 answers
751 views

Sharing IDC file between versions 5 and 6 of IDA pro

I am using version 6 of IDA because it is the only one that works on Mac. My colleague is using IDA 5. We would like to collaborate by sending the an IDC file back and forth. However, the IDC file ...
user avatar
3 votes
0 answers
376 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
user avatar
  • 496
3 votes
0 answers
568 views

Where is uni.inc file?

In the IDA Pro generated asm code, I see this line: include uni.inc ; see unicode subdir of ida for info on unicode I don't find unicode subdir nor do I find uni.inc file... Could any one give me ...
user avatar
3 votes
0 answers
314 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
user avatar
  • 972
3 votes
0 answers
3k views

IDA pro and Bochs Debugger

I am debugging a shellcode in IDA Pro IDA Pro version: 6.1.011 (32-bit) Bochs version: 2.6.2 I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want ...
user avatar
2 votes
0 answers
69 views

Strange exception thrown while debugging in Win10, but not Win7

I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
user avatar
2 votes
0 answers
80 views

calculate memory address from IDA to use with Frida

I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address. I debug an Android application with Frida, how can I put this address in Frida to watch this value? I ...
user avatar
  • 21
2 votes
0 answers
66 views

How do relocations work for imported functions in SH4 ELF?

I build very simple hello world code with sh4 gcc compiler as shared library: #include <stdio.h> void hello() { printf("Hello world!\n"); } But when I load .so file into the ...
user avatar
  • 1,740
2 votes
0 answers
107 views

How to print a manually defined struct in IDA pro while debugging?

Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members. Now if i have the variables'...
user avatar
2 votes
0 answers
79 views

Understanding Hex-Rays syntax

I have a Ida decompiled function that invokes another function through a function pointer but I'm really confused how it calculates it's address. I'm new to hex-rays syntax. int __fastcall SUB_XXXX(...
user avatar
  • 73
2 votes
0 answers
104 views

How to disassemble win32 function RegSetValueExW?

I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern. How do I actually disassemble RegSetValueExW_0?
user avatar
  • 121
2 votes
0 answers
89 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
user avatar
  • 21
2 votes
0 answers
45 views

Is there a way to resume execution of a process for a given amount of time then suspend it?

I am using the following IDC script in IDA: #include <idc.idc> static main() { for (i=0; i<10; i++) { PauseProcess(); ...
user avatar
  • 331
2 votes
0 answers
55 views

How to go to the variable's stored location directly in decompiler mode of IDA?

When i'm debugging a code in decompiler mode, one problem i face is that when i double click on a variable, it goes to "stack locations" instead of the actual address that the variable/...
user avatar
2 votes
0 answers
49 views

IDA stack depth differences when branching

I'm decompiling some Direct3D code that makes a lot of indirect calls to __stdcall functions. For example: call dword ptr [edx+0xC8h] which is really: pD3DDevice->SetRenderState(); IDA doesn't ...
user avatar
2 votes
0 answers
168 views

Display open handle ids in IDA Pro

Is there a way to display all the open handles of a process in IDA Pro while debugging it? I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server. I want to ...
user avatar
2 votes
0 answers
2k views

How to proceed after running binwalk on this firmware?

I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP So far I've used binwalk and gotten the following output: ...
user avatar
  • 1,605
2 votes
1 answer
298 views

Can somebody explain this weird alignment/optimisation done when zeroing out a buffer?

I have the following disassembly which looks like a buffer being populated with zeros in a loop, however, I'm confused at why the alignment is needed here (if a jump will always be 4-bytes, why does ...
user avatar
2 votes
0 answers
77 views

IDA pro 7... how do you tell which module each string is in?

In IDA pro 7, when you generate the list of stirngs in the strings window, it gives you an "address" which starts with something like "debug12x"... is there any way to tell which module that is in? Or ...
user avatar
  • 51
2 votes
0 answers
175 views

How to handle flags that affect instruction decoding in IDA processor modules?

I am writing a processor module for the Oki6620* architecture. Like ARM's Thumb mode or m7700's M flag, this architecture has a special flag that affects instruction decoding, named DD (Data ...
user avatar
  • 121
2 votes
0 answers
124 views

removing bios wireless white listing

I am trying to remove the white listing for wireless cards from my Thinkpad L540 running Debian Buster. I did the following steps: booted with kernel parameter iomem=relaxed used pawn to dump BIOS ...
user avatar
  • 121
2 votes
1 answer
342 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
user avatar
  • 378
2 votes
0 answers
186 views

How to return a list of vtable methods?

I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
user avatar
  • 1,196
2 votes
0 answers
234 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
user avatar

1
2 3 4 5
7