Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
2 votes
1 answer
90 views

Reading memory values in IDA

Want to get 32 bits from 0x8000 adress as 8 bytes MEM_EXT:00008000 db 54h MEM_EXT:00008001 db 53h, 57h, 20h MEM_EXT:00008004 dd 322E3256h, 31332030h, ...
  • 123
2 votes
1 answer
56 views

Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?

I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M). Looking at the idapython documentation, it looks like maybe I can do this via the ...
  • 196
3 votes
1 answer
157 views

IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text

Recently I got a program that has two colors of .text segment, one is black and the other is brown: While the flow chart and the decompiler work well on black part, they are both disabled on the ...
1 vote
0 answers
238 views

Themida devirtualization?

I'm trying to analyze virtualized? code in IDA which looks like this. which protection method is applyed on this code and how can i analyze this code?
  • 11
3 votes
0 answers
93 views

How to debug windows EFI modules during boot using IDA Pro's windbg?

I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
0 votes
0 answers
72 views

How to find the the event handler function for a QtAbstractButton?

I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
1 vote
1 answer
123 views

What are latest research in reverse engineering?

I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering. So, what are the latest ...
1 vote
1 answer
122 views

Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?

Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version. Problem is i have to do it again cause there ...
0 votes
0 answers
45 views

Working with IA64 in IDA Pro

When disassembling IA64 code in IDA Pro when I try to open the Local Types window i get an error: Sorry, the current processor doesn't support the type system
  • 481
1 vote
0 answers
48 views

Access a XREFs with frida

I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
  • 41
1 vote
0 answers
101 views

Corrupted IDA database .i64 file (Empty Header)

Im my 10 years using IDA Pro this never happend. I saved using IDA Pro 7.7 when I go to open today I find out that IDA PRO didnt put header on file If I try to open says "File .... is not an IDA ...
  • 11
1 vote
0 answers
91 views

IDA api: get function argument definition

So let's say we have the following code: 0: lea rax, [rbp+8] 1: mov rcx, rax 2: mov rdx, 5 3: call my_fun i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
  • 31
1 vote
0 answers
39 views

After jumping to a new segment, it warns "The memory could not be written"

I append a new segment right after the original ones in IDA, and I modify an instruction in .text seg to jump to the new seg to run my new codes. But when I use Local Windows debugger, it warns that &...
1 vote
0 answers
156 views

Convert instructions to op code bytes in python script for IDA Pro

I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work. This is my python ...
  • 99
4 votes
2 answers
409 views

How to make pseudocode in IDA more human readable

Some codes in IDA are not clear enough. Especially when they do reference after calculation while ( dx33[rdi24] ); if ( rax35 != &WPP_GLOBAL_Control && (*((_BYTE *)rax35 + 68) & 2) !=...
1 vote
0 answers
18 views

How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]

I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
  • 111
2 votes
1 answer
83 views

Function pointer as struct field in IDA

I have following function: void __thiscall ParsePackage_v5(package_t *package, stream_t *stream) { (*(*package->stream + 8))(package->stream, package, 4); } .text:0069F5A0 ; void __thiscall ...
1 vote
0 answers
80 views

How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?

I am looking at the following CTF challenge: 0x56555779 <+0>: lea ecx,[esp+0x4] 0x5655577d <+4>: and esp,0xfffffff0 0x56555780 <+7>: push DWORD PTR [ecx-0x4] ...
  • 1,738
4 votes
1 answer
95 views

How to force IDA to show size of pointer dereference?

IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register: mov ecx, ...
2 votes
2 answers
168 views

Reverse function in .rdata field

I'm tracking a function called CreateIoCompletionPort in dns.exe. The import tab in IDA shows that it's imported from api-ms-win-core-io-l1-1-0.dll. However, it appears in .rdata section in the .dll ...
1 vote
0 answers
72 views

How to call the Color Picker window in Ida Pro from a script?

I'm going to make a python script that allows you to color selected functions - in the right colors. To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
  • 481
1 vote
2 answers
227 views

How to use IDA pro to find ALL strings in an exe file?

I've been using IDA for some time and most of the time I can find the strings I am looking for in the String panel. In one of the recent exe files I was working on, many string are missing, or not ...
2 votes
1 answer
160 views

How to create a function graph in IDA? Could not find grapher (Linux)

IDA (free v8.0 on Kali Linux) produces an error any time I attempt to create a graph, e.g. View > Graphs > Function Call: Could not find grapher '/usr/bin/dotty'. Please check GRAPH_VISUALIZER ...
  • 63
2 votes
1 answer
234 views

How to hide Remote Windows Debugger in IDA Pro?

Whenever I try to debug a 3D game through VMware and IDA Pro, an "access violation" pops up. The error occurs in the body of the program after memory is allocated by the operator New. ...
  • 481
1 vote
0 answers
64 views

Find an address of injected code via GetModuleHandleA

I am reversing really old game (20 years old). l2.exe loads Dsetup.dll Network.dll. (not sure about order) inside of the Dsetup.dll i found and injection (kind of protection) into module Network.dll. ...
2 votes
1 answer
63 views

Infer function parameter types from caller argument type in IDA

So i have the following code: struct my_struct_t var1; fun(var1); I don't have the symbols for fun's parameter type but since it's called with an argument with type my_struct i would want IDA to ...
  • 31
2 votes
0 answers
26 views

Find location to override PC by stack frame with stackoverflow

I have stackoverflow in MIPS arch (without ASLR/canary) In Ida I see that the buffer that has the overflow located in SP+200 In the beginning if function I can see the stack size because I see the ...
  • 151
1 vote
0 answers
301 views

Fail to load pdb file in IDA

I'm following this post to set my IDA symbol path How to configure IDA to load .pdb files from Microsoft public symbol server? I added a system variable called _NT_SYMBOL_PATH with value SRV*\C:\...
0 votes
0 answers
41 views

RDATA Section Strings

I have been reversing a binary and trying to make sense of it, which is basically a go malware, there are lot of important strings at the .rdata section, but right now am not sure where this strings ...
1 vote
0 answers
128 views

What is the meaning of this message in IDA?

