Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
2,040
questions
329
votes
16
answers
411k
views
Is there any disassembler to rival IDA Pro?
Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
- 4,108
42
votes
1
answer
93k
views
Decompiling iPhone App
I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
- 429
37
votes
3
answers
23k
views
What is a FLIRT signature?
I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
- 4,006
34
votes
4
answers
15k
views
How to reverse engineer a Windows 10 UWP app?
I wanted to see what Microsoft are doing when you click "Restart now" button in their Settings -> Update window on Windows 10:
Somehow the results are not the same what is available via ...
- 1,437
32
votes
5
answers
11k
views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
- 2,475
27
votes
6
answers
3k
views
Tools to work cooperatively on the same binary
What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work?
I used various methods long ago to share information with others, but not ...
- 6,624
25
votes
1
answer
7k
views
How to reattach tabs in IDA?
I feel dumb for needing to ask, but I've been annoyed by this several times in the past and have yet to come across the answer.
Sometimes, when rearranging tabs in IDA Pro, I accidentally detach the ...
- 731
23
votes
7
answers
7k
views
How is a structure located within a disassembled program?
I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...
- 333
22
votes
1
answer
6k
views
Static analysis of C++ binaries
When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
- 1,214
21
votes
1
answer
17k
views
How to organize vtables in IDA Pro?
I am using IDA Pro to disassemble a C++ behemoth with 1600+ classes, many of them having pure virtual methods.
Some classes also are made up of multiple base classes, in hierarchies 5+ levels deep.
...
- 367
20
votes
1
answer
39k
views
How to debug the DLL of an EXE using IDA Pro?
I'm fairly new to the RE world, started right around a week and have gotten my hands dirty with some really good stuff on this website. Pardon my naive knowledge.
Currently, I'm trying to reverse a ...
- 345
19
votes
3
answers
15k
views
In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?
The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
- 10.6k
18
votes
3
answers
5k
views
What are nullsub_ functions in IDA?
In nearly every dis-assembly created by IDA, there are several functions that are marked nullsub_ which according to IDA, return null nothing (just ret instruction).
So, what are those and why are ...
- 2,972
18
votes
3
answers
14k
views
Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?
I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
- 191
18
votes
1
answer
16k
views
How do you search for unicode strings?
In all versions of IDA, I can't seem to be able to search for unicode strings. When reversing programs, I constantly see unicode strings that could have really helped if I could see them in the ...
user24091
17
votes
6
answers
22k
views
What is a free & open source alternative to IDA Pro for MacOS?
I am looking for a free & open source alternative to IDA Pro runs on MacOS - the suggestions should have as close to the features of IDA as possible. I should also be able to edit an executable ...
user20964
17
votes
1
answer
28k
views
How to re-analyse a function in IDA Pro?
I am working on an obfuscated binary. IDA did pretty good job distinguishing code from junk. However, I had started messing around with a function changing from code to data and vice versa and ...
- 3,058
17
votes
3
answers
8k
views
Parsing/Rescuing corrupted IDA database
I'm reversing an application with IDA.
My VM crashed and left the IDA database in a corrupted unpacked state.
The next time I tried to load it back, IDA gave me the following error message: The ...
- 1,998
17
votes
3
answers
6k
views
How to debug an IDAPython script from within IDA?
IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
- 173
16
votes
4
answers
15k
views
What are the essential IDA Plugins or IDA Python scripts that you use? [closed]
I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
- 7,432
16
votes
1
answer
6k
views
IDA EBP variable offset
Let's take a look of how IDA displays address of local variable. For instance:
MOV EAX, [EBP + var_4]
As we all know as far as local variables go, they are located at lower addresses of EBP.
Though,...
- 3,058
16
votes
2
answers
2k
views
Is there an actively maintained collaboration plugin for IDA?
There are many IDA Pro plugins that assist with collaboration, but are any actively maintained and known to work with the latest version of IDA (version 6.9)?
These are the tools that I'm aware of, ...
- 179
15
votes
3
answers
10k
views
Which calling convention to use for EAX/EDX in IDA
I have some code (I assume Delphi) which uses only the EAX and EDX register for passing the arguments (and of course the stack if more are required). I looked which calling conventions would match, ...
- 963
15
votes
1
answer
2k
views
Treating independent code as a function in IDA Pro
When reverse engineering programs, I often find functions like the one below. This function in particular has a set of nested if/else blocks (pink boxes) which would typically be fairly easy to ...
- 1,306
14
votes
2
answers
2k
views
How do you set registers as structs within a function in IDA?
For example, in the following disassembly:
.text:007C6834 014 mov eax, [esi+4]
.text:007C6837 014 mov dword ptr [esi], offset ??_7CAvatar@@6B@ ; const CAvatar::...
- 1,208
14
votes
4
answers
7k
views
Creating IDA Pro debugger plugins - API documentation and examples?
Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
14
votes
1
answer
4k
views
Is there an equivalent of 'Run trace' as in OllyDbg for IDA PRO?
I have been looking for the equivalent of the "Run Trace" option of OllyDbg in IDA Pro. Can anyone mention if there is one and how to use it ?
