Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,520
questions
0
votes
1answer
72 views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
1
vote
0answers
27 views
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
0
votes
0answers
47 views
Why is IDA Pro showing no strings in strings window but there are strings?
My IDA Pro Strings window shows no strings. It's not loading - it just detects no strings. However, littered all over this large binary are many strings that IDA Pro actually does pick up, but only ...
1
vote
2answers
135 views
Type reconstruction ambiguity
In TIE: Principled Reverse Engineering of Types in Binary Programs, Lee J. et al claim to solve most of the challenges in the process of C code decompilation that come with type reconstruction.
While ...
1
vote
0answers
168 views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
0
votes
2answers
104 views
IDA - How to resolve “Write access to const memory detected” error?
I'm trying to analyze a binary that I unpacked, rebuilt, and dumped, using Scylla. After loading it into IDA and viewing pseudocode, I can see that there are errors where IDA tells me that it notices ...
1
vote
1answer
96 views
How to make sense of RTOS in firmware?
I am reverse engineering a firmware which has a Linux and an RTOS component. I used binwalk to easily locate the Linux filesystems, extract them, mount them, and now I have binaries which I can open ...
1
vote
0answers
48 views
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a ...
2
votes
2answers
96 views
BIOS first jump leads to empty memory
I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
1
vote
1answer
146 views
ELF file crashing after executing shellcode
So after changing the entry point via the e_entry field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it:
// write string and jump to OEP, ...
0
votes
0answers
53 views
Using IDA pro 7.2 and android server breakpoints problem
i have been trying to use IDA to make a breakpoints on a 4 byte memory address
to find out what arm op code writes to it . yet it fails to set a breakpoint and gives me this message " Xscale support ...
2
votes
0answers
100 views
How to proceed after running binwalk on this firmware?
I'm trying to access the firmware from the .bin in this archive: http://mydjiflight.dji.com/file/links/OSMO_ACTION_V17020_20191203_ZIP
So far I've used binwalk and gotten the following output:
...
1
vote
1answer
123 views
Stack-pointer analysis failed
I'm testing my toy obfuscating C compiler against IDA's decompiler, but IDA refuses always functions (then the decompilation is not possible). For example, at one of lowest-levels of obfuscating, a ...
1
vote
0answers
61 views
Strange function in Disassembly (IDA)
I was reversing one executable in IDA and found out the function with this structure:
.text:0058A6E0 sub_58A6E0 proc near
.text:0058A6E0
.text:0058A6E0 var_4 = dword ptr ...
0
votes
1answer
66 views
Attach one debugger to a DotNet application, and a second one to a loaded DLL
I'm trying to reverse an application that is using a DLL that i'm interested in.
I can properly disassemble the application itself with DnSpy, as it is a .Net application, and I can disassemble the ...
0
votes
1answer
66 views
Detecting libc function with IDA
I have binary than running on Arm , static and striped.
I don't know which compiler compiled this binary.
How can I identify function like fread sleep printf ioctl
0
votes
1answer
52 views
Patch Arm binary with Ida
In Ida I can patch binary that run on x86 , but not binary that run on Arm.
How can I simply patch binary , change assembly(not only hex) and save to new binary file
1
vote
0answers
54 views
Hex-Ray Decompiler: inline function not recognized
While trying to decompile an application with Hex-Ray 7.0, I stumbled upon the problem that in nearly all cases, what seems to be a certain inline function will not be recognised, which bloats the ...
0
votes
1answer
82 views
IDA Pro ignores condition in breakpoint
Look at the condition. It is supposed to break only when the R2 is 40, but it breaks in any call to this instruction. I'm using IDA Pro 7.2.181105, debugging with Remote GDB Debugger, an ARMv4T code. ...
0
votes
0answers
32 views
IDAPython api which get indirect memory address reference
I'm currently learning to use IDAPython for automated analysing on many binaries. Some binaries load memory address into register by adding base address with offset, that idautils.XrefsTo() cannot ...
1
vote
1answer
63 views
Is there a handy assembly to mock app conversion tool?
It might be too silly of a question, but here you go.
Suppose you have some software that contains a tricky nested assembly sequence (like this one) you try to reverse engineer. brain*[pen&paper] ...
0
votes
0answers
48 views
Add function to Export Address Table
I did reverse engineering through IDA Pro, but I needed to expand my function. Since there was no free space, I renamed the old function (using Hex-view) to avoid a match, created a new section (using ...
0
votes
1answer
39 views
Class definition
I have a complicated question to ask so I will try my best to be clear.
I have this binary I am trying to reverse that came with a pdb file.
I have dumped the compilands of the binary to begin with.
...
1
vote
1answer
81 views
Can somebody explain this weird alignment/optimisation done when zeroing out a buffer?
I have the following disassembly which looks like a buffer being populated with zeros in a loop, however, I'm confused at why the alignment is needed here (if a jump will always be 4-bytes, why does ...
1
vote
1answer
49 views
How to Insert Call to Already Imported Function in amd64 Windows DLL using IDA Pro?
I am trying to patch a function in 64-bit Windows DLL to load data I have inserted into the resource table of the DLL. I want to insert code something like this:
mov r8d, 0Ah ; lpType
mov ...
