Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,712
questions
0
votes
1answer
58 views
Debug with IDA Pro right click option
So I was wondering if is there a way for IDA to appears in the righ click options of an executable.
As you can see, Debug with x64dbg was built by itself, IDA 32 didn't do, so I just changed it in ...
2
votes
0answers
40 views
IDA stack depth differences when branching
I'm decompiling some Direct3D code that makes a lot of indirect calls to __stdcall functions.
For example:
call dword ptr [edx+0xC8h]
which is really:
pD3DDevice->SetRenderState();
IDA doesn't ...
0
votes
1answer
83 views
What is copy_block struct in Tricore Arch?
Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below:
ld32.w d4, [a0]-0x68D4
I know a0 = 0xD00032E0 but ...
3
votes
2answers
97 views
How can I get xrefs to class member variables in IDA?
I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it.
I want to know how I can get a list of all references to a given class member ...
1
vote
0answers
32 views
After jumping to the xref operand of a function I found via string searching in IDA, I am brought to an rdata section? [closed]
First post here, so sorry. I'll try to keep it short. Anyways, when trying to xref an operand (to find its offset), it brings me to an rdata function. It looks like this:
.rdata:00000001419318D8 ...
2
votes
2answers
87 views
Finding Code Reference String in MS-DOS 16-bit Executable with IDA Pro
Have an application that has code to detect serial port model. I'm trying to work out how it works through static analysis. I have unpacked the EXE and can find the references to the strings:
dseg:...
2
votes
1answer
58 views
how can I diff two ARM32 binaries at assembly code level?
I'm looking for a tool like Beyond Compare, meld, kdiff, etc. which can be used to compare two disassembled binaries. I know that there's binary (hex) comparison, which shows difference by hex values, ...
2
votes
1answer
70 views
IDA PRO: How to set conditional breakpoint on a EAX register value?
I want a breakpoint when the EAX record == 1. here's an IDC script that does this, but it is very slow. does anyone have a faster script or plugin that does this?
#include <idc.idc>
static main(...
-1
votes
1answer
51 views
IDA PRO: How to set conditional breakpoint on a register value?
I want to set a breakpoint when the register EAX = 00000001
0
votes
1answer
52 views
Custom IDA Decompilation Format
Is there a way to customize the format of IDA's decompiled code?
e.g.
char buf[7]; // [rsp+5h] [rbp-1Fh]
to
char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ]
or
switch (c)
to
switch( c )
0
votes
0answers
41 views
Question about weird instructions which is not able to understand for me
I tried to analyze a certain part of program with IDA PRO, So I set a break point at some instruction and start debugging(press F9 key)
Afer It start debugging mode, I was pressing F7 key(step into) ...
0
votes
2answers
25 views
Determine if there is a cross reference using idapython given a specific address
I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from)
ea_start = #
ea_end = #
for ea in ...
1
vote
2answers
55 views
How to attach IDA Window back to be part of the IDA main window
I accidently maximized the functions Window and now it is de attached from the main window:
How can I attach it back to be part of the main window? I tried to drag it but it doesn't work. Also re ...
1
vote
1answer
80 views
Can you decompile code if you Know the Complier?
My company has a small number of .exe that were written in the '80s that are performing some minorly important tasks. Source code is gone and documentation is scarce. In order to run them we need to ...
0
votes
1answer
72 views
Analyzing raw binary without ELF header in IDA Pro
I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro.
I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is ...
0
votes
0answers
70 views
In which program do I reverse engineer UEFI firmwares
I came into a problem, where I am unable to use a hardware due to a firmware incompatibility. As I have multiple sources and proofs that the hardware is indeed supported on the hardware level, and it ...
0
votes
1answer
52 views
How to resolve major function numbers to their name while reversing windows drivers?
I'm reversing some windows drivers, and IDA never converts numbers to their corresponding major function name like IRP_MJ_CREATE = 0x00, how can i force this? is there anyway i can convert a number to ...
0
votes
1answer
67 views
Why some functions in IDA can't be searched
I don't know why but I noticed, on some program I am reversing, that in a section named .bss, there functions and I can't find them through the regular search, why is that.
For example, I wanted to ...
0
votes
0answers
20 views
Patching swift methods
The following is taken from a de-compiled iOS app.
Is this a swift method?
Is it objective-c derived?
Why is it showing in IDA as EXPORT?
Can this be patched to return 1?
EXPORT _$...
1
vote
1answer
46 views
Edit IDA signal handler
In Ida Pro while debugging linux process with gdbserver I got window that show than SIGTRAP has been arrived, I choose to pass it to application.
How can I edit that choose now? I want to ignore this ...
0
votes
0answers
45 views
trying to understand this mov memory[register] instruction
Windows 10, IDA Home, 64bit application compiled with Visual Studio.
I'm reverse engineering a crackme and i found this instruction :
mov cl, byte_51B000[eax]
mov byte_51B018[edx], cl
in ...
0
votes
0answers
37 views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
0
votes
1answer
96 views
Find out the name of constants and var in IDA pro
I'm trying to search with IDA pro constants of type "#define SIZE 100" and normal local variables from a gcc-compiled binary file. I know there are a lot of open threads on the subject but I ...
0
votes
1answer
92 views
How to inform Hex-Rays decompiler (7.0) of known register values?
I'm currently working on a binary that has encrypted strings, using IDA 7.0. The encrypted data is copied to another location in memory, which is then decrypted. I have already decrypted the strings ...