- 437
13
votes
2
answers
16k
views
IDA Convert to Unicode
In IDA 5.0 Freeware how do you convert a block of data into a unicode string, the only thing I can find is to convert it into an ascii string.
db 'a'
db 0
db 'b'
db 0
db 'c'
db 0
db 'd'
db 0
db 0
db ...
- 1,208
12
votes
5
answers
3k
views
Artifacts similar to "@YAXPAX@" within memory and IDA sessions
When reversing binaries and parsing memory, I often run across strings like "@YAXPAX@" used to reference procedures. Is there a name for this type of convention?
I believe theses strings are symbol ...
- 123
12
votes
2
answers
5k
views
How to map an arbitrary address to its corresponding basic block in IDA?
Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that?
Edit:
more specifically, I want to know the beginning / end of ...
- 1,183
12
votes
2
answers
3k
views
Detecting recursive functions in IDA
How can I detect/mark recursive functions in IDA?
Trivial method would be to check every function's call list and if it calls itself then it's recursive. I'ld like to put a comment or some kind of ...
- 1,998
12
votes
4
answers
5k
views
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
- 323
12
votes
1
answer
620
views
Are those code snippets and file paths in a C++ binary some sort of standard debug information?
This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info.
Is this something standard? (Is this RTTI)
If so, how is this called?
Are there ...
- 3,009
12
votes
3
answers
2k
views
IDA plugin/script for generating signature statistics (for all sigs) for a target?
I have more than 40 different IDA signature files (besides the built-in ones) and sometimes I don't want to go through the hassle of examining what signatures may be relevant for a given target. ...
- 221
11
votes
2
answers
23k
views
How do I know the bytes corresponding to an instruction in Hex view in IDA?
When I select an assembly instruction in IDA graph view, I want to see the exact bytes corresponding to the selected instruction when I switch to He view in IDA. How do I do that?
- 1,301
11
votes
4
answers
8k
views
How can I change the Read/Write/Execute flags on a segment in IDA?
Sometimes when you load a binary manually in IDA you wind up with segments that have unknown read write and execute flags. You can see them under the Segments subview (Shift + F7). Is there a way to ...
- 5,611
11
votes
5
answers
12k
views
How to find offsets in OllyDBG from IDA
I'm currently trying to gain some practice in RE and I need some help for patching a DLL.
Here are my steps:
I first analyze the main program and the dll in IDA trying to understand the logic. I then ...
- 121
11
votes
3
answers
21k
views
How to decompile an Objective-C static library (for iOS)?
I'm trying to use IDA Pro v6.5 (freeware) (demo) to decompile an objective-c library compiled for ARM7-7S. I tried Hopper v2.8.8 (freeware) with no success.
I had no problem until I tried to display ...
- 213
11
votes
4
answers
6k
views
Best alternatives to IDA Pro, Immunity and OllyDbg for a blind user
I am totally blind and want to learn to do reverse engineering so I can advance my career. Unfortunately, IDA Pro, Immunity and OllyDbg are all not accessible to a blind person using a screenreader.
...
- 379
11
votes
1
answer
802
views
Hex-Rays Decompiler: Buffer on the stack
I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...
- 383
11
votes
2
answers
5k
views
What to do when IDA cannot provide a function name?
For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the ...
- 215
11
votes
2
answers
15k
views
How to display memory zones content on IDA Pro?
This is a very naive question about IDA Pro. Once the IDA debugger started, I would like to be able to type a memory address (or a memory zone) and look easily at the content of it (in various format)....
- 18.5k
11
votes
1
answer
13k
views
What is the difference between step into and step over when debugging?
I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
- 385
11
votes
1
answer
9k
views
Could you list some useful plugins and scripts for IDA Pro? [closed]
I am just starting to use IDA Pro. After discussing a bit with the community, it seems that IDA Pro plugins and scripts are quite important to reach a good level of productivity while analyzing a ...
11
votes
2
answers
3k
views
Hooking to a function with variable argument list
I am using Detours 3.0 to hook onto a function I obtained from Ida Pro. The problem is I came across a function which I cannot seem to hook which is due to either invalid arguements or the fact that ...
- 111
11
votes
1
answer
5k
views
What makes CDMs such as Widevine hard to reverse engineer?
According to this PDF, Widevine has three security levels. The least secure one, and the one used by Chrome on desktops is level 3 in which all decryption is done outside of a Trusted Execution ...
- 111
10
votes
3
answers
100k
views
How to obtain x86-64 pseudocode in IDA Pro?
Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
- 109
10
votes
2
answers
5k
views
Why does IDA add "db" statements between disassembled code
I'm trying to analyze a MS-DOS COM file that I wrote a few years ago with IDA Free 5.0, I've since renamed the segment to code_and_data and named constants and set data types correctly. However, when ...
- 203
10
votes
2
answers
8k
views
Mixed 16/32-bit code reversing using IDA
I am trying to reverse engineer a binary blob I expect to transition from 16-bit real mode into 32-bit protected mode (it is boot time code), so I expect the code to contain code of both sorts.
When ...
user1797
10
votes
1
answer
6k
views
Extracting arguments from IDA
Let's say I have the following function in IDA:
int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>)
What's the fastest way to extract the argument information ...
- 2,307