Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0 votes
1 answer
69 views

IDA: String referenced in Assembly, but not shown in string view

I was looking for a spcific string in IDA, but there were no hits in the "string view". Now after browsing the disassembly for a while I realize that not only does the string exist, IDA did ...
user avatar
0 votes
0 answers
16 views

why ida7.6, here() return not exact EA in structure address range?

scene: After I use one structure to define a global variable in .data segment, then I cant use here() to get the exact EA where the cursor is, only get the struture's head address. ask for help: How ...
user avatar
1 vote
1 answer
80 views

Automatically propagate types in IDA pro when variables are assigned?

Let's say I have this code in the decompiler of IDA pro: var1 = var2; And assume the type of var1 is X (for example X could be char array with size 5). Is there anyway that I can tell IDA that ...
user avatar
0 votes
1 answer
107 views

What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?

What is the meaning of this kind of jmp instruction in x86 assembly in IDA? Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]? When I follow that off_XXX, I get to the ...
user avatar
  • 1
0 votes
0 answers
48 views

Which encryption returns 192 hash value it means 96 in bytes?

I am reversing an APK and there is a signature that needs to be found. The function from where the signature is generated is present in the .so file. I did small debugging. While doing it, the ...
user avatar
0 votes
0 answers
25 views

IDA debugger register string pointer in conditional breakpoints

When debugging in IDA, it’s possible to use an IDC script as the breakpoint condition. I want to break if EAX points to a null terminated string which contains “substring”. I can’t seem to find a ...
user avatar
1 vote
1 answer
51 views

IDA: close without saving changes

In my work, I often end up with lots of IDA windows open concurrently. Once done with analysis, I would like to close them all. It is relatively easy to issue a command to all of them simultaneously e....
user avatar
  • 135
0 votes
0 answers
54 views

How to debug a DLL without rundll32

I'm currently looking at the sample mentioned in this article here, and it seems that it uses the SvcMain function prototype instead of the runnableExport function prototype used by rundll32. As a ...
user avatar
1 vote
1 answer
151 views

How to create and change variables at address in IDA Python?

I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it. For structs, there's ...
user avatar
  • 206
1 vote
1 answer
37 views

IDA Pro S12X flash page references

Trying to analyse a dump from MC9S12X series MCU and can`t get how IDA making cross flash page references and if it could be done without scripts. The project contains 64 code segments with linear ...
user avatar
1 vote
2 answers
102 views

What is the point to have 2 different places for structures: Local Types and Structures in IDA?

Why is there 2 places for structures in IDA: Local Types and Structures? What are Local Types local to? Why do I have to synchronize a type in the Local Types window to the idb in order to edit it? ...
user avatar
  • 206
0 votes
0 answers
36 views

ida shows instructions as hex data

I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem. at the start of the program, there is a label that points to an address of ...
user avatar
0 votes
0 answers
31 views

Is it possible to rebase direct calls and jmps when i rebase the IDB in IDA pro?

When i rebase the IDB file, it doesn't effect the direct calls, so something like call dword ptr ds:851F3020h Will not get rebased and all of the sudden all my direct calls are pointing to ...
user avatar
1 vote
1 answer
42 views

Does opening a crash dump run a file in memory?

I am new to malware analysis, and I'm learning how to detect malware that uses process injection to execute PE files from memory. I chose a ransomware sample that uses process injection to load the ...
user avatar
1 vote
0 answers
29 views

Easiest way to move everything, including custom structs, from an IDA Pro IDB to another?

I have analyzed a 32 bit version of an executable, defined many structs, renamed many things and so on. Now i want to move everything, including the structs that i defined, to the IDB of the 64 bit ...
user avatar
0 votes
0 answers
46 views

Red color in IDA

Why in IDA the numeric offset next to [ebp- marked with black letters in red background? .text:004015D0 ; int __stdcall WinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPSTR lpCmdLine,int nShowCmd)...
user avatar
  • 113
0 votes
1 answer
46 views

How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)

In IDA Pro, when you create a custom struct, apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable, it only prints limited ...
user avatar
1 vote
2 answers
60 views

IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)

I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
user avatar
  • 39
0 votes
0 answers
46 views

How can i reconstruct a full PE from a memory injected PE that only has IAT + sections content?

