Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,608
questions
2
votes
2answers
40 views
X86 access to global strings pattern
While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it.
.text:00002560 ...
1
vote
0answers
36 views
IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?
I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself.
Unedited function:
Corrected ...
0
votes
0answers
35 views
how to calculate no basic blocks of a function using IDAPython
I am new to IDA Pro, IDAPython want to calculate no of basic blocks and its location in a function using IDAPython, please share the code with library needed to import.
1
vote
0answers
51 views
Reverse engineering old mmo
I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as "dd ?"? Float numbers and ...
0
votes
1answer
48 views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
4
votes
1answer
72 views
what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?
I'm trying to debug a dll file using Ida disassembler and Windbg.
I'm debugging rundll32.exe and passing the target dll (debugee) as an argument.
I'm able to have a breakpoint on each Dll load & ...
1
vote
0answers
54 views
How to setup VSCode with IDAPython?
Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
1
vote
0answers
23 views
Display open handle ids in IDA Pro
Is there a way to display all the open handles of a process in IDA Pro while debugging it?
I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server.
I want to ...
1
vote
1answer
24 views
Find Nearest Address Which Has XRef in IDA
I'm working on an executable. I've searched by string, and found my string appears once in something that looks like table of localized strings + keys. Now I want to find the function which accesses ...
1
vote
0answers
40 views
memory addresses in Hex View are always byte-aligned in new versions of IDA
In IDA < 7, Hex View shows addresses starting from any memory location you choose (both synchronize or G + address). For example, asking for 0019E7EC shows:
0019E7EC 48 4B 46 42 39 39 2D 32 51 ...
-2
votes
1answer
142 views
Debug and crack .NET executable PE
First of all, i'm trying to learn reverse engineering for testing my codes and that's all and i'm not stupid enough to do illegal things with my knowledge so please don't give me legal advises.
I'm ...
1
vote
1answer
37 views
IDA Pro: How to change segment register value
For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
2
votes
1answer
49 views
NEC 76F004GD Disassembly
I have a Toyota ECU from 2005 with an NEC 76F0004GD micro controller on it, I have already read the full 512k dump from the chip using a K-Tag. However, when I tried to put it into IDA, there weren't ...
0
votes
2answers
93 views
asm snippet to pseudo-code
I'm looking into a way to generate pseudo-code from snippet of assembly,
let's assume I have this ASM
push rbp
mov rbp, rsp
mov DWORD PTR [rbp-4], edi
mov DWORD PTR [...
0
votes
2answers
44 views
How to manually change the end of function and extend it in IDA pro?
So in a malware sample (Shelter) IDA doesn't include some parts of the function in the function itself, and puts the endp in an earlier part, so for example the function really ends at 0x401080 but it ...
-1
votes
2answers
58 views
Is address in program can change
I talking about linux arch.
When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2
When I want use that address to breakpoint (for example with ptrace or ...
0
votes
0answers
20 views
bad memory mapping in case of MEMORY dump IDA <-> WinDbg
when I open the debug dump (IDA x64) , I don't have the memory ranges. Exactly like in this question:
ESP out of range of "Stack View" in IDA
It used to be fine, but I don't have the menu ...
1
vote
1answer
76 views
IDA pro not showing function names properly
I am working with a C++ application in IDA and whenever I name a function with a :: or a ~ symbol it shows up in the function window as an underscore which is very hard to read (ex. Class::Function ...
1
vote
0answers
68 views
Guidelines for dealing with obfuscated code
I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1
vote
1answer
21 views
How to specify path of output database in IDA Pro?
I'm trying to generate IDB files from the command-line using the -o flag of IDA, something like this:
ida.exe -B input.dll -oC:\Results\input.idb. However, it seems that the value of the -o arguments ...
0
votes
0answers
25 views
How to view all of the struct member values in IDA pro?
The problem i am having in reading the struct values is that in the decompiler, when the struct is too large i cant view all the values when i hover over the structure member :
Tried viewing these ...
-2
votes
1answer
108 views
How to fix Mach-O segment section to deobfuscate the binary
When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments.
Loading file 'target' into database...
...
0
votes
1answer
50 views
Problem with set of instructions in dissasembly
first of all I'm new to reverse engineering so here's a noob question hahaha, I'm trying to solve a crackme and I found this set of instructions:
Why would it move the content of eax into cd:...
1
vote
2answers
96 views
How to decompile “call eax” in IDA Pro?
I know that there is a similar question but the answers didn't provide any fix for that problem.
I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
0
votes
2answers
63 views
Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?
So lets say i have these type of instructions in functions :
x == constant value
x = constant value
x > constant value
no matter if its just an assignment or compare or anything, i want to get the ...
1
vote
1answer
53 views
How to create struct of bit fields in IDA?
Suppose that we have bit fields struct like this:
struct PartInfo
{
unsigned int day:5;
unsigned int month:4;
unsigned int year:7; // year <= 99
unsigned int lot_no:11; // lot_no <= ...
