Questions tagged [ida]
Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.
1,759
questions
3
votes
1answer
78 views
Specifying the register value which is constant for all the functions
In the firmwares I met the situation when some register value is set at startup, and then it's implicitly used as a base address to access the variables.
e.g. register r13 is set to 0x40000000 which ...
1
vote
2answers
98 views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
1
vote
1answer
64 views
How to stop Hex Rays optimizations?
I know it's not a bug, but a feature. Hex Rays found that there's a variable which is set to specific value, thus there's no need to display the branches where the code will never be run, so it warns ...
0
votes
0answers
30 views
How to create a form with a dropdown menu in ida in using C++ ask_form?
There is a function in kerwin.hpp, but its usage is unclear to me.
I want to display to the user a list of strings to choose from so I defined:
qstrvec_t fileNames;
I want the user to choose one and ...
0
votes
0answers
40 views
IDA error: “write access to const memory has been detected”
I'am a newbie of IDA and after disassably a file I get this error on some subroutine:
"write access to const memory has been detected"
// write access to const memory has been detected, the ...
0
votes
0answers
25 views
IDA Pro having issue decompiling gcc compiled ELF64 function with more than one leave/ret
I am new to IDA Pro and am not familiar with anything beyond default settings for decompilation. I have an ELF64 kernel module compiled with gcc and, in several cases, IDA Pro's decompilation is ...
0
votes
1answer
65 views
Failed to load IDA PLW plugin
I am trying to install mIDA plugin for IDA.
I found a compiled PLW file here: https://github.com/sourceincite/tools/tree/master/pymsrpc/mIDA , downloaded it and saved it to C:\Program Files\IDA 7.0\...
0
votes
1answer
54 views
How to simplify a function “calling itself's reference”
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
0
votes
1answer
42 views
open decompiler view of current module (dll) in dynamic analysis
I have a program (P.exe) with several dependencies (A.dll, B.dll etc). I decompiled and studied B.dll, but at runtime, P.exe is using A.dll. The horizon is updating in ISA view-RIP, but I don't have ...
2
votes
0answers
75 views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
0
votes
1answer
55 views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
1
vote
2answers
739 views
Hex-Rays not properly showing strings
Here's the difference between Hex_Rays and the debugger:
Note that I've synchronized the views, so they are showing the same operations in both the debugger and the decompiler. I've tried Edit -> ...
1
vote
2answers
51 views
Cannot disassemble exported functions
I want to disassemble a function from Kernel32.dll to see what it does, but every single function I try looks like this in the decompiler:
Function:
jmp ds:Function_0
Where is the function? ...
4
votes
1answer
174 views
Ghidra + IDA cant detect a string but Radare2 can
Im new to reverse engineering, and ive trying Ghidra, IDA (Freeware) and Radare2 with a simple CrackMe, the problem is, both Ghidra and IDA couldnt detect a string while Radare2 (Using Cutter GUI) ...
0
votes
1answer
69 views
Exporting C++ types from database to another
I have a pe dll binary with it's pdb file. I'd want to use this file's types in another database.
I tried to export the types using "Create C header file" and "Dump typeinfo to IDC file&...
5
votes
1answer
130 views
WinDBG Hung on Shellcode Execution
I've been trying to debug a piece of simple shellcode with Windbg. To go over the steps I took, I allocated a buffer for the shellcode with .foreach /pS 5 ( register { .dvalloc 400 } ) { r @$t0 = ...
0
votes
2answers
72 views
Correct target of absolute jmp in IDA
In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution:
F000:FEFF : mmap'ed location of function ...
2
votes
0answers
43 views
Is there a way to resume execution of a process for a given amount of time then suspend it?
I am using the following IDC script in IDA:
#include <idc.idc>
static main()
{
for (i=0; i<10; i++)
{
PauseProcess();
...
2
votes
1answer
174 views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
0
votes
1answer
50 views
Assuming x is a number smaller than 0xff what happens to x after the assignment LOBYTE(x)=x-1?
I understand that LOBYTE is an IDA macro for retrieving the lower byte of a variable. My question is what is the difference between the result of x=x-1 and LOBYTE(x)=x-1 when x is smaller than or ...
0
votes
0answers
55 views
IDA is already trying to suspend the process crash when debugging kernel?
Unlike Windbg where you can easily stop, in IDA when i want to pause the debugee and click on suspend, IDA says "IDA is already trying to suspend the process" then most of the times it ...
0
votes
0answers
25 views
IDA Windows determine programming language used? or even narrow down to compiler
[Python] So basically if something is written in python it basically screams at you "Hey this is python" if you go to a hexview and see tons of 'py' at the start of a module (pySpark, ...
0
votes
1answer
38 views
How to avoid database / code mismatch when developing and debugging your own code in IDA?
This seems like a very basic use case and I can't get it to work properly. I'm developing my own test application in Visual Studio c++. I want to test it through several IDA debugging sessions. Every ...
1
vote
1answer
59 views
Using windows 10 for malware analysis
I want to ask can I use windows 10 for malware analysis, I'm asking this because I see many reversers and analysts using windows 7 for this purpose. Can anyone please guide me?
2
votes
1answer
44 views
What is the difference between uintX_n (used in IDA Pro) and unitX_t types?
During debugging a binary in IDA Pro, I've noticed types of the form
30 uint16_n 00000002 struct {uint16_t inner;}
42 uint32_n ...
