Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
7
votes
1answer
5k views

Problem while debugging with gdbserver in IDA Pro

I'm new to debugging with IDA Pro and I ran into the problem that my breakpoint is not hit while attempting to debug with gdbserver. The program is written by myself and it is simple to debug with gdb....
5
votes
2answers
3k views

IDAPython for IDAFree 5.0

I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can ...
1
vote
2answers
878 views

Understanding packet byte structures with OllyDbg

I have written a small dll that detours the function that decrypts and encrypts game packets allowing me to see the packets being sent and received. Packets like login are easy to structure because ...
-3
votes
1answer
755 views

Difference between Instruction and Function in IDA Pro

I am newbie in IDA Pro. I have a basic question, what is the difference between instruction and function in IDA Pro? Is function contains some instructions on it ?! Thanks in advance :)
1
vote
1answer
2k views

Two disassembly windows in IDA

Is there any way I can have a kind of "split-view" where I can look at the disassembly of two different portions of the code(of a single file) in IDA? It'd be nice to be able to do that.
4
votes
5answers
4k views

How to find a subroutine (or next instruction) called after returning from a (Windows) dialog box?

The dialog box is a password challenge, and I'd like to catch/trace/observe the code (hopefully the password-checking code) that gets executed right after clicking the OK button of the dialog box. I ...
3
votes
1answer
744 views

Getting funcap plugin work in IDA pro

I am trying to use funcap plugin in IDA pro 6.1. However, after loading the plugin (with Alt+F7) and pressing the debugger's run button, it returns me: Internal error 30191 Any idea what is the ...
3
votes
1answer
925 views

Ida Plugin Batch analysis issue.

I overcame recent issues with a redefinition and finished my Plugin. In short this plugin uses Hex-Rays Decompiler to decompile a given file, analyzes properties of the pseudocode and then appends ...
1
vote
0answers
589 views

IDA Pro not showing structures, even when they're defined

I have this kind of code: I have reversed the struct entirely, and when I try to cast to ClientGame*, instead of: if(mainStruct->something & 2) I see: The offsets 0x364, 0x370, and 0x374 ...
2
votes
1answer
3k views

How to fix the type of a function pointer call in the Hex-Rays decompiler?

In a disassembly with a call to a DirectDraw->BltFast function, I encountered the following: (*(void (__stdcall **)(LPDIRECTDRAWSURFACE7, _DWORD, _DWORD, _DWORD, _DWORD, signed int, int, int, int, ...
2
votes
1answer
742 views

Forwarded call to “operator new()” in IDA Pro

I'm using IDA Pro with the Hexrays decompiler. There is a function like this: That function assigns the result of sub_100033AE to dword_10005368. So to know what the DWORD is, I checked what does ...
2
votes
0answers
397 views

IDA Signatures for OpenSSL [duplicate]

This may be an old topic, but I still haven't find a solution. Sometimes happens to reverse Windows executables that contain strings clearly related to encryption algorithms implemented through ...
1
vote
1answer
2k views

Adding another section to an idb file

I'm debugging a process inside a VM via Olly, and occasionally exporting a section dump when needed and loading it on the host system for better analysis. Right now I'm looking at a dump of a certain ...
2
votes
1answer
467 views

Issue with Hex-Ray's Decompiler Plugin, redefinition of 'vsscanf'

I am currently writing a plugin for the Hex-Ray's Decompiler to be used on IDA 6.2. The basic gist is that it is supposed to get the decompiled functions and run some automated analysis on it, nothing ...
2
votes
1answer
2k views

Deobfuscating IDA Pseudocode

I have wanted to get into the art of reverse engineering for quite some time now, so I took a look at a few online lessons (such as opensecuritytraining.info) and also got my hands on IDA Pro. ...
4
votes
1answer
553 views

ELF counterpart for IDA Pro PE utilities

I'm interested in patching ELF files using IDA and the following PE utilities have proven very useful for patching PEs. Does anyone know if there are some publicly available IDA scripts similar to ...
1
vote
1answer
894 views

Hide data areas in IDA IDC

I'm using the following IDC function to copy the RAM Data and Code sections from the packed binary, into the correct runtime locations for my Fujitsu FR system: static idc_memcpy(source, dest, count, ...
3
votes
1answer
990 views

IDA fails to load Symbols from EXE on Linux

When I try to load a Portable Executable in IDA Pro 6.6 it can't resolve the Symbols. I have hooked it to a win32_remote.exe. It keeps saying E_PDB_NOT_FOUND. I even have WinDBG installed.
4
votes
2answers
2k views

Setting an IDA function pointer in a struct via script

The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member ...
2
votes
1answer
1k views

Custom UI buttons

I just started using IDA and OllyDbg, although I am experienced developer but before this I was reverse engineering only Java and .Net code which is much more easy task comparing of what I need to do ...
2
votes
1answer
1k views

IDApro subroutine analysis

I am using IDA to find out parameters of a routine in a DLL. I browsed to the routine in question and saw that IDA has automatically done that job for me and put a comment like this: ; ==============...
4
votes
2answers
2k views

How to use IDC to clear output window in IDA Pro?

As a beginner I'm trying to use IDC to clear output window in IDA Pro,but I don't know which function will work. My IDA Pro version is 6.1.
4
votes
2answers
1k views

Image base of unknown file format?

As a beginner I'm trying to load an unknown format binary file with IDA Pro,but I don't know the Image Base of this file. Are there any methods to get the Image Base. Could you also reference related ...
1
vote
0answers
651 views

How to map enum types to imm values in IDA

I have added support for type info handling in my IDA processor, and now in the use_regarg_type3 event, I am mapping a parameter that I know is an enum. But, I am unsure how to set an imm operand to ...
0
votes
4answers
4k views

Can IDA Pro on Linux disassemble a Windows PE (or Mac OS X app)?