1
vote
0answers
12 views
Debug only one thread with ida-gdb server
If I want to debug process in embedded that running linux , I can run gdb-server in embedded and attach to process with Ida.
The problem is if this process has 1 thread that can't stop over than x ...
0
votes
0answers
47 views
IDA Pro Setup Questions MPC555 microprocessor
I'm attempting to tune a BMW from the early 2000's that uses an MPC555 microprocessor, which is a PowerPC big endian. I need to find a single byte switch that I think is referenced in the subroutines ...
0
votes
1answer
27 views
IDA: apply function parameter as struct pointer
In the following function foo
.text:0000000000401110 foo proc near
.text:0000000000401110
.text:0000000000401110 var_8 = qword ptr -8
.text:0000000000401110
.text:...
1
vote
1answer
34 views
How to determine what code created a string, in a live debugger session?
I'm using IDA 7 to debug a running application that must be a child of another application, which means I can't start it from IDA (using Debugger->Run). Instead, I have to run the application normally,...
2
votes
1answer
56 views
Finding the correct input of an executable to print out the flag. IDA 7
I'm trying to understand the behaviour of the code below so I can determine what input will trigger the "YOU DID IT !~!" string (at the end of the program instructions):
.text:00C21034 Buf= byte ptr -...
1
vote
2answers
171 views
Methods for preventing IDA decompiler
I want to write a C function, such that hex-rays decompiler will fail on it. I want to do it for study purposes, and not for an actual anti-reversing method. Do you have any recommendations/approaches ...
1
vote
1answer
70 views
Type inference inconsistency
I'm testing several decompilers against the following C code
static int bar(int i) {
return ++i;
}
static int apply(int (*fun)(int), int i) {
return i % fun(i);
}
static int foo(int (*app)(...
2
votes
0answers
38 views
IDA pro 7… how do you tell which module each string is in?
In IDA pro 7, when you generate the list of stirngs in the strings window, it gives you an "address" which starts with something like "debug12x"... is there any way to tell which module that is in? Or ...
3
votes
0answers
37 views
IDA's debuggers disappeared
Using IDA 7
I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
0
votes
1answer
37 views
IDA Pro: __GETDS breaks decompiler output
when trying to decompile some interrupt service routines done with Watcom, the __GETDS call at the beginning of the functions will break the decompiler output completely.
Here's the disassembly:
And ...
0
votes
1answer
93 views
running IDA python without gui
I am trying to run IDA without GUI. My purpose is to run a specific script that receives arguments via my main program against multiple files, but for some reason, it does not work for me. Sometimes ...
2
votes
1answer
71 views
IDA pseudocode support
How can I know which processors IDA knows how to view pseudocode of?
If IDA does not know to view pseudocode for my processor, how can I fix that??
3
votes
1answer
68 views
x86 disassembly confusion regarding VESA functions
I'm trying to disassemble an old DOS application and got stuck at some point of the VESA graphics handling.
The VESA function to be called will be stored in a global variable, e.g. ...
1
vote
1answer
50 views
Memory map in AVR Harvard architecture
In this video https://youtu.be/D0VKuZuuvW8?t=259 .
You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff .
So in the video he ask ...
0
votes
0answers
33 views
Extract .NET code from React Native for Windows
I'm interested in reversing a UWP program made using React Native for Windows. Once such applications are compiled, the logic is contained in one dll. After opening this dll into IDA, it appears ...
0
votes
1answer
27 views
IDA decompiled function signature mismatch
I am on the last version of IDA.
There is a function B, that its signature is B(int a,int b).
There is a function A that calls it.
But in function A, the call appears like B(12) for example.
How ...
1
vote
1answer
37 views
IDA - ObjC - Meaning of _BYTE and dword_0?
This is my first experience disassembling/reverse engineering, and am having a bit of difficulty keeping up. For reference, I'm trying to uncover the inner workings of a pretty good library in my ...
0
votes
1answer
45 views
indirect return value address
I have usercall with calling convention I do not fully understand, it returns std::string but IDA recognize it as void.
I've noticed that every calle reads from x8/w8 afterwards, from wikipedia;
...
0
votes
1answer
32 views
IDA Change ram and rom without reopen IDA
when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary.
Is there any smart way ?
1
vote
2answers
326 views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
1
vote
0answers
27 views
How to load a library at a specific address in IDA and re-analyze the program statically?
I have a dumped PE that has calls like
call ds:dword_4010B4
now these are actually addresses of APIs in kernel32.dll
my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
2answers
113 views
How to solve this anti-disassembler trick?
I have this __asm instruction in C code:
int func_0x8b4c55a0()
{
__asm
{
call $ +5
add[esp],5
ret
}
}
int main()
{
char cVar1;
if ((cVar1 = ...
1
vote
0answers
40 views
How to dump a unpacked PE and still get the API names with IDA when they are called directly?
So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header)
i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
0
votes
2answers
126 views
Is it possible to use a program's GUI abilities without the GUI?
Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?
For example, a program with abilities nested too deeply in cascading submenus:...
2
votes
2answers
362 views
CPU support by ghidra
Where can I see all the CPUs supported by Ghidra?
Does Ghidra support more CPUs than IDA Pro?
