Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0
votes
1answer
58 views

Debug with IDA Pro right click option

So I was wondering if is there a way for IDA to appears in the righ click options of an executable. As you can see, Debug with x64dbg was built by itself, IDA 32 didn't do, so I just changed it in ...
2
votes
0answers
40 views

IDA stack depth differences when branching

I'm decompiling some Direct3D code that makes a lot of indirect calls to __stdcall functions. For example: call dword ptr [edx+0xC8h] which is really: pD3DDevice->SetRenderState(); IDA doesn't ...
0
votes
1answer
83 views

What is copy_block struct in Tricore Arch?

Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below: ld32.w d4, [a0]-0x68D4 I know a0 = 0xD00032E0 but ...
3
votes
2answers
97 views

How can I get xrefs to class member variables in IDA?

I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it. I want to know how I can get a list of all references to a given class member ...
1
vote
0answers
32 views

After jumping to the xref operand of a function I found via string searching in IDA, I am brought to an rdata section? [closed]

First post here, so sorry. I'll try to keep it short. Anyways, when trying to xref an operand (to find its offset), it brings me to an rdata function. It looks like this: .rdata:00000001419318D8 ...
2
votes
2answers
87 views

Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro

Have an application that has code to detect serial port model. I'm trying to work out how it works through static analysis. I have unpacked the EXE and can find the references to the strings: dseg:...
2
votes
1answer
58 views

how can I diff two ARM32 binaries at assembly code level?

I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
2
votes
1answer
70 views

IDA PRO: How to set conditional breakpoint on a EAX register value?

I want a breakpoint when the EAX record == 1. here's an IDC script that does this, but it is very slow. does anyone have a faster script or plugin that does this? #include <idc.idc> static main(...
-1
votes
1answer
51 views

IDA PRO: How to set conditional breakpoint on a register value?

I want to set a breakpoint when the register EAX = 00000001
0
votes
1answer
52 views

Custom IDA Decompilation Format

Is there a way to customize the format of IDA's decompiled code? e.g. char buf[7]; // [rsp+5h] [rbp-1Fh] to char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ] or switch (c) to switch( c )
0
votes
0answers
41 views

Question about weird instructions which is not able to understand for me

I tried to analyze a certain part of program with IDA PRO, So I set a break point at some instruction and start debugging(press F9 key) Afer It start debugging mode, I was pressing F7 key(step into) ...
0
votes
2answers
25 views

Determine if there is a cross reference using idapython given a specific address

I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from) ea_start = # ea_end = # for ea in ...
1
vote
2answers
55 views

How to attach IDA Window back to be part of the IDA main window

I accidently maximized the functions Window and now it is de attached from the main window: How can I attach it back to be part of the main window? I tried to drag it but it doesn't work. Also re ...
1
vote
1answer
80 views

Can you decompile code if you Know the Complier?

My company has a small number of .exe that were written in the '80s that are performing some minorly important tasks. Source code is gone and documentation is scarce. In order to run them we need to ...
0
votes
1answer
72 views

Analyzing raw binary without ELF header in IDA Pro

I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro. I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is ...
0
votes
0answers
70 views

In which program do I reverse engineer UEFI firmwares

I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it ...
0
votes
1answer
52 views

How to resolve major function numbers to their name while reversing windows drivers?

I'm reversing some windows drivers, and IDA never converts numbers to their corresponding major function name like IRP_MJ_CREATE = 0x00, how can i force this? is there anyway i can convert a number to ...
0
votes
1answer
67 views

Why some functions in IDA can't be searched

I don't know why but I noticed, on some program I am reversing, that in a section named .bss, there functions and I can't find them through the regular search, why is that. For example, I wanted to ...
0
votes
0answers
20 views

Patching swift methods

The following is taken from a de-compiled iOS app. Is this a swift method? Is it objective-c derived? Why is it showing in IDA as EXPORT? Can this be patched to return 1? EXPORT _$...
1
vote
1answer
46 views

Edit IDA signal handler

In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application. How can I edit that choose now? I want to ignore this ...
0
votes
0answers
45 views

trying to understand this mov memory[register] instruction

Windows 10, IDA Home, 64bit application compiled with Visual Studio. I'm reverse engineering a crackme and i found this instruction : mov cl, byte_51B000[eax] mov byte_51B018[edx], cl in ...
0
votes
0answers
37 views

Lexer and parser for .asm file produced by objdump

Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
0
votes
1answer
96 views

Find out the name of constants and var in IDA pro

I'm trying to search with IDA pro constants of type "#define SIZE 100" and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I ...
0
votes
1answer
92 views

How to inform Hex-Rays decompiler (7.0) of known register values?

