Skip to main content

Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
1 vote
0 answers
344 views

How to use IDA environment to run python scripts?

I am trying out following technique: https://github.com/CMUSTRUDEL/DIRTY This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset. It ...
R4444's user avatar
  • 1,807
0 votes
1 answer
71 views

My ida.reg file got deleted, is there any way to restore ida?

I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed - Is there any way to restore ida? ...
R4444's user avatar
  • 1,807
0 votes
0 answers
62 views

IDA Free Debugger slows down app substantially

I'm using IDA Free to decompile and debug an exectuable (a game, actually). When starting the debugger, the game runs really, really slow occasionally. Before, I have used Cheat Engine to debug the ...
Daniel's user avatar
  • 161
1 vote
0 answers
110 views

How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?

I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
LyZeN77's user avatar
  • 11
3 votes
1 answer
565 views

convert a memory location to string in Ghidra

I asked exactly the same question here, but later I figure out this community and found out this helpful to ask it here as well. I would like to have a decompiled pseudo-code in Ghidra like: ...
Iman Abdollahzadeh's user avatar
0 votes
0 answers
272 views

How to decrypt xxtea encrypt lua file from cocos2D game

I'm trying to decipher this game because it's about to be discontinued I tried to decompile the apk looking for image resources and lua files. Looking at the received title I guess that the game was ...
Neit's user avatar
  • 41
0 votes
1 answer
155 views

Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?

I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game. The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at. I was ...
Edward Winch's user avatar
1 vote
0 answers
72 views

After loading additional files into an IDA database: can I process it, including applying PDB etc?

After loading an additional binary (.dll) file into an IDA database, is there a way to run it through a similar routine as would happen if the DLL had been loaded standalone? What I am aiming for is ...
0xC0000022L's user avatar
  • 10.9k
1 vote
0 answers
94 views

DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro

I am having an issue when using the Cutter Reverse Engineering Program, Here is a Segment of Decompiled Assembly, in Cutter :- at 0000:4ed5 in the picture I posted the .string line of text is there, ...
Edward Winch's user avatar
1 vote
1 answer
91 views

IDC script offsets

I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
AndS's user avatar
  • 11
1 vote
2 answers
423 views

Using IDA 8.3 Freeware on a Z180 .bin file

The last time I tried my hand at disassembly it was in 1986-1988... a Z80 embedded processor PROM image file... 42K of code turned into 27000+ lines of assembler code... using a disassembly program ...
Mike's user avatar
  • 21
3 votes
2 answers
296 views

Inspect executable binary similarity

I've found a company in China selling a software that is clearly a copy of my own work. For context, this is actually a physical product that comes with a Ubuntu computer and the software pre-...
AndroC's user avatar
  • 131
0 votes
0 answers
41 views

Getting IDA pro to understand that a "large" push can be two separate arguments?

I am reversing a large 16-bit DOS application compiled with a borland compiler. This often pushes one 32-bit value to the stack when a function takes two 16-bit arguments. Is there any way I can get ...
Kender's user avatar
  • 1
0 votes
0 answers
115 views

How to force IDA to understand that a given literal value is the bitwise combination of enum members?

I have an .so file which uses the dynamic linker with dlopen and friends. So the values for RTLD_* used in dlopen are of relevance to me. The standard imported enum in IDA looks like this: FFFFFFFF ; ...
0xC0000022L's user avatar
  • 10.9k
0 votes
0 answers
72 views

IDA python : display not refreshing function parameters after type update

I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :) The issue : I have a ...
Jeremy's user avatar
  • 1
0 votes
1 answer
142 views

How to convert variable to struct member in IDA?