I am thinking of buying IDA Pro for my Linux programming environment after reverse engineering a bit with OllyDBG (under WINE)... But before I endorse into such a costly purchase I ask the following ...
2
votes
1answer
1k views

Loading multiple IDB files for debugging session

I can't seem to figure out if I can and how you load multiple idb files with notes into a debugging session? Is there a method or plugin that allows me to load these idb's? What I am doing now is ...
1
vote
1answer
1k views

IDA Pro breakpoints with side effects

I am trying to set a breakpoint that works by applying a condition. More precisely, I am trying to change the count increment in the AL register by placing a breakpoint condition saying AL = Al - 1 ...
1
vote
0answers
779 views

IDA Pro Patch Error

I am trying to alter a jnz in IDA but it wont allow me. It says: Cannot Reach Destination From current location Any reason for this problem ? Edit: The Program is Trying to CreateFileA. It Then ...
3
votes
1answer
2k views

Understanding unknown in IDA

What is this instruction trying to do? .text:4044A5EC LDR R5, =(unk_40885080 - 0x4044A5F8) Looking at the value of unk_40885080 it holds a value of 20 in the .data segment.
1
vote
1answer
1k views

IDA doesn't understand -0.0f (0x80000000)?

I'm relatively new to IDA. Recently I was disassembling an ARM binary that contains some signal processing routines. One of the data tables used by the routine is an array of floats, and one of those ...
1
vote
1answer
927 views

Reverse pseudo code

I am reversing a binary which seems to have all the symbols exported which helps. What I have seen is a pile of variables and functions which all start with the letter 'v', for example v101. I have ...
2
votes
2answers
584 views

Redirecting/Remapping/Rerouting a Memory Access

I need a little help from you guys! At present, I'm working on an IDA Pro Database in order to create a patch for an executable, and I'm totally stuck on editing the following sub: .text:008EC420 ; ...
3
votes
1answer
3k views

IDA and XRefs in the .data Section

When using IDA, I can press x on any subroutine to see where it is called from. Eventually I end up in the .data section. But, what am I looking at when I get to this point ? Are these exports ...
5
votes
1answer
2k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
3
votes
1answer
406 views

Experiences from reverse engineers in detecting recursive calls

I have absolutely no experience in reversing real-world binary codes, so I wonder how the obfuscated codes prevent reversers. I doubt that the reverses always find some ways to understand what are ...
2
votes
1answer
965 views

IDA PRO and Dos Load Exec

I am trying to reverse some DOS game in IDA pro (5.0 demo). I get stuck when it tries to load the overlay file. Is it possible to load the 2nd executable into the original namespace? It has already ...
3
votes
5answers
5k views

How do you compare C source code with the corresponding binary's assembly in IDA Pro?

I'm wondering if there's a way to compare source code to the disassembled assembly in IDA Pro? (e.g. I compile hello.c in Linux then open the binary in IDA Pro in OS X, and would like to compare the ...
3
votes
1answer
1k views

How to remote debug Linux binary from Mac OS X with IDA?

I heard that you can run linux_server on the linux server you wish to debug remotely, but I only see references to Windows on the IDA site. Can we use OS X to remote debug a linux program with IDA? If ...
3
votes
2answers
724 views

IDA - save work on kernel mode debugging

I'm working with IDA pro on a kernel mode function (VMware + windbg) and I'm a annoying because I can't save the workstation state. IDA crash after 3 hours when I "quit and save memory status". Is ...
5
votes
2answers
954 views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
3
votes
3answers
4k views

IDA Xrefs from - how to?

I want to generate all xrefs from function just to check what api it uses in its call-tree. I know I can generate call tree graph by right clicking on function name and "Xrefs from", but I would like ...
2
votes
0answers
195 views

Getting basic blocks using SDK

How to map an arbitrary address to its corresponding basic block in IDA? There are several ways to do it using Ida-python, but I am interested in pure C++ solutions (using IDA SDK, of course).
3
votes
2answers
6k views

DLL - Dynamic Analysis on IDA

I'm "middle-new" in re and I have to debug a dll's function. How can I tell to IDA : start function XXX with parameters A, B and C ? Is there a solution or a plugin doing that ? I've tried doing that ...
8
votes
1answer
3k views

Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better

When I decompile using IDA PRO I get code which could look like both of these Understanding the __PAIR__ macro. Macro itself. // The following definition is not quite correct because it always ...
7
votes
2answers
2k views

Virus uses a custom XOR encryption and need help possibly cracking it / Reversing EXE

As stated in my previous question i was infected by a encrypting virus that encrypts two 1024 byte blocks of any given file (First 1024, and last 1024) in some type of custom CFB XOR encryption. I ...
7
votes
1answer
9k views

What is the difference between step into and step over when debugging?

I am using EDB and stepping through the program but I do not even know what the difference in behavior is when doing this. I feel like this is something I should know if I ever have hope of reverse ...
2
votes
1answer
4k views

Set breakpoint on shared library

I am a noob to the reversing world. I have a Android Java application which uses a shared library via JNI and I would like to set a breakpoint in the shared library. The shared library is stripped ...
3
votes
0answers
509 views

Sharing IDC file between versions 5 and 6 of IDA pro

I am using version 6 of IDA because it is the only one that works on Mac. My colleague is using IDA 5. We would like to collaborate by sending the an IDC file back and forth. However, the IDC file ...
3
votes
2answers
4k views

Is there a way to adjust local variables when a function doesn't utilize ebp?

I have a problem just like in the question. Modern compilers don't use ebp to handle local variables and arguments, they just calculate and add hard=coded offsets to esp. Example: sub esp, 5Eh ...
4
votes
4answers
1k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...

1
27 28
29
30 31
34