I have a injected PE (kernel mode rootkit to be exact) that only has the IAT table, which basically only stores the addresses of some kernel functions in an array which is referenced inside its code, ...
user avatar
2 votes
1 answer
72 views

Disable optimization of for loops in Hex Rays Decompiler

Are there any good ways of splitting up a very long for loop or if statement in IDA into larger chunks to make it more readable? Disabling use fast structure analysis in the Hex Rays decompiler ...
user avatar
2 votes
2 answers
115 views

How to import macro as enum into IDA Pro?

Is there any tools can auto generate enum type by macro? For example, NTSTATUS in Windows defined as #define STATUS_ILLEGAL_INSTRUCTION ((NTSTATUS)0xC000001DL) #define ...
user avatar
  • 117
1 vote
1 answer
47 views

Double jump when calling functions

I wanted to ask why there is a double jump when calling some functions? For example first call: .text:005AC266 push eax .text:005AC267 call j_WinRegisterWindow ...
user avatar
  • 113
0 votes
1 answer
76 views

How to get IDA and Hex-Rays to forcibly sync their knowledge of the sample on-demand?

; PCWSTR __stdcall RtlGetNtSystemRoot() public RtlGetNtSystemRoot RtlGetNtSystemRoot proc near ; CODE XREF: LdrpBuildSystem32FileName+1A↑p ...
user avatar
  • 10.5k
0 votes
0 answers
26 views

How to change the color of a graph edge and custom hints in IDA

I would like to access the API to change the color of graph edges to reflect my assessment of their correctness (I already know how to do this within the tool, I need to do it programmatically). There'...
user avatar
  • 101
1 vote
1 answer
65 views

List instructions to fix wrong IDA analysis

I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
user avatar
  • 97
1 vote
2 answers
71 views

How do I find where in the code a particular Windows Resource is used?

I'm trying to reverse engineer a Windows program. Using PE Editor, I find that the string in question - which I'm interested in - has got id 2820. The string is in this format: "Some text, some ...
user avatar
  • 111
2 votes
1 answer
98 views

How do I reverse engineer structs that are put as parameters in a function

how do I go around figuring out where to reverse engineer a struct? As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
user avatar
1 vote
1 answer
74 views

Exporting all function addresses from IDA

I have a x86 executable opened in IDA. In the function window you can see a list of all functions with their starting address. My goal is to programmatically export a list of all functions IDA found ...
user avatar
  • 13
2 votes
2 answers
92 views

How to restore struct fields

I have an object named ComputeService::RPC that is being used as input in a function inside a binary file: __int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this) pc *...
user avatar
  • 451
-1 votes
2 answers
62 views

Parse offset to PE struct

Im trying make my idb beautier. I want to parse the offset to PE structure. Here is some example: I want to parse (module + 60) to (module_base->e_lfanew) but when i change the type of module_base ...
user avatar
1 vote
1 answer
86 views

How could I find a call of a function thats only referenced inside a vftable?

So I have this function which I'm trying to figure out the arguments to. However, all the xrefs of it point to a VFTable. How would I find a call for this function?
user avatar
  • 11
1 vote
1 answer
207 views

How to get function signature using IDA Python in IDA Pro

I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names. I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
user avatar
  • 11
0 votes
1 answer
88 views

How do I find a function and find out what it does using reverse engineering?

I am attempting to find a function in a specific game. Is there anyway that , using the assembly code I get from decompiling the game in either Ida or x64dbg , I can locate a function I am ...
user avatar
2 votes
1 answer
149 views

Finding function from pattern

I have been trying to reverse engineer a game for a while now. I have a pattern already for the function I want to find: \x89\x54\x24\x10\x4C\x89\x44\x24\x18\x4C \x89\x4C\x24\x20\x48\x83\xEC\x28\x48\...
user avatar
0 votes
0 answers
61 views

Injecting class into the JNIEnv in android jni

void *handle = dlopen("/data/local/tmp/libnative-lib.so", RTLD_LAZY); if (!handle) { printf("\nFailed to load library\n"); } void *offset = dlsym(handle, "...
user avatar
1 vote
0 answers
47 views

How to hide NOPs in IDA?