I'm working on a windows program which is walking PEB Ldr list. the related types are as follows: struct LDR_DATA_TABLE_ENTRY { LIST_ENTRY InLoadOrderLinks; // offset = 0, size = 0x10 ...
H3d9's user avatar
  • 3
0 votes
0 answers
52 views

How to get the byte offset of a type casted pointer in IDA PRO

v6 = v5 + 0x3E; if ( v5 + 0x1F >= 0 ) v6 = v5 + 0x1F; v7 = abs32(*(_DWORD *)(buf_14 + 8)) * 4 * (v6 >> 5); I want to get the byte offset pointer pointing at. Is there any way to get ...
msh's user avatar
  • 1
0 votes
0 answers
45 views

How can I map a binary that uses bank switching in IDA Pro?

Is it possible to memory map a binary that uses bank switching in IDA Pro? I'm trying to reverse engineer a binary for the Motorola 6800 architecture. The full 64Kb binary is mapped to the upper 32Kb ...
graphite_block's user avatar
1 vote
1 answer
782 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
valaGQ237's user avatar
0 votes
0 answers
126 views

Debug the DLL of an EXE using IDA Freeware

I'm trying to debug a DLL that is called in an executable file. I put the DLL in Ida Free and defined the breakpoints, and set 'Application' to the executable path. When I start the debug, the ...
Luiz's user avatar
  • 1
1 vote
1 answer
741 views

How to decode lua files and resource files that are protected from Frida and IDA64?

I am trying to decrypt Lua files from an Android game "The Sea Road: Fate Assembly" (APK download link). It uses Cocos2d-x, but it's encrypted, maybe with AES encryption. With Frida, the ...
xbuyk987's user avatar
0 votes
1 answer
75 views

IDA Pro: JDWP error: ABSENT_INFORMATION - Desired information is not available

I am trying to debug a dex file from an APK file in IDA Pro. I set some breakpoints when launching the activity. When I start the process, the application waits for the debugger. After some time, IDA ...
Quayyum Ali's user avatar
0 votes
0 answers
48 views

Using __usercall convention in IDA with non-x86 architecture

I'm working on SPARC binary in IDA Pro and need to use __usercall convention, but can't make it work. For example, I've tried to use the following function declaration to reflect the fact that the ...
Vadim  Yakovlev's user avatar
1 vote
1 answer
246 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33
1 vote
0 answers
80 views

Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?

My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing From my research, I have come to the understanding that in order to extract the ipa ...
rasputin's user avatar
0 votes
1 answer
100 views

IDA Pro Debugging GDB SendDbgCommand

I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging. Setting up the debug environment with IDA Pro using ...
Ballers's user avatar
  • 49
0 votes
1 answer
99 views

IDA python API set function chunk end

I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
Tomer Attali's user avatar
1 vote
1 answer
315 views

Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?

In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
rasputin's user avatar
0 votes
1 answer
296 views

NameError: name 'ScreenEA' is not defined

Part of Practical malware analysis Lab5, is to run a python script in IDA Pro I have tried by going to Files-->Script command then I have pasted my python code: sea = ScreenEA() for i in range(...
Octo's user avatar
  • 1
0 votes
0 answers
67 views

What to expect from a Reverse Engineering technical test with IDA for a junior position? Experiences?

I'm excited about the prospect of taking a technical Reverse Engineering test for a junior position that I've been trying to secure. The test is expected to last around 3 hours, and I've been informed ...
Rusty's user avatar
  • 1
2 votes
0 answers
140 views

Trying To Understand DOS Game Assembly Instructions

I am trying to understand assembly language instructions, for a DOS Game. I have looked at the following Link :- https://atrevida.comprenica.com/atrtut07.html reading about how VGA Graphics work in ...
Edward Winch's user avatar
0 votes
2 answers
194 views

How does IDA know the symbol names for classes and interfaces?

I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
trxgnyp1's user avatar
  • 103
0 votes
0 answers
105 views

How to load correctly a SPC56AP54 dump in Ghidra or IDA?

