Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
11
votes
2answers
12k views

How to display memory zones content on IDA Pro?

This is a very naive question about IDA Pro. Once the IDA debugger started, I would like to be able to type a memory address (or a memory zone) and look easily at the content of it (in various format)....
7
votes
2answers
3k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
4
votes
1answer
3k views

Do IDA Python plugins work with IDA free or only IDA pro? [closed]

For example, the plugin fluorescence.py is a very small tool that adds a choice in the "Options" menu of IDA to highlight call instructions. It is supposed to work upon dropping it into the plugins ...
15
votes
3answers
3k views

What are nullsub_ functions in IDA?

In nearly every dis-assembly created by IDA, there are several functions that are marked nullsub_ which according to IDA, return null nothing (just ret instruction). So, what are those and why are ...
8
votes
2answers
2k views

C-sky CPU reverse-engineering

I am trying to RE a firmware for a TV STB, its based on a GX3201 chip which is based on C-sky CPU (CK610M I think). I am stuck in the following points : I am not able to properly identify the CPU ...
7
votes
2answers
2k views

Importing C header file with memory location definitions

Bear with me as I am new to IDA and have not managed to find an answer to my question on google or other related outlets. I am reversing a firmware blob from an ARM device of which I have a c header ...
7
votes
1answer
3k views

Zte Reverse engineering config.bin file problem

I just got a Zte ZXHN F660 GPON ONT Wireless router with my optic fiber internet provided by my telecom provider. My first discovery was that the eth Lan ports are bricked wich means I can only use ...
5
votes
1answer
1k views

How to display dump data in IDA Debugger?

Bit of a noob question, I'm working through some examples on crackmes. In Ollydbg and x64dbg, in the stack, disassembler and registry windows, there are texts to show values of memory locations, for ...
5
votes
2answers
4k views

Ida Pro: parsig complex operand expression using Idapython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
3
votes
1answer
8k views

IDA Pro/Hex-Rays FLIRT Signatures and Standard library function detection

I'm having some problems performing a standard decompilation of a Windows EXE file using IDA Pro/Hex-Rays and its built-in FLIRT signatures. A lot of standard C++ functions are not being recognized ...
10
votes
1answer
38k views

How could I change an instruction in IDA Pro?

I'm trying to change an instruction in an executable that's loaded in IDA Pro v6.1 For example: lis r11, ((qword_90E1B2D8+0x10000)@h) to lis r10, unk_90E163D0@h Any help is ...
9
votes
2answers
10k views

Converting a virtual table from .rdata into an IDA struct

Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry: And what the resulting struct should look like (but with all entries - this vtable specifically, ...
8
votes
1answer
3k views

IDA Pro: use structs on parameters

I have a small function that is given a struct as parameters. The struct looks to something like this: struct my_struct { short a; unsigned int b; unsigned int c; }; Taking care of the ...
7
votes
2answers
3k views

How to Fix a memory dump of a dll - so i dynamically reverse it using olly \ ida

I need to analyze a memory dump of a malware module, unfortunately the sample is not the original dll, but the dump of the dll from the memory. Now fixing the sections headers is fairly easy - i just ...
6
votes
2answers
5k views

How to get imge base of current setting through script in IDA pro?

As a beginner I'm trying to disassemble a file with IDA Pro 6.5. I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program. Now, I want to get the image base of ...
6
votes
1answer
2k views

Parsing IDA Pro .asm files

Does anyone know of projects that parse the disassembly from IDA Pro using a lexer and/or parser generator library? But I would also totally be fine with JSON or XML format. So far, I have been able ...
6
votes
1answer
6k views

How to automatically rename some IDA functions from a given list?

I have a text file which contains a list of function name and address pairs, structured like this : 194C:841B LoadMessage 194C:8429 ShowDialog ... Is there a way (eg: script, automation, ...) to ...
5
votes
1answer
1k views

How to make type libraries from Windows 10 SDK and DDK?

I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial TILIB - utility to create type libraries for IDA. Then I downloaded it from IDA Support: ...
3
votes
1answer
1k views

How to find start of .text section?

i made a random console application and loaded into IDA. The start of .text section shown is 00BA1000. Then i loaded the application into CFF explorer. The address of entry point was 000110AA. Is it ...
3
votes
1answer
1k views

How to dissassemble Motorola/Freescale/NXP PowerQUICC excutable

I have a probably executable file for Motorola/Freescale/NXP PowerQUICC MPC860 and cannot disassemble it with IDA Pro since I cannot find the correct processor type in IDA?! IDA list MPC860 as ...
3
votes
2answers
23k views

IDA cannot launch debugger for 64-bit exe files

I want to launch IDA debugger for one 64-bit exe file and it fails, have tried with more samples, but result always the same. Here is that I do. Launch IDA Pro (64-bit) Select Debugger -> Run -> ...
2
votes
2answers
2k views

IOCTL Code for Windows driver

Recently I tried to obtain OICTL Codes from the iscflashx64.sys driver and I have found it in DispatchDeviceControl function. After driver being installed and have started with SCM it displayed in ...
2
votes
1answer
5k views

What does __PAIR__ mean in Hex-Rays decompiler output? [duplicate]

what does this code on IDA? i've found with this a couple of times and i don't have idea what means. int a5; int dGainMax; COERCE_DOUBLE(__PAIR__(a5, dGainMax))
1
vote
2answers
6k views

Hints to reverse engineering a QT software

I am facing a little bit of problem during reverse a QT application with Ollydbg or IDA. This software use a protection schema to indetify the number of click made on a QList. After a random amount ...
8
votes
2answers
7k views

Exporting structures and enums in IDA

It is possible to import structures and enums declarations from C files in IDA. However, is it possible to export structures and enums to C?
7
votes
1answer
3k views

IDA pro and default windows (lib) functions

Why can't IDA Pro successfully determine which exact functions are called after successful disassembly of inline functions? For example, statically linked functions like printf(), memcpy(), memset() ...
7
votes
1answer
712 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
6
votes
1answer
3k views

Can I send gdb command from IDA Debugger to gdbserver?

