Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
2,040
questions
2
votes
1
answer
90
views
Reading memory values in IDA
Want to get 32 bits from 0x8000 adress as 8 bytes
MEM_EXT:00008000 db 54h
MEM_EXT:00008001 db 53h, 57h, 20h
MEM_EXT:00008004 dd 322E3256h, 31332030h, ...
- 123
2
votes
1
answer
56
views
Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?
I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M).
Looking at the idapython documentation, it looks like maybe I can do this via the ...
- 196
3
votes
1
answer
157
views
IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text
Recently I got a program that has two colors of .text segment, one is black and the other is brown:
While the flow chart and the decompiler work well on black part, they are both disabled on the ...
- 153
1
vote
0
answers
238
views
Themida devirtualization?
I'm trying to analyze virtualized? code in IDA which looks like this.
which protection method is applyed on this code and how can i analyze this code?
- 11
3
votes
0
answers
93
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 369
0
votes
0
answers
72
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
1
vote
1
answer
123
views
What are latest research in reverse engineering?
I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering.
So, what are the latest ...
1
vote
1
answer
122
views
Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?
Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version.
Problem is i have to do it again cause there ...
- 53
0
votes
0
answers
45
views
Working with IA64 in IDA Pro
When disassembling IA64 code in IDA Pro when I try to open the Local Types window
i get an error:
Sorry, the current processor doesn't support the type system
- 481
1
vote
0
answers
48
views
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
- 41
1
vote
0
answers
101
views
Corrupted IDA database .i64 file (Empty Header)
Im my 10 years using IDA Pro this never happend.
I saved using IDA Pro 7.7 when I go to open today
I find out that IDA PRO didnt put header on file
If I try to open says "File .... is not an IDA ...
- 11
1
vote
0
answers
91
views
IDA api: get function argument definition
So let's say we have the following code:
0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
- 31
1
vote
0
answers
39
views
After jumping to a new segment, it warns "The memory could not be written"
I append a new segment right after the original ones in IDA, and I modify an instruction in .text seg to jump to the new seg to run my new codes. But when I use Local Windows debugger, it warns that &...
- 11
1
vote
0
answers
156
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 99
4
votes
2
answers
409
views
How to make pseudocode in IDA more human readable
Some codes in IDA are not clear enough. Especially when they do reference after calculation
while ( dx33[rdi24] );
if ( rax35 != &WPP_GLOBAL_Control && (*((_BYTE *)rax35 + 68) & 2) !=...
- 121
1
vote
0
answers
18
views
How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
- 111
2
votes
1
answer
83
views
Function pointer as struct field in IDA
I have following function:
void __thiscall ParsePackage_v5(package_t *package, stream_t *stream)
{
(*(*package->stream + 8))(package->stream, package, 4);
}
.text:0069F5A0 ; void __thiscall ...
- 23
1
vote
0
answers
80
views
How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?
I am looking at the following CTF challenge:
0x56555779 <+0>: lea ecx,[esp+0x4]
0x5655577d <+4>: and esp,0xfffffff0
0x56555780 <+7>: push DWORD PTR [ecx-0x4]
...
- 1,738
4
votes
1
answer
95
views
How to force IDA to show size of pointer dereference?
IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register:
mov ecx, ...
2
votes
2
answers
168
views
Reverse function in .rdata field
I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll.
However, it appears in .rdata section in the .dll ...
- 121
1
vote
0
answers
72
views
How to call the Color Picker window in Ida Pro from a script?
I'm going to make a python script that allows you to color selected functions - in the right colors.
To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
- 481
1
vote
2
answers
227
views
How to use IDA pro to find ALL strings in an exe file?
I've been using IDA for some time and most of the time I can find the strings I am looking for in the String panel.
In one of the recent exe files I was working on, many string are missing, or not ...
- 19
2
votes
1
answer
160
views
How to create a function graph in IDA? Could not find grapher (Linux)
IDA (free v8.0 on Kali Linux) produces an error any time I attempt to create a graph, e.g. View > Graphs > Function Call:
Could not find grapher '/usr/bin/dotty'. Please check GRAPH_VISUALIZER ...
- 63
2
votes
1
answer
234
views
How to hide Remote Windows Debugger in IDA Pro?
Whenever I try to debug a 3D game through VMware and IDA Pro, an "access violation" pops up.
The error occurs in the body of the program after memory is allocated by the operator New.
...
- 481
1
vote
0
answers
64
views
Find an address of injected code via GetModuleHandleA
I am reversing really old game (20 years old).
l2.exe loads Dsetup.dll Network.dll. (not sure about order)
inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
- 111
2
votes
1
answer
63
views
Infer function parameter types from caller argument type in IDA
So i have the following code:
struct my_struct_t var1;
fun(var1);
I don't have the symbols for fun's parameter type but since it's called with an argument with type my_struct i would want IDA to ...