0
votes
1answer
75 views
what is Off in IDA Pro?
probably silly question, what does Off ... means in IDA Pro?
i markered the snapshot as an example.
0
votes
0answers
58 views
how to get all “called functions” in idapython
I am using following function to generate a call graph using idapython:
def generate_graph():
callees = dict()
# loop through all functions
for function_ea in idautils.Functions():
...
1
vote
1answer
46 views
Problem when opening a script file in IDA (syntax error)(pe_sections.idc)
I downloaded the script files from http://www.openrce.org/downloads/details/57/PE_Scripts.
Then i extracted the files in the folder idc in the IDA folder (C:\Program Files\IDA 7.0\idc)
I opened IDA (...
0
votes
0answers
85 views
idapython: how to apply hexrays types to disassembly interface
I am using idapro 7.5 to get variable information from binaries.
Consider following simple code:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
int i, N, ...
2
votes
1answer
101 views
WinDBG doesn't resolve function names when debugging kernel module
I am debugging a kernel driver. When I set a breakpoint with WinDBG in one of its functions but it doesn't complete the function names while on IDA it shows the names (statically).
Here is a picture ...
0
votes
1answer
34 views
How to run a process with high privileges using remote debugging
I am using remote debugging with IDA. The target and host machine are Windows.
I can run the process on the remote machine and debug it with IDA using remote debugging but I need that the process will ...
1
vote
1answer
99 views
Statically Reverse Engineering Shellcode - IDA to Ghidra
I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/
Hash: ...
0
votes
0answers
32 views
ida: a better way of printing ida script output on console
I just started exploring ida. I have a simple IDAPython script.
import sys
import idc
import idautils
# wait for auto-analysis to complete
idc.auto_wait()
for ea in idautils.Functions():
print(idc....
0
votes
1answer
104 views
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
0
votes
1answer
70 views
A bit confusion with cheat engine function address and IDA subrutine
I have found a function with Cheat Engine that I like to show in IDA:enter image description here
but the function is not present in IDA.
Probably I have a bit confusion becouse I don't have ...
1
vote
2answers
78 views
How to set conditional breakpoint to modify ZF (Zero flag)
In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0.
I don't know how to do it:
I searched for example scripts in IDC or ...
0
votes
2answers
65 views
Order of arguments in __usercall
i have the following function with five arguments:
; int __cdecl trampolineRegister(void)
a4= dword ptr 8
a5= dword ptr 0Ch
push ebp
mov ebp, esp
add eax, ...
0
votes
0answers
64 views
A way to detect a anti-cheating system
I have created a DLL for DLL inject injection to add a force feedback to a GOG game. The DLL Work perfectly. I have tried to see how work the Debug in CE with this script:
debugProcess() -- Attach ...
0
votes
0answers
72 views
IDA IDC script does not seem to work
I am trying to measure code coverage for a malware sample linked here. I am using DynamoRIO's(7.1.0-1) drcov utility to get an ASCII log. The log file is linked here. I am then using Dynapstalker to ...
0
votes
0answers
105 views
How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”
I have IDA 6.95, Python 2.7 and Python 3.7.
Currently when I start IDA it uses Python 2.7:
-----------------------------------------------------------------------------------------
Python 2.7.12 (v2.7....
0
votes
0answers
55 views
Address register offsets and analysis (Tricore)
I'm decompiling a binary file for a Infineon Tricore processor, the code is incomplete and only contains part of the code so will not execute. The auto analysis did a great job and the code is ...
1
vote
2answers
149 views
STL Data Structures Hex-Rays
We all know that reversing STL code is no fun. To make it easier, I usually create some of the strucutres so I can reference the created STL structures in another custom structure.
For example, msvc - ...
1
vote
0answers
62 views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
0
votes
0answers
21 views
What is the meaning of call ds:ApiName[registry*constant] in IDA .asm files?
I have a dataset of .ASM files generated by IDA (dont have the corresponding file)
now there are a lot of calls like this :
.text:00637114 5F pop edi
.text:...
0
votes
1answer
334 views
What do these 2 Ghidra warnings mean?
When disassembling ARM binaries in Ghidra, I often see these warnings:
/* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
/* WARNING: Treating ...
0
votes
0answers
23 views
Failed to load .net binary on IDA Pro
I tried to use IDA Pro to load a binary file. IDA detected it as a .NET file:
but when I click OK to load the program, the following error occured, and the program can't be loaded:
I tried to google ...
0
votes
1answer
43 views
Can't find sequence of bytes in IDA while debugging
While debugging a program, I have an address 0011E028 in eax that points to another address: 680df44:
I wanted to see what appear inside the address 680df44 so I go to Search > sequence of bytes......
0
votes
0answers
54 views
How to reverse engineer structs
I am new to reverse engineering, really new, I am able to reverse engineer vtables and getting function indices for each of them (with the help of the original SDK of the software that I work with), ...
0
votes
0answers
20 views
IDA, wrong jmp operand after patching
I'm writing a python script for IDA to automate the deobfuscation of a binary.
After patching with a jmp instruction ida provides the following disassembly:
.text:008FD01E jmp ...
-1
votes
1answer
131 views
IDA decompile binary file
how can I decompile a binary file using IDA? I tried opening it and it said it cannot find the entry point automatically and I don't know where to find it,
1
vote
1answer
97 views
Get a networkx graph from the the function call-graph of the file using IDApython?
Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