I want to send gdb command (like "backtrace", "b *0xAAAAAAA", "i b", ...) from IDA debugger to gdbserver over gdb remote debugging and receive result and print it to output view of IDA, can I do it? ...
6
votes
1answer
2k views

Handling INT 2D anti-debugger technique in IDA Pro

I'm analyzing a PE file using IDA Pro that is using int 2Dh technique as anti debugging: CODE:00455050 push ebp CODE:00455051 mov ebp, esp CODE:00455053 push ecx CODE:00455054 push ebx ...
6
votes
3answers
8k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
5
votes
1answer
2k views

DOS program debug in IDA?

Does anybody know something hack to debug 16bit DOS program in IDA 6.1?
5
votes
1answer
4k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
5
votes
1answer
2k views

Struct with negative offset in IDA possible

I have a structure which looks like this: RefString struct RefCount dd ? StrLen dd ? CString db... RefString ends When the code passes around a pointer, it doesn't point to the ...
5
votes
2answers
2k views

IDA Proximity viewer not finding obvious paths?

Using IDA 6.2 (and also with IDA 6.4), I'm trying out the Proximity viewer to find the path between 2 functions as described at the hexblog post here. Using the Xrefs From/To (old option) it shows ...
5
votes
1answer
554 views

What's the meaning of dword_XXXX and offset dword_XXXX in IDA?

Consider the following code: In C++: SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized void someFunction() { globalPointer->...
5
votes
1answer
1k views

Coalesce Enums in IDA?

Is there a way to modify the IDA decompiled source to reflect "OR"ed values of two or more enums? For instance, I have the following enums, HTTP_QUERY_CONNECTION has the value 23 and ...
4
votes
1answer
2k views

Hacking Lua - Introduce new functions into built Lua

I am trying to hack a game (not for cheating though) by introducing new built-in methods and functions in order to communicate with the game using sockets. Here is a small "pseudo code" example of ...
4
votes
5answers
4k views

How to find a subroutine (or next instruction) called after returning from a (Windows) dialog box?

The dialog box is a password challenge, and I'd like to catch/trace/observe the code (hopefully the password-checking code) that gets executed right after clicking the OK button of the dialog box. I ...
3
votes
2answers
3k views

Get a list of global variables with IDA python

I am trying to use IDA python to get a list of all variables in .data section because I want to extract a list of cross references to each global variables from IDA. Is it possible to do this with IDA ...
3
votes
0answers
806 views

STL map and map entry structures for IDA/HexRays

I have several binaries (Visual Studio 2005, amd64/x86_64) that I need a portion of each reversed in order to better understand the reasons for their malfunction in certain edge cases (they are long ...
3
votes
2answers
2k views

adding instructions in IDA

I noticed that you can't simply add an instruction in IDA. Yes, you can modify one, but not add(maybe there is such feature? Can't find it though). So I used HxD to forcibly increase the PE binary ...
3
votes
1answer
4k views

IDAPython: How to get function argument values

I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example,...
2
votes
1answer
7k views

Decrypting Lua Files

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted. ...
2
votes
1answer
4k views

Set breakpoint on shared library

I am a noob to the reversing world. I have a Android Java application which uses a shared library via JNI and I would like to set a breakpoint in the shared library. The shared library is stripped ...
2
votes
2answers
8k views

Packed PE-file, where to start?

I'm new to reverse engineering, so maybe it's an easy question but not for me). I've got .exe file which is somehow packed. When I open it with IDA, I got warning that file was packed or modified, and ...
2
votes
1answer
581 views

IDA - Create Process Flow Map Between 2 Sub-Routines

Using IDA, can I specify 2 Sub-Routines (really, it's 2 WINAPI calls) and have IDA create a "map" between the 2 points? I want to know all the possible branches the EIP can take from one instruction ...
1
vote
0answers
232 views

Reading stp (Designaknit Stitch Pattern)-Files

I want to write a small knitting program for my wife. In it, I will also read * .stp files (Stitch pattern). These are small files containing a graphic created by the program DesignaKnit and many of ...
1
vote
2answers
5k views

How can I step through instructions in IDA and know the current EIP?

import idaapi x=0 while x<10: idaapi.step_into() rv = idaapi.regval_t() idaapi.get_reg_val('EIP',rv) ea = rv.ival print hex(ea) x+=1 Hi. Here is a script to step-into 10 ...
1
vote
4answers
2k views

How to cause program to stop execution when a particular value is found in memory

I am new to reverse engineering. This is my problem: I am running a program and I know a value 'X' will be calculated during execution. Now how do i set the IDA or ollydbg to break when value X ...
1
vote
2answers
186 views

Dealing With x86 Segmentation Overlaps

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...