I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
0
votes
1answer
75 views

what is Off in IDA Pro?

probably silly question, what does Off ... means in IDA Pro? i markered the snapshot as an example.
0
votes
0answers
58 views

how to get all “called functions” in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
1
vote
1answer
46 views

Problem when opening a script file in IDA (syntax error)(pe_sections.idc)

I downloaded the script files from http://www.openrce.org/downloads/details/57/PE_Scripts. Then i extracted the files in the folder idc in the IDA folder (C:\Program Files\IDA 7.0\idc) I opened IDA (...
0
votes
0answers
85 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
2
votes
1answer
101 views

WinDBG doesn't resolve function names when debugging kernel module

I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically). Here is a picture ...
0
votes
1answer
34 views

How to run a process with high privileges using remote debugging

I am using remote debugging with IDA. The target and host machine are Windows. I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
1
vote
1answer
99 views

Statically Reverse Engineering Shellcode - IDA to Ghidra

I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/ Hash: ...
0
votes
0answers
32 views

ida: a better way of printing ida script output on console

I just started exploring ida. I have a simple IDAPython script. import sys import idc import idautils # wait for auto-analysis to complete idc.auto_wait() for ea in idautils.Functions(): print(idc....
0
votes
1answer
104 views

IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?

I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
0
votes
1answer
70 views

A bit confusion with cheat engine function address and IDA subrutine

I have found a function with Cheat Engine that I like to show in IDA:enter image description here but the function is not present in IDA. Probably I have a bit confusion becouse I don't have ...
1
vote
2answers
78 views

How to set conditional breakpoint to modify ZF (Zero flag)

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0. I don't know how to do it: I searched for example scripts in IDC or ...
0
votes
2answers
65 views

Order of arguments in __usercall

i have the following function with five arguments: ; int __cdecl trampolineRegister(void) a4= dword ptr 8 a5= dword ptr 0Ch push ebp mov ebp, esp add eax, ...
0
votes
0answers
64 views

A way to detect a anti-cheating system

I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script: debugProcess() -- Attach ...
0
votes
0answers
72 views

IDA IDC script does not seem to work

I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
0
votes
0answers
105 views

How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
0
votes
0answers
55 views

Address register offsets and analysis (Tricore)

I'm decompiling a binary file for a Infineon Tricore processor, the code is incomplete and only contains part of the code so will not execute. The auto analysis did a great job and the code is ...
1
vote
2answers
149 views

STL Data Structures Hex-Rays

We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure. For example, msvc - ...
1
vote
0answers
62 views

CRC16 Reverse in C166 Arch

Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm. So I have to describe this with detail. Sorry if i vast your time for ...
0
votes
0answers
21 views

What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?

I have a dataset of .ASM files generated by IDA (dont have the corresponding file) now there are a lot of calls like this : .text:00637114 5F pop edi .text:...
0
votes
1answer
334 views

What do these 2 Ghidra warnings mean?

When disassembling ARM binaries in Ghidra, I often see these warnings: /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */ /* WARNING: Treating ...
0
votes
0answers
23 views

Failed to load .net binary on IDA Pro

I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file: but when I click OK to load the program, the following error occured, and the program can't be loaded: I tried to google ...
0
votes
1answer
43 views

Can't find sequence of bytes in IDA while debugging

While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44: I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
0
votes
0answers
54 views

How to reverse engineer structs

I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
0
votes
0answers
20 views

IDA, wrong jmp operand after patching

I'm writing a python script for IDA to automate the deobfuscation of a binary. After patching with a jmp instruction ida provides the following disassembly: .text:008FD01E jmp ...
-1
votes
1answer
131 views

IDA decompile binary file

how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,
1
vote
1answer
97 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...

1
2
3 4 5
35