Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

IDA - Remote debug on linux

I am trying to debug remotly an ELF from my windows 10 (the ELF runs on my ubuntu 32 bit vm) (the ELF is from pwnable.kr - unlink). Because the exploit is via gets() I try to pass input through the "...
0
votes
1answer
809 views

Working backwards from a popup

I'm currently trying to reverse engineer a game,but there's and anti-debug, so far the only leads I've tried to follow are: I found an IsDebuggerPresent API, I tried to change the value of EAX by ...
0
votes
1answer
189 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
-1
votes
2answers
2k views

IDA Pro can't view part of the file, which I can see exists WinHEX

Why does this happen and how do I get to that place in file using IDA? I have found a unicode string using WinHEX. Now I would like to see from where is it referenced. I tried to jump on the file ...
8
votes
1answer
2k views

How do you manage/backup your IDA database? [closed]

Recently I lost an important IDA database. Up until now, I manually made a copy of my work IDB every day, but that's obviously not a good backup technique. I was wondering how do you manage/backup ...
7
votes
2answers
2k views

Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE

As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
7
votes
1answer
4k views

BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied

I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
6
votes
1answer
2k views

How to extract the input file offset of a byte in idapython?

For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
6
votes
1answer
841 views

How to get IDA Pro Free to automatically change segment on retf?

I have been unable to get IDA pro to do a simple disassembly of a flat 16-bit binary (bootloader) file. I'm just getting started, and it seems to be harder than it should be. There's a simple set of ...
6
votes
2answers
323 views

How can my plugin get notified of anterior or posterior comments (and more) changes to an IDA database?

IDA Pro allows plugins to receive notifications for a number of events. These are defined in the hook_type_t enumeration inside loader.hpp in the SDK from what I saw. If I subscribe to HT_IDB events, ...
6
votes
3answers
3k views

How to get the CPU architecture via Idapython?

I was not able to find an API function to get the CPU architecture of the loaded binary. In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type. ...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
4
votes
1answer
5k views

Setting name of (newly created) functions via IDAPython

Is there a way to specify the name of a function when creating it with idc.MakeFunction()? If not, what is the best practice to rename a function? I found idc.GetFunctionName(ea) but no counterpart ...
4
votes
2answers
2k views

IDA segmentation problem

In the program I'm trying to reverse engineer, originally IDA only created three segments: CODE, DATA and .idata. Using the information from the compiler source code (http://pastebin.com/ParJ3683 ...
4
votes
1answer
2k views

IDA Pro C dump for Decryption function

I have been battling this infection I got that encrypts my files in 512 byte chunks with a friend. We have managed to find the Decryption function we think in IDA (the code is heavily obfuscated) from ...
4
votes
2answers
337 views

Backtracing where a register gets initialized

I am currently trying to bypass a CRC check, that exists inline on many places in an application to check if memory pages in the .text section have been modified. Short explanation of the crc32 ...
3
votes
3answers
1k views

How to see all functions that called with debugger

I debugging with IDA, and I want to see/print all the functions that get called. In the functions window I see over than 1000 functions. So I want to see which functions are called when I press ...
3
votes
1answer
4k views

Set memory breakpoing on access on a section in IDA

Is there a way to set memory breakpoint on Access on IDA in Win32 debugger... like we do in Olly from the memory window ? I tried to do that with the example "UnPackMe_NoNamePacker.d.out.exe" in 20th ...
3
votes
1answer
2k views

Understanding unknown in IDA

What is this instruction trying to do? .text:4044A5EC LDR R5, =(unk_40885080 - 0x4044A5F8) Looking at the value of unk_40885080 it holds a value of 20 in the .data segment.
3
votes
2answers
1k views

Can someone tell me what this memcpy or maybe it's a memset? looks like a memset, rep movsd and rep movsb This is a packet sending function

Trying to understand a function thats responsible for sending out a packet. I don't understand could it be a integer array or something? or some inline function that's not properly getting rendered in ...
3
votes
2answers
1k views

How do I adjust the length of the parameters in IDA?

In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value. However, how can I do this with the parameters size? ...
3
votes
1answer
5k views

How do i use IDA for heap search for specific types and values?

How do i use IDA debugger to find some specific values in process memory, like values of float or integer, or string type? Then how can i trace how program accesses them?
3
votes
1answer
1k views

Loading user specified IDA symbols in GDB

While reversing a binary, whatever symbols we name inside IDA IDB database, is it possible to load the same in GDB while debugging? e.g. I tried wsym which attempts to inject those as symbols. However,...
3
votes
2answers
338 views

Grouping functions based on their placement/order in the binary

Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
3
votes
1answer
7k views

What is the meaning of *(_DWORD *)

I disassemble some code using IDA Pro and get the pseudo-code. It showed something like below. for ( i = 0; i < 6; ++i ) { v7 = (int)&val_253; for ( k = 1; k < ...
2
votes
1answer
674 views

Turn ¨Assemble¨ option on, in IDA Pro Demo

Is there a way to highlight "assemble" option in EDIT menu at IDA pro to apply a patch. Guess that idagui.cfg must be changed at some point, and turn NO to YES somewhere. I use the last demo version....
2
votes
1answer
1k views

Set QWORD with a constant value in IDA Pro

At line #3 of a function, I have a QWORD at address 7FE875F3FE0 which resolves to a value of 85857490416 for which the function returns true. If not, the value is set to 0. I would like to know how ...
2
votes
1answer
319 views

How to detect only external-module calls?

