Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
2
votes
2answers
40 views

X86 access to global strings pattern

While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it. .text:00002560 ...
1
vote
0answers
36 views

IDA 7.0: Why does editing this function result in red-marked stack-pointer offsets?

I tried to fix the size of both the saved registers and the local variable area using IDA's "Edit function" option as IDA could not recognize it properly by itself. Unedited function: Corrected ...
0
votes
0answers
35 views

how to calculate no basic blocks of a function using IDAPython

I am new to IDA Pro, IDAPython want to calculate no of basic blocks and its location in a function using IDAPython, please share the code with library needed to import.
1
vote
0answers
51 views

Reverse engineering old mmo

I am newish to reverse engineering and have a question about a problem with IDA Pro. I am trying to reverse engineer an old mmo game. Anyone know why dword_ calls show as "dd ?"? Float numbers and ...
0
votes
1answer
48 views

ida identifies library function as regular function

I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
4
votes
1answer
72 views

what routine in ntdll.dll is responsible of dispatching DllMain function of loaded dll?

I'm trying to debug a dll file using Ida disassembler and Windbg. I'm debugging rundll32.exe and passing the target dll (debugee) as an argument. I'm able to have a breakpoint on each Dll load & ...
1
vote
0answers
54 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
1
vote
0answers
23 views

Display open handle ids in IDA Pro

Is there a way to display all the open handles of a process in IDA Pro while debugging it? I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server. I want to ...
1
vote
1answer
24 views

Find Nearest Address Which Has XRef in IDA

I'm working on an executable. I've searched by string, and found my string appears once in something that looks like table of localized strings + keys. Now I want to find the function which accesses ...
1
vote
0answers
40 views

memory addresses in Hex View are always byte-aligned in new versions of IDA

In IDA < 7, Hex View shows addresses starting from any memory location you choose (both synchronize or G + address). For example, asking for 0019E7EC shows: 0019E7EC 48 4B 46 42 39 39 2D 32 51 ...
-2
votes
1answer
142 views

Debug and crack .NET executable PE

First of all, i'm trying to learn reverse engineering for testing my codes and that's all and i'm not stupid enough to do illegal things with my knowledge so please don't give me legal advises. I'm ...
1
vote
1answer
37 views

IDA Pro: How to change segment register value

For a specific Android library that I have loaded into IDA, I want to switch the THUMB/ARM mode to ARM, no matter the consequences that this is going to have to the code. Is there a way to efficiently ...
2
votes
1answer
49 views

NEC 76F004GD Disassembly

I have a Toyota ECU from 2005 with an NEC 76F0004GD micro controller on it, I have already read the full 512k dump from the chip using a K-Tag. However, when I tried to put it into IDA, there weren't ...
0
votes
2answers
93 views

asm snippet to pseudo-code

I'm looking into a way to generate pseudo-code from snippet of assembly, let's assume I have this ASM push rbp mov rbp, rsp mov DWORD PTR [rbp-4], edi mov DWORD PTR [...
0
votes
2answers
44 views

How to manually change the end of function and extend it in IDA pro?

So in a malware sample (Shelter) IDA doesn't include some parts of the function in the function itself, and puts the endp in an earlier part, so for example the function really ends at 0x401080 but it ...
-1
votes
2answers
58 views

Is address in program can change

I talking about linux arch. When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2 When I want use that address to breakpoint (for example with ptrace or ...
0
votes
0answers
20 views

bad memory mapping in case of MEMORY dump IDA <-> WinDbg

when I open the debug dump (IDA x64) , I don't have the memory ranges. Exactly like in this question: ESP out of range of "Stack View" in IDA It used to be fine, but I don't have the menu ...
1
vote
1answer
76 views

IDA pro not showing function names properly

I am working with a C++ application in IDA and whenever I name a function with a :: or a ~ symbol it shows up in the function window as an underscore which is very hard to read (ex. Class::Function ...
1
vote
0answers
68 views

Guidelines for dealing with obfuscated code

I have taken a deep dive into reversing software with IDA, I used Ghidra before. I have already solved a couple of basic crackmes now I have targeted another one which's code is obfuscated, also has ...
1
vote
1answer
21 views

How to specify path of output database in IDA Pro?

I'm trying to generate IDB files from the command-line using the -o flag of IDA, something like this: ida.exe -B input.dll -oC:\Results\input.idb. However, it seems that the value of the -o arguments ...
0
votes
0answers
25 views

How to view all of the struct member values in IDA pro?

The problem i am having in reading the struct values is that in the decompiler, when the struct is too large i cant view all the values when i hover over the structure member : Tried viewing these ...
-2
votes
1answer
108 views

How to fix Mach-O segment section to deobfuscate the binary

When reversing a Mach-O crackme file under IDA Free and MacOS, the analysis output a log in the console window that yields warning about Mach-O segments. Loading file 'target' into database... ...
0
votes
1answer
50 views

Problem with set of instructions in dissasembly

first of all I'm new to reverse engineering so here's a noob question hahaha, I'm trying to solve a crackme and I found this set of instructions: Why would it move the content of eax into cd:...
1
vote
2answers
96 views

How to decompile “call eax” in IDA Pro?

I know that there is a similar question but the answers didn't provide any fix for that problem. I am decompiling a .dll file, and I have found out the subroutine that I needed, but it's throwing a "...
0
votes
2answers
63 views

Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?

So lets say i have these type of instructions in functions : x == constant value x = constant value x > constant value no matter if its just an assignment or compare or anything, i want to get the ...
1
vote
1answer
53 views

How to create struct of bit fields in IDA?

