Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,928
questions
0
votes
1
answer
69
views
IDA: String referenced in Assembly, but not shown in string view
I was looking for a spcific string in IDA, but there were no hits in the "string view". Now after browsing the disassembly for a while I realize that not only does the string exist, IDA did ...
- 373
0
votes
0
answers
16
views
why ida7.6, here() return not exact EA in structure address range?
scene:
After I use one structure to define a global variable in .data segment, then I cant use here() to get the exact EA where the cursor is, only get the struture's head address.
ask for help:
How ...
- 1
1
vote
1
answer
80
views
Automatically propagate types in IDA pro when variables are assigned?
Let's say I have this code in the decompiler of IDA pro:
var1 = var2;
And assume the type of var1 is X (for example X could be char array with size 5). Is there anyway that I can tell IDA that ...
- 320
0
votes
1
answer
107
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
- 1
0
votes
0
answers
48
views
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.
I did small debugging. While doing it, the ...
0
votes
0
answers
25
views
IDA debugger register string pointer in conditional breakpoints
When debugging in IDA, it’s possible to use an IDC script as the breakpoint condition. I want to break if EAX points to a null terminated string which contains “substring”. I can’t seem to find a ...
1
vote
1
answer
51
views
IDA: close without saving changes
In my work, I often end up with lots of IDA windows open concurrently. Once done with analysis, I would like to close them all. It is relatively easy to issue a command to all of them simultaneously e....
- 135
0
votes
0
answers
54
views
How to debug a DLL without rundll32
I'm currently looking at the sample mentioned in this article here, and it seems that it uses the SvcMain function prototype instead of the runnableExport function prototype used by rundll32. As a ...
- 1
1
vote
1
answer
151
views
How to create and change variables at address in IDA Python?
I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it.
For structs, there's ...
- 206
1
vote
1
answer
37
views
IDA Pro S12X flash page references
Trying to analyse a dump from MC9S12X series MCU and can`t get how IDA making cross flash page references and if it could be done without scripts.
The project contains 64 code segments with linear ...
- 11
1
vote
2
answers
102
views
What is the point to have 2 different places for structures: Local Types and Structures in IDA?
Why is there 2 places for structures in IDA: Local Types and Structures?
What are Local Types local to?
Why do I have to synchronize a type in the Local Types window to the idb in order to edit it? ...
- 206
0
votes
0
answers
36
views
ida shows instructions as hex data
I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem.
at the start of the program, there is a label that points to an address of ...
0
votes
0
answers
31
views
Is it possible to rebase direct calls and jmps when i rebase the IDB in IDA pro?
When i rebase the IDB file, it doesn't effect the direct calls, so something like
call dword ptr ds:851F3020h
Will not get rebased and all of the sudden all my direct calls are pointing to ...
- 320
1
vote
1
answer
42
views
Does opening a crash dump run a file in memory?
I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
- 11
1
vote
0
answers
29
views
Easiest way to move everything, including custom structs, from an IDA Pro IDB to another?
I have analyzed a 32 bit version of an executable, defined many structs, renamed many things and so on.
Now i want to move everything, including the structs that i defined, to the IDB of the 64 bit ...
- 320
0
votes
0
answers
46
views
Red color in IDA
Why in IDA the numeric offset next to [ebp- marked with black letters in red background?
.text:004015D0 ; int __stdcall WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)...
- 113
0
votes
1
answer
46
views
How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)
In IDA Pro, when you create a custom struct, apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable, it only prints limited ...
- 320
1
vote
2
answers
60
views
IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)
I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
- 39
0
votes
0
answers
46
views
How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?
I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
- 320
2
votes
1
answer
72
views
Disable optimization of for loops in Hex Rays Decompiler
Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
2
votes
2
answers
115
views
How to import macro as enum into IDA Pro?
Is there any tools can auto generate enum type by macro?
For example, NTSTATUS in Windows defined as
#define STATUS_ILLEGAL_INSTRUCTION ((NTSTATUS)0xC000001DL)
#define ...
- 117
1
vote
1
answer
47
views
Double jump when calling functions
I wanted to ask why there is a double jump when calling some functions? For example first call:
.text:005AC266 push eax
.text:005AC267 call j_WinRegisterWindow
...
- 113
0
votes
1
answer
76
views
How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?
; PCWSTR __stdcall RtlGetNtSystemRoot()
public RtlGetNtSystemRoot
RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p
...
- 10.5k
0
votes
0
answers
26
views
How to change the color of a graph edge and custom hints in IDA
I would like to access the API to change the color of graph edges to reflect my assessment of their correctness (I already know how to do this within the tool, I need to do it programmatically). There'...