I'm debugging one module which draws some letters using either GDI or most possibly Direct Draw. I want to trace where this happens so for the reason I need to trace only instances of code, which ...
2
votes
0answers
555 views

Passing input to program in Remote Debugging with IDA Pro

I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
2
votes
3answers
2k views

Why can't you edit pseudo code?

Dabbler in re here, so potentially a stupid question... I know ida, binary ninja, and ghidra are really powerful at generating pseudo code. From everything I've read pseudo code can't be edited in ...
2
votes
3answers
567 views

What are the .cpp files in IDA disassembly [duplicate]

I opened wsl.exe in IDA Pro v7 and follow some strings. I saw some strings with .cpp extension. Can anyone explain what are those .cpp file in that disassembly? Where can I find it? Are those hidden ...
2
votes
1answer
979 views

Stepping through ARM firmware image

I have a binary firmware image with a routine that I find hard to understand. I want to step through this encryption routine step by step so I can better understand it. I was able to obtain all the ...
2
votes
3answers
2k views

IDA decompiler macro

What is the purpose of COERCE_FLOAT and COERCE_UNSIGNED_INT macros in the Hex Rays decompiled code below? double __cdecl sub_401580(float a1) { unsigned int v1; // eax@1 double v2; // st7@1 ...
2
votes
1answer
341 views

Stack variable information removed in IDA pro (free version)?

I'm using the IDApro free version and I was wondering why sometimes there could be a instruction like... mov [esp + 1140h + var_1234], ebx and if you click inside the bracket, and hit the letter K (...
2
votes
1answer
265 views

What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?

What is the memory address information I should plug into IDA for this BIN file? GOAL: To disassemble a BIN file extracted from firmware.sb This BIN file contains the low level board initialization,...
2
votes
1answer
364 views

How to modify strings and funtions reference detection in IDA pro?

I have loaded a binary file into IDA which is for Motorola 6800 series. The strings are referenced like this: pea ($2017A99).l. The actual address of the referenced string in above command is ...
2
votes
1answer
4k views

How to change address in the hex view in IDA debugger?

I'm just learning the IDA pro debugger, so I apologize if this is something simple. Say, if I opened a debugee process and started stepping through it with a debugger (WinDbg) and then want to look up ...
1
vote
1answer
2k views

IDA Pro Export C style array using Python instead of GUI menu

IDA Pro 6.95. From the menu I can use Edit... Export data... C unsigned char array (hex). I want to do this in a Python script without rewriting what already works. I have looked for a way to find a ...
1
vote
1answer
75 views

Type inference inconsistency

I'm testing several decompilers against the following C code static int bar(int i) { return ++i; } static int apply(int (*fun)(int), int i) { return i % fun(i); } static int foo(int (*app)(...
1
vote
1answer
629 views

ESP out of range of “Stack View” in IDA

A very similar (or exact) question was asked here, though it was not answered properly. I am debugging a process in IDA and am unable to view the dynamic contents of the stack because its value ...
1
vote
1answer
160 views

How to deal with code that change its address among different execution

I think that this is a basic need of every reverser so this question may have been asked in other places but really, I'm unable to find an answer. Maybe I'm asking the wrong question. So, supposing I ...
1
vote
1answer
203 views

How to watch communication between 2 processes?

I have exe file in my pc(exe1) that send message to another exe (client-server maybe). I dont know which exe recived this message from exe1 and with which iso that message encoding. How can I see ...
1
vote
2answers
120 views

Monitor all changes done by function

What is the easiest way to track all changes before and after a specific function is executed. I know I can trace instruction but that may yield a long list of all command executed. I want to stop the ...
1
vote
2answers
2k views

How to add/find parameters to a function declaration in IDA/HexRays?

I've a binary opened in IDA. It uses a function pointer from a COM vtable. I found that the COM method has 13 parameters (including this). But IDA shows only 4 parameters as shown in this pseudocode: ...
1
vote
1answer
3k views

Unable to view stack and memory addresses in IDA Pro [duplicate]

I am debugging a 32-bit ELF executable using remote GDB debugging option of IDA Pro. However, I am unable to view the contents of stack in the stack view. Also, the stack pointer value is: 0xFFFFD328 ...
1
vote
2answers
2k views

Convert IDA listings to assembly without using IDA non-free

I'm currently working with a huge set of IDA Pro listings (~1TiB). For a project I need to perform analyses on the mnemonics and operands on a subroutine level. Therefor I want to convert the IDA ...
1
vote
1answer
458 views

IDA debugging SSE intrinsics

Whenever I hover over a SSE variable, e.g.: correct = tmp_corr; Which are both declared as __m128 IDA shows them as a string of bytes, e.g. "\x00\x00..." sometimes even weird characters... Is ...
0
votes
0answers
401 views

IDA 7.0 (free) fails to load symbols with message “DWARF: Cannot determine location of DWARF info” during debugging

Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM: Then loaded a test PE file and started debugging it (using Local Windows Debugger): ...
0
votes
0answers
197 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
0
votes
1answer
1k views

Run to user code in IDA

Is there a way, as ollydbg provides, to run untill user code (programmer code) with IDA PRO ? You can do that in several ways in olly, like setting a breakpoint on the .text section of main module.

1 2
3