Suppose that we have bit fields struct like this: struct PartInfo { unsigned int day:5; unsigned int month:4; unsigned int year:7; // year <= 99 unsigned int lot_no:11; // lot_no <= ...
1
vote
0answers
19 views

finding specific string in ios dyld_shared_cache

Im trying to find the library inside a dyld cache that contains a specific string. I grepped the cache file and for the offset of the string, however when im throwing the cache file to ida non of the ...
0
votes
1answer
64 views

Find functions signatures in Ida?

I didn't understand the subject of find function in Ida via signature. If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
0
votes
0answers
41 views

How to debug with gdb (rbreak) in order to obtain a callback to be used on C# interop

Well, I have several questions about this topic. I don't know if I'm using the right method to achieve what I need. I need to debug which exact method does something inside a process in order to ...
0
votes
0answers
21 views

How to visualize execution paths of dll in IDA pro

I'd like to know how to visualize execution paths of dll in IDA pro. I've used lighthouse with drcov to colorize the paths of exe, but I can't do it for dll. It's no problems for me if a way to ...
0
votes
0answers
87 views

How to reverse engineer Apple MacBook SMC update firmware image using IDA Pro 7.2?

Alright so I have watched extraordinary presentations videos from three different reverse engineers who hacked the Apple SMC Update firmware: Charlie Miller: https://www.youtube.com/watch?v=...
0
votes
0answers
58 views

How to force IDA to properly parse the ELF header?

Is possible to force IDA to parse the elf file into its appropriate fields without resorting to IDC/IDApython, I mean is there a built-in functionality that I'm missing? For instance it possible to ...
0
votes
0answers
35 views

Parsing C header files from DWARF Debug File

I have a Linux executable that has a linked .debug file containing DWARF debug info and I would like to find a way to parse C headers for types defined in the executable. Using gdb and ptype I can ...
1
vote
1answer
63 views

IDAPython: idaapi.get_highlight for demangled names

I'm using the following code to get the address of the selected function/variable: hightlight = idaapi.get_highlight(idaapi.get_current_viewer()) screen_ea = idaapi.get_screen_ea() ea = idaapi....
0
votes
1answer
31 views

IDA fails to recognize the new added segment during execution and seems to think its empty?

So i dumped a PE file after it was unpacked, but the problem is it references another section in the memory map, so i dumped that section and added it to IDA just like this question : IDA Pro - Load ...
0
votes
1answer
69 views

Malware attempting to move a value into $zero in MIPS?

Recently I have been trying to reverse engineer an IoT malware called NyaDrop using IDA. There I came across this mysterious assignment a few times. addiu $zero, 0xA as well as move $at, $at ...
1
vote
0answers
55 views

Ida pro: recompilable c code [duplicate]

Is it possible to produce recompilable C code using IDA pro? What I mean: I can export binary into C pseudocode using "produce file" feature. But, the code is not recompilable. First, defs.h file is ...
0
votes
0answers
26 views

How does BAP- BinaryAnalysisPlatform helps for reverse engineering

I saw the BAP- BinaryAnalysisPlatform as a helpful tool for reverse engineering. Can you please explain me how does this BAP, helps for reverse engineering (I already use Ida pro)
0
votes
0answers
25 views

Print Stacktrace when process read String

There is a process that prints HELLO , in Ida that simple to find it in Strings and watch with X-ref all the functions that read that strings. There is an option to put a hardware breakpoint on this ...
1
vote
1answer
63 views

Recognize binary architecture

I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux. When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
1
vote
1answer
40 views

IDA FLAIR doesn't see sig files

I've added the following sig files which were generated using flair 7.0 to ida 7.0 I want ida to find known function names from the sig files, when I list the FLIRT signature files I don't see the ...
1
vote
1answer
67 views

Ida python No module named tempo

I tried to run tempo.py from ida python github , but I got error No module named tempo According to Igor Skochinsky answer , this script is wrong Apparently, tempo was an internal module used ...
1
vote
1answer
21 views

How to mark collection of strings/ offsets in ida

I'm looking at a PE file that loads a bunch of strings and offsets into memory one after the other, and I was wondering whether there was any way to mark all of the dwords in a range of memory as ...
3
votes
2answers
125 views

Windows - syscalls being called in a strange way?

I've been reading about the way syscalls are called in windows. The general theme in all the articles I read is: 64bit- called inside ntdll 32bit- from ntdll jumping to KiFastSystemcall but when I ...
1
vote
1answer
249 views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...
0
votes
1answer
37 views

Appending strings mid function

I'm using Ida Freeware. The string should not be changed in .data section. Basically I need to append a few letters to a string mid function. Currently it looks like this: First I would like to test ...
1
vote
2answers
68 views

increment a register which has maximal value?

I am looking at some assembly code and can't get my head around it. The code below is shown in IDA. My question revolves on what happens in the loop. Let me explain what I exactly don't understand in ...
0
votes
0answers
10 views

How to give multiple inputs to IDA when using remote linux debugger every time the program is restarted?

So this is a problem I'm facing when solving pwn CTF challenges i usually need to give many inputs for a program to reach certain point every time i restart it i tried to do it like this, by putting ...
0
votes
0answers
15 views

Hex Rays Mapping To Wrong Variable

The assembly file has multiple variables which both use the rax register. The decompiler did recognize that at least somewhat, since it did create two variables which use the rax register. However, it ...
0
votes
0answers
58 views

Jump without jmp near

I need to jump a Hello, I need to jump some lines that lock program in a loop status. i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...

1
2
3 4 5
33