1
vote
4answers
89 views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
2
votes
1answer
74 views
IDA Pro “force new variable” for register variable?
IDA Pro 7.2 has a new functionality named force new variable.
See:
Here and Here.
But it is only efficient for stack-based variables. How can I force a new variable for a register-based variables?
1
vote
1answer
49 views
Injecting code into an ELF binary , got Segmentation fault(SIGSEGV)
I am currently working on an ELF-injector and my approach is standard: find code cave (long enough sequence of 0's), rewrite it with the instructions I want to execute and then jump back to the start ...
0
votes
1answer
53 views
What does this custom piece of frame manipulation code from a router binary do?
I've decompiled a custom router ELF binary using Hex-Rays and have recently come across the following function in the binary:
pkt_hdr_t *__cdecl pkt_hdr_from_frame(frame_t *frame, uint16_t *remaining)
...
0
votes
0answers
21 views
Configure window behavior in IDA Pro?
On 7.2 and later, IDA Pro would maximize the Window if i press Go and automatically maximize while disassembling, and it would no longer remember the window size anymore. I'm not used to it and I want ...
2
votes
3answers
80 views
Where Can I Get .PDB files for Windows OS Components?
I want to take a look at some components of the Windows OS in IDA, such as ntoskrnl.exe and some of the Windows API .DLLs. I understand there is a Microsoft symbol server, but I am not sure how to ...
1
vote
0answers
87 views
Right way to reverse a VM
I'm currently reversing a virtualized sample that uses a custom VM bytecode. After defeating the anti-disassembly tricks I'm finally faced with the vm_dispatch function. I have to figure out the ...
0
votes
1answer
64 views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
0
votes
1answer
34 views
Visual c compiler options
I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA.
This because I need to find a particular funciton with ...
0
votes
2answers
66 views
How to parse the NT headers and section headers of a PE file using IDApython?
I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
0
votes
1answer
51 views
How to parse the IAT using IDApython?
Is it possible to parse the IAT using IDApython?
i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
0
votes
1answer
165 views
IDA pro 7.5 - No previous fonts / color imports
For the past few years I've been using an ida color scheme which I created, that was very easy on my eyes with the previous versions of IDA Pro (<7.0). However, after start using version 7.5 I ...
1
vote
0answers
62 views
ZTE AES-256-CBC Encrypted backup config file
i tried router pass view tool on (a closed source one) it's able to decrypt the older version of it V3.1. tested on two routers of it and it gave me this output
Encrypted Data Start Position: 227
...
0
votes
0answers
46 views
Parsing binary file to Idb faster with Ida
When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores?
Is there any way to make that process faster? run it on all ...
1
vote
1answer
48 views
What do the following AARCH64 LDR and STR instructions do exactly?
The following instructions are part of a IDA's disassembly of an AARCH64 binary. While it is fairly obvious that the # represent pure numbers and the [] probably refer to the memory address referred ...
1
vote
1answer
81 views
Analyze stack with IDAPython
In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack.
char buffer[XXX]; // [sp+YYh]
How can I get that information (buffer size and place of this buffer ...
0
votes
2answers
114 views
Find assembly in binary with ida python
I want to find 2 consecutive instructions with Ida python
move r2,r3 ; move r2 r4
What is the easy way to find the addresses of that with Ida python?
I can Iterate on all Functions and for each ...
0
votes
1answer
50 views
Converting a data address offset to the equivalent struct in a C++ module
I have an offset to a property within a player class that I need to access data from. It's made of a specific struct that I have already assembled. IDA reports the accessing offset as so:
v32 = ( v3 + ...
0
votes
2answers
35 views
IDA how to view path between 2 functions
I like to view the path between 2 functions with IDA 7.0.
I have already tried with "function browser" but not work becouse these 2 functions are not linked.
For what I see there is no way ...
0
votes
0answers
32 views
Issue Debugging in IDA PRO
I am analyzing a binary file to retrieve the password. It requires a userID and password. By analyzing I need to crack the password. But after running through IDA it is being terminated.
First, I used ...
0
votes
1answer
59 views
Ida python find function address that using string
I have string at address 0xaaaa that I want to know the address of function that use this string
import idautils
len(list(idautils.XrefsTo(0xaaaa,1)))
return 0
Why is that ? When I tried this code ...
0
votes
0answers
22 views
Function obfuscation with hundreds of LDR PC, what is it called and how is it generated?
I am working on some obfuscated code. To my understanding, here is how the obfuscation works:
Take the subroutine you want to obfuscate, like;
LDR R2, [R0,#8]
MOV R0, #0
CMP ...
1
vote
1answer
79 views
IDA plugin to show xrefs to virtual functions?
I'm analyzing a C++ PE binary with its debug symbols using IDA 7.3 w/ the decompiler.
I'm using the HexRaysPyTools plugin to get the xrefs to class fields, but it doesn't show xrefs to virtual ...
1
vote
2answers
171 views
How to convert hexadecimal values to 16-bit Unicode in IDA Pro 7.5?
The context:
For a student project which goal is to make us learn reverse engineering and how to use IDA Pro, we have to reverse engineer the APT28 hospitality malware (as described in this blog post: ...
1
vote
0answers
17 views
Creating stack variables when they are addressed by non-SP register
So, I have ARM code which uses R7 as the register to access the stack variables:
In the first basic block IDA successfully identified R7 as stack pointer and created the variables. But then, after ...