- 101
1
vote
1
answer
65
views
List instructions to fix wrong IDA analysis
I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
- 97
1
vote
2
answers
71
views
How do I find where in the code a particular Windows Resource is used?
I'm trying to reverse engineer a Windows program. Using PE Editor, I find that the string in question - which I'm interested in - has got id 2820. The string is in this format: "Some text, some ...
- 111
2
votes
1
answer
98
views
How do I reverse engineer structs that are put as parameters in a function
how do I go around figuring out where to reverse engineer a struct?
As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
1
vote
1
answer
74
views
Exporting all function addresses from IDA
I have a x86 executable opened in IDA.
In the function window you can see a list of all functions with their starting address.
My goal is to programmatically export a list of all functions IDA found ...
- 13
2
votes
2
answers
92
views
How to restore struct fields
I have an object named ComputeService::RPC that is being used as input in a function inside a binary file:
__int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this)
pc *...
- 451
-1
votes
2
answers
62
views
Parse offset to PE struct
Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example:
I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
- 57
1
vote
1
answer
86
views
How could I find a call of a function thats only referenced inside a vftable?
So I have this function which I'm trying to figure out the arguments to.
However, all the xrefs of it point to a VFTable.
How would I find a call for this function?
- 11
1
vote
1
answer
207
views
How to get function signature using IDA Python in IDA Pro
I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names.
I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
- 11
0
votes
1
answer
88
views
How do I find a function and find out what it does using reverse engineering?
I am attempting to find a function in a specific game. Is there anyway that , using the assembly code I get from decompiling the game in either Ida or x64dbg , I can locate a function I am ...
- 35
2
votes
1
answer
149
views
Finding function from pattern
I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find:
\x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C
\x89\x4C\x24\x20\x48\x83\xEC\x28\x48\...
- 35
0
votes
0
answers
61
views
Injecting class into the JNIEnv in android jni
void *handle = dlopen("/data/local/tmp/libnative-lib.so", RTLD_LAZY);
if (!handle) {
printf("\nFailed to load library\n");
}
void *offset = dlsym(handle, "...
1
vote
0
answers
47
views
How to hide NOPs in IDA?
I am trying to understand a method in IDA Free and I find the NOPs, especially the multibyte NOPs confusing.
Is it possible to hide these? I believe that they are not relevant for my understanding.
- 950
2
votes
1
answer
259
views
In IDA what does db and dd offset means in data section?
So, in .data section there is some variable, and after it there is db or dd (offset). What exactly does this mean? And what does “align” means? Is there any Wiki or something like that that tells all ...
2
votes
0
answers
69
views
Strange exception thrown while debugging in Win10, but not Win7
I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
- 121
1
vote
0
answers
66
views
IDA tracing not working
I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called.
I have tried to use IDA Tracing, but it doesn't print to file.
- 73
1
vote
1
answer
46
views
How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]
I have this class with constructor offsets and attributes:
public class example
{
// Fields
public float Attribute_1 = 1.5f; // 0x8
public int Attribute_2 = 102 ; // 0xC
// RVA: ...
- 21
1
vote
1
answer
71
views
Can I get loaded pdb file path from IDAPython?
IDA Pro can automatically download and load .pdb files from symbol server.
And now I want to write an IDAPython plugin to obtain some data from the .pdb file.
But I don't know how to get the file path ...
- 117
1
vote
1
answer
112
views
A tutorial or docs to unpack a custom packed PE
I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
- 11
2
votes
1
answer
163
views
Free alternative to Lighthouse Code Coverage Explorer?
I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
- 51
2
votes
1
answer
125
views
Does Ghidra have an equivalent to IDA's "Evaluate Expression" feature?
This is the window that appears when you press Shift + /.
Example:
- 33
1
vote
0
answers
50
views
identify the functions of stripped binaries
As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are ...
0
votes
1
answer
64
views
idapython: type information with different prefixes
I checked how to get type information here - https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf.html
Although, I am not sure what these different type prefixes mean. For e.g. BT_{...
- 1,427
1
vote
0
answers
51
views
Force IDA to redo SP analysis?
I had a function which I was unable to decompile due to a positive SP value, I tried to change it manually but accidentaly made everything worse, is there a way to restore/make IDA redo the original ...
- 39
0
votes
1
answer
138
views
IDAPython: function parameters and return value
I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using
tif = idaapi.tinfo_t()
ida_nalt.get_tinfo(tif, ea)
function_type = tif....
- 1,427
1
vote
1
answer
76
views
Re-analyse HexRays decompiled output
I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures.
How do I automatically ...
- 113
1
vote
1
answer
101
views
How is it possible to generate C++ class header from a .dll or ELF file?
I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
- 204