I am trying to analyze a SPC56AP54 MCU. I try to load it in Ghidra by selecting "MPC8270", but probably this is wrong and the disassembly looks bad. Can someone please give a hint if there ...
C0DER's user avatar
  • 61
0 votes
1 answer
102 views

Tool to analyze .obj files (not COFF) created with /LTCG

This Microsoft article states that: When building with LTCG, the compiler front end doesn't invoke the back end. Instead, it emits an OBJ file with IL in it. It bears repeating: this IL is not the ...
langlauf.io's user avatar
  • 1,560
2 votes
2 answers
257 views

How can I find the buffer of CryptGenRandom?

I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop. According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
Riemann's user avatar
  • 83
1 vote
2 answers
108 views

how to access the initialized data in windbg through offset from IDA

In IDA, I see a value called dword_1C0203AB4 which doesn't have a symbol name. I want to view the value in system. My windbg is connected to the system and the driver files in system and IDA is the ...
anonymous bear's user avatar
2 votes
1 answer
131 views

Problems with the display of constants in IDA Pro pseudocode

There is an elf x64 file, the pseudocode of IDA Pro 7.6 shows that a constant is 0xFFFFFFFD, but in fact it is "3" in the source code, how can I change it to show "3" in the ...
user6903's user avatar
  • 411
0 votes
1 answer
95 views

How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?

Is there an API which lets me programmatically: set the default string type (Setup) and rebuild the string list (Rebuild) ???
0xC0000022L's user avatar
  • 10.9k
0 votes
1 answer
252 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
1 vote
0 answers
124 views

Log functions called in IDA Pro?

When I run an exe in IDA how could I log which functions were called into a text file? log.txt: call func1 call func2 call func1 call func1 Not worried about indirect calls. This is for differential ...
Eva4684's user avatar
  • 11
1 vote
1 answer
112 views

Why I can't decompile this ARM function?

I have an ARM (thumb) function from Nokia's firmware: ROM:10A5409C srv_opps_normal_push_ind_handler ; CODE XREF: srv_opp_event_hdlr+1C6↑p ROM:10A5409C ROM:10A5409C var_18 = -0x18 ROM:...
raspiduino's user avatar
0 votes
0 answers
99 views

How do I properly decode the .bin files (RLE compression)? (DOS game - 1988)

Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking? The files are in .BIN format. Compression is RLE The game is from 1988 ...
The Thinker's user avatar
0 votes
0 answers
87 views

read params of int variable in ida?

I have located a known int variable that belongs to a tls library, the variable has parameters I need to look at to find the name of another variable I need. Is it possible to read the parameters?
Botytec's user avatar
0 votes
1 answer
154 views

idat.exe -S, path with spaces

I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so But I get an error. Among the logs is present the error: home\mypath: ...
Dario B.'s user avatar
0 votes
1 answer
86 views

idat.exe -S -A close without error

I have developed a idapython script and I run it using the following command: idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so In myscript.py I appended the exit(0) in order to ...
Dario B.'s user avatar
0 votes
1 answer
110 views

split function argument from IDA's hints

Suppose I have a function, I know that the first 4 arguments come with fixed registers. _BYTE *__fastcall foo(__int64 a1, _QWORD *a2, unsigned int a3, char a4, _QWORD *a5) For the fifth one, if I ...
anonymous bear's user avatar
1 vote
1 answer
239 views

How to quickly mark functions library in IDA Pro?

I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
void_17's user avatar
  • 33
2 votes
1 answer
427 views

IDA: Demangled name simplification in idapython

With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them. For example, the following function: Python> ida_name.demangle_name(idc....
Blub's user avatar
  • 123
1 vote
0 answers
88 views

How to remove a node in CTREE

Im learning about CTREE in IDA. Here is my ida decompiled code: v3 = 0; if ( !strcmp(Str1, "hello") ) v3 = 100; return a1 + v3; At this time, i just want to mess arround with CTREE ...
Brian MJ's user avatar
2 votes
2 answers
234 views

How to version control an IDA project?

I'm a git addict. Whenever I develop a C++, Python application, I need to version control it. For example, the csproj file managed by Visual Studio holds the compiling configurations for a C# project, ...
Gqqnbig's user avatar
  • 133

1
2
3 4 5
44