- 31
2
votes
0
answers
26
views
Find location to override PC by stack frame with stackoverflow
I have stackoverflow in MIPS arch (without ASLR/canary)
In Ida I see that the buffer that has the overflow located in SP+200
In the beginning if function I can see the stack size because I see the ...
- 151
1
vote
0
answers
301
views
Fail to load pdb file in IDA
I'm following this post to set my IDA symbol path How to configure IDA to load .pdb files from Microsoft public symbol server?
I added a system variable called _NT_SYMBOL_PATH with value SRV*\C:\...
- 121
0
votes
0
answers
41
views
RDATA Section Strings
I have been reversing a binary and trying to make sense of it, which is basically a go malware, there are lot of important strings at the .rdata section, but right now am not sure where this strings ...
- 11
1
vote
0
answers
128
views
What is the meaning of this message in IDA?
What is the meaning of this mmessage in IDA:
The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
- 23
0
votes
0
answers
104
views
IDA binary patch "has no file mapping"
I am trying to change one byte (TBZ to TBNZ) inside a ~40mb binary. Ive done this multiple times with other files but this time IDA is giving me a hard time by simply not patching and printing this to ...
- 1
0
votes
1
answer
90
views
ida pro: scripting debugger with python fails on step_over/run_to
So I am trying to run an app and collect information at certain points.
No biggie, right? Wrong. Check this simple example:
import ida_dbg
ida_dbg.step_over() #or runto()
eax = ida_dbg.get_reg_val(&...
- 423
0
votes
0
answers
69
views
Can someone help to understand code disassembly by IDA?
Can someone help to understand code disassembly by IDA?
Basically this use for calculate key from seed. Here I would like to understand the logic and also I would like to know what would be the output ...
- 1
0
votes
0
answers
57
views
Can anyone help to understand how Calli function work?
Can anyone help to understand how below function works?
Below is C# code which calls c++ dll function.
Utils.Conversions.GcStrToStdStr(accessMode, ref struct2);
_Common* nativeCommon = this....
- 1
0
votes
0
answers
70
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 21
2
votes
1
answer
462
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 23
2
votes
1
answer
125
views
Identify two structs in IDA
When decompiling an exe file, I have defined two structs struct A and struct B that are of the same structure. They appeared under different contexts, thus I assumed that they were different structs. ...
- 143
0
votes
1
answer
86
views
WinGraph32 for the OllyFlow plugin
I am trying to use the OllyFlow plugin for OllyDbg 1.10. It requires WinGraph32.exe, which was apparently distributed with IDA at some point, because the book Game Hacking says:
Wingraph32 is not ...
- 103
2
votes
1
answer
74
views
Am I missing symbols when RE'ing shellcode?
I have a question about reversing a tutorial which shows how to reverse engineering shellcode. My question is simple:
In figure 4, we see at (7) TEX.ProcessEnvironmentBlock: is this a comment, or was ...
1
vote
1
answer
74
views
Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro
We have an EXE that IDA pro lists the following segments:
Name Start End R W X D L Align Base Type Class AD es ss ds fs gs
cseg01 00000000 0000EA50 ? ? ? . ...
- 1,165
2
votes
1
answer
781
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6.
I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
- 121
1
vote
1
answer
40
views
Under what circumstances relative to instr rip+offsets to .rdata data may not match?
I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
- 43
1
vote
1
answer
47
views
Cannot reset botched IDA setting
I managed to accidentally modify the opcode column setting of the view window to display the data in word format (2 byte). For the life of me I cannot seem to figure how to switch if back to byte ...
- 21
3
votes
1
answer
133
views
How to select an item in IDAPython, in decompilation view?
I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures).
I have changed the arguments types for a list of ...
- 228
1
vote
1
answer
150
views
Can I get a valid source code from this assembly?
I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:
; code
pxor xmm0, xmm0
ucomiss xmm0, xmm1
ja short loc_67F31600
movss xmm2, cs:...
- 113
1
vote
0
answers
85
views
Auto-loaded type information and relationship between .til and .sig: how to find links and how to change them (config)?
NB: most of my targets are PE files for pc, so I'll stick with that for the question. But I suppose the principle holds also for the related directories, like $IDADIR/sig/arm.
Let's say I load a PE ...
- 10.6k
2
votes
0
answers
426
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
3
votes
1
answer
129
views
View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra
I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere
And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the ...
- 133
1
vote
1
answer
129
views
IDA not allowing Memory Mapping
I own an electronic instrument that has video display which has a horizontal timing issue. The graphics display initialization is done in a 256K bootrom and the desire is to use IDA to reverse the ...
- 21
2
votes
0
answers
335
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 219