What is the meaning of this mmessage in IDA: The decompiler assumes that the segment '.text' is read-only because of its NAME. All data references to the segment will be replaced by constant values. ...
0 votes
0 answers
104 views

IDA binary patch "has no file mapping"

I am trying to change one byte (TBZ to TBNZ) inside a ~40mb binary. Ive done this multiple times with other files but this time IDA is giving me a hard time by simply not patching and printing this to ...
  • 1
0 votes
1 answer
90 views

ida pro: scripting debugger with python fails on step_over/run_to

So I am trying to run an app and collect information at certain points. No biggie, right? Wrong. Check this simple example: import ida_dbg ida_dbg.step_over() #or runto() eax = ida_dbg.get_reg_val(&...
0 votes
0 answers
69 views

Can someone help to understand code disassembly by IDA?

Can someone help to understand code disassembly by IDA? Basically this use for calculate key from seed. Here I would like to understand the logic and also I would like to know what would be the output ...
  • 1
0 votes
0 answers
57 views

Can anyone help to understand how Calli function work?

Can anyone help to understand how below function works? Below is C# code which calls c++ dll function. Utils.Conversions.GcStrToStdStr(accessMode, ref struct2); _Common* nativeCommon = this....
  • 1
0 votes
0 answers
70 views

IDA Pro maps wrong variable for offset

I hope there is a proper way to fix my issue. Here's memory layout: .data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r .data:004F3D10 ...
2 votes
1 answer
462 views

How do I reverse an exe packed with an unknown packer?

I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used... How can I unpack it if it's possible? ...
  • 23
2 votes
1 answer
125 views

Identify two structs in IDA

When decompiling an exe file, I have defined two structs struct A and struct B that are of the same structure. They appeared under different contexts, thus I assumed that they were different structs. ...
  • 143
0 votes
1 answer
86 views

WinGraph32 for the OllyFlow plugin

I am trying to use the OllyFlow plugin for OllyDbg 1.10. It requires WinGraph32.exe, which was apparently distributed with IDA at some point, because the book Game Hacking says: Wingraph32 is not ...
  • 103
2 votes
1 answer
74 views

Am I missing symbols when RE'ing shellcode?

I have a question about reversing a tutorial which shows how to reverse engineering shellcode. My question is simple: In figure 4, we see at (7) TEX.ProcessEnvironmentBlock: is this a comment, or was ...
1 vote
1 answer
74 views

Finding Correct Segment From An Address For Windows 3.1 EXE in IDA Pro

We have an EXE that IDA pro lists the following segments: Name Start End R W X D L Align Base Type Class AD es ss ds fs gs cseg01 00000000 0000EA50 ? ? ? . ...
2 votes
1 answer
781 views

How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6

I created an app in 2018 with python and then used Cython and pyinstaller v 3.6. I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
1 vote
1 answer
40 views

Under what circumstances relative to instr rip+offsets to .rdata data may not match?

I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
  • 43
1 vote
1 answer
47 views

Cannot reset botched IDA setting

I managed to accidentally modify the opcode column setting of the view window to display the data in word format (2 byte). For the life of me I cannot seem to figure how to switch if back to byte ...
  • 21
3 votes
1 answer
133 views

How to select an item in IDAPython, in decompilation view?

I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures). I have changed the arguments types for a list of ...
  • 228
1 vote
1 answer
150 views

Can I get a valid source code from this assembly?

I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as: ; code pxor xmm0, xmm0 ucomiss xmm0, xmm1 ja short loc_67F31600 movss xmm2, cs:...
  • 113
1 vote
0 answers
85 views

Auto-loaded type information and relationship between .til and .sig: how to find links and how to change them (config)?

NB: most of my targets are PE files for pc, so I'll stick with that for the question. But I suppose the principle holds also for the related directories, like $IDADIR/sig/arm. Let's say I load a PE ...
  • 10.6k
2 votes
0 answers
426 views

IDA Free vs IDA Home (to have Lumina)

I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function). I don't found in Google a tool to know for exemple the functions recognized by the ...
3 votes
1 answer
129 views

View user32.dll LoadStringA string ID's in IDA on MacOS like you can with Ghidra

I'm going through through Challenge 3 (Task 4) of Basic Malware RE: https://tryhackme.com/room/basicmalwarere And in Ghidra after I do analysis, I can view the .rsrc area and it shows me all the ...
1 vote
1 answer
129 views

IDA not allowing Memory Mapping

I own an electronic instrument that has video display which has a horizontal timing issue. The graphics display initialization is done in a 256K bootrom and the desire is to use IDA to reverse the ...
  • 21
2 votes
0 answers
335 views

Find constant variables with float values using Ghidra

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet: // Namespace: public class ...
  • 219

1
2
3 4 5
41