1
vote
0answers
19 views
finding specific string in ios dyld_shared_cache
Im trying to find the library inside a dyld cache that contains a specific string.
I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
0
votes
1answer
64 views
Find functions signatures in Ida?
I didn't understand the subject of find function in Ida via signature.
If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
0
votes
0answers
41 views
How to debug with gdb (rbreak) in order to obtain a callback to be used on C# interop
Well, I have several questions about this topic. I don't know if I'm using the right method to achieve what I need.
I need to debug which exact method does something inside a process in order to ...
0
votes
0answers
21 views
How to visualize execution paths of dll in IDA pro
I'd like to know how to visualize execution paths of dll in IDA pro.
I've used lighthouse with drcov to colorize the paths of exe, but I can't do it for dll.
It's no problems for me if a way to ...
0
votes
0answers
87 views
How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?
Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware:
Charlie Miller:
https://www.youtube.com/watch?v=...
0
votes
0answers
58 views
How to force IDA to properly parse the ELF header?
Is possible to force IDA to parse the elf file into its appropriate fields without resorting to IDC/IDApython, I mean is there a built-in functionality that I'm missing?
For instance it possible to ...
0
votes
0answers
35 views
Parsing C header files from DWARF Debug File
I have a Linux executable that has a linked .debug file containing DWARF debug info and I would like to find a way to parse C headers for types defined in the executable. Using gdb and ptype I can ...
1
vote
1answer
63 views
IDAPython: idaapi.get_highlight for demangled names
I'm using the following code to get the address of the selected function/variable:
hightlight = idaapi.get_highlight(idaapi.get_current_viewer())
screen_ea = idaapi.get_screen_ea()
ea = idaapi....
0
votes
1answer
31 views
IDA fails to recognize the new added segment during execution and seems to think its empty?
So i dumped a PE file after it was unpacked, but the problem is it references another section in the memory map, so i dumped that section and added it to IDA just like this question :
IDA Pro - Load ...
0
votes
1answer
69 views
Malware attempting to move a value into $zero in MIPS?
Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times.
addiu $zero, 0xA
as well as move $at, $at
...
1
vote
0answers
55 views
Ida pro: recompilable c code [duplicate]
Is it possible to produce recompilable C code using IDA pro?
What I mean:
I can export binary into C pseudocode using "produce file" feature. But, the code is not recompilable. First, defs.h file is ...
0
votes
0answers
26 views
How does BAP- BinaryAnalysisPlatform helps for reverse engineering
I saw the BAP- BinaryAnalysisPlatform as a helpful tool for reverse engineering.
Can you please explain me how does this BAP, helps for reverse engineering (I already use Ida pro)
0
votes
0answers
25 views
Print Stacktrace when process read String
There is a process that prints HELLO , in Ida that simple to find it in Strings and watch with X-ref all the functions that read that strings.
There is an option to put a hardware breakpoint on this ...
1
vote
1answer
63 views
Recognize binary architecture
I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux.
When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
1
vote
1answer
40 views
IDA FLAIR doesn't see sig files
I've added the following sig files which were generated using flair 7.0 to ida 7.0
I want ida to find known function names from the sig files,
when I list the FLIRT signature files I don't see the ...
1
vote
1answer
67 views
Ida python No module named tempo
I tried to run tempo.py from ida python github , but I got error No module named tempo
According to Igor Skochinsky answer , this script is wrong
Apparently, tempo was an internal module used ...
1
vote
1answer
21 views
How to mark collection of strings/ offsets in ida
I'm looking at a PE file that loads a bunch of strings and offsets into memory one after the other, and I was wondering whether there was any way to mark all of the dwords in a range of memory as ...
3
votes
2answers
125 views
Windows - syscalls being called in a strange way?
I've been reading about the way syscalls are called in windows.
The general theme in all the articles I read is:
64bit- called inside ntdll
32bit- from ntdll jumping to KiFastSystemcall
but when I ...
1
vote
1answer
249 views
IDA and Ghidra Reversing
I have several questions about IDA and Ghidra (for MIPS and ARM):
Is there any option to load an executable file with all its libraries?
For example, I want to enter inside a function which its ...
0
votes
1answer
37 views
Appending strings mid function
I'm using Ida Freeware. The string should not be changed in .data section. Basically I need to append a few letters to a string mid function. Currently it looks like this:
First I would like to test ...
1
vote
2answers
68 views
increment a register which has maximal value?
I am looking at some assembly code and can't get my head around it. The code below is shown in IDA. My question revolves on what happens in the loop.
Let me explain what I exactly don't understand in ...
0
votes
0answers
10 views
How to give multiple inputs to IDA when using remote linux debugger every time the program is restarted?
So this is a problem I'm facing when solving pwn CTF challenges
i usually need to give many inputs for a program to reach certain point every time i restart it
i tried to do it like this, by putting ...
0
votes
0answers
15 views
Hex Rays Mapping To Wrong Variable
The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
0
votes
0answers
58 views
Jump without jmp near
I need to jump a
Hello,
I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