I am trying to understand a method in IDA Free and I find the NOPs, especially the multibyte NOPs confusing. Is it possible to hide these? I believe that they are not relevant for my understanding.
user avatar
2 votes
1 answer
259 views

In IDA what does db and dd offset means in data section?

So, in .data section there is some variable, and after it there is db or dd (offset). What exactly does this mean? And what does “align” means? Is there any Wiki or something like that that tells all ...
user avatar
2 votes
0 answers
69 views

Strange exception thrown while debugging in Win10, but not Win7

I am disassembling a legacy 32-bit (x86) application using IDA Home (7.6) (for x86 disassembly) in a 64-bit Windows 10 environment running in a virtual machine (VMWare Fusion for Mac). The application ...
user avatar
1 vote
0 answers
66 views

IDA tracing not working

I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called. I have tried to use IDA Tracing, but it doesn't print to file.
user avatar
  • 73
1 vote
1 answer
46 views

How To Access Predefined Class Attributes From IDA Pro After Loading The Binary Without Debugger Attached To Process [closed]

I have this class with constructor offsets and attributes: public class example { // Fields public float Attribute_1 = 1.5f; // 0x8 public int Attribute_2 = 102 ; // 0xC // RVA: ...
user avatar
  • 21
1 vote
1 answer
71 views

Can I get loaded pdb file path from IDAPython?

IDA Pro can automatically download and load .pdb files from symbol server. And now I want to write an IDAPython plugin to obtain some data from the .pdb file. But I don't know how to get the file path ...
user avatar
  • 117
1 vote
1 answer
112 views

A tutorial or docs to unpack a custom packed PE

I am facing an odd situation. I have a licensed game that's doing odd actions on the system. I isolated it as I could and observed the behavior both network and so forth, and I suspect it's a custom-...
user avatar
  • 11
2 votes
1 answer
163 views

Free alternative to Lighthouse Code Coverage Explorer?

I was trying to find if there is any free tool that allows an output similar to Lighthouse. I want to highlight the code paths taken so that I only reverse engineer the parts that are being executed. ...
user avatar
2 votes
1 answer
125 views

Does Ghidra have an equivalent to IDA's "Evaluate Expression" feature?

This is the window that appears when you press Shift + /. Example:
user avatar
  • 33
1 vote
0 answers
50 views

identify the functions of stripped binaries

As far I know that stripped binaries when we decompile it we can't know what most of functions (sub_XXXXXX) really do becuase they are not part of the binary's symbol table, so the names are ...
user avatar
0 votes
1 answer
64 views

idapython: type information with different prefixes

I checked how to get type information here - https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf.html Although, I am not sure what these different type prefixes mean. For e.g. BT_{...
user avatar
  • 1,427
1 vote
0 answers
51 views

Force IDA to redo SP analysis?

I had a function which I was unable to decompile due to a positive SP value, I tried to change it manually but accidentaly made everything worse, is there a way to restore/make IDA redo the original ...
user avatar
  • 39
0 votes
1 answer
138 views

IDAPython: function parameters and return value

I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using tif = idaapi.tinfo_t() ida_nalt.get_tinfo(tif, ea) function_type = tif....
user avatar
  • 1,427
1 vote
1 answer
76 views

Re-analyse HexRays decompiled output

I have analysed a large library in an older version of IDA and want to upgrade. I have marked lots of functions as "decompiled" and changed their function signatures. How do I automatically ...
user avatar
  • 113
1 vote
1 answer
101 views

How is it possible to generate C++ class header from a .dll or ELF file?

I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
user avatar
  • 204

1
2
3 4 5
39