Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
1
vote
1answer
35 views

Is there a way to edit structure field value in memory during debug

I'm debugging some code and I know that there's a structure in memory, I have a definition of the structure, I apply it on memory, then I look at the structure field values, and I see that one of the ...
0
votes
0answers
91 views

How to recover randomly generated private key from a Program that implements Diffie Hellman Exchange

This program implements Diffie Hellman key Exchange, a pair of random private keys are generated every time the program runs. How should I go about finding the random number generation subroutine ...
0
votes
1answer
74 views

How to Modify CBZ Branch in ARM64?

If I want after running the CBZ W0, loc_C5C8 command Run to the ADRP X8,#selRef_curent_version@PAGE command regardless of the condition (in picture), what should I do?
0
votes
0answers
35 views

IDA Fails to Analyze Stack Pointer Correctly in Heavily Chunked Functions

I am currently dealing with obfuscated code in IDA. The obfuscation I am combating is control flow obfuscation, where a function is split up into hundreds of basic blocks spread across the entire ...
1
vote
0answers
50 views

TMS320VC5416 DSP firmware reversing

I have file with DSP firmware inside. Each chunk of code or data is preceded by header with format "page,offset,length".See below full list of headers: page: 0000 offset: 0080 len: 0149 page: 0000 ...
0
votes
0answers
25 views

How to make library functions linked statically to extrn?

I want to write an IDAPython script which will identify all statically linked libraries (I think I got that part down - starting from a certain address they all seem to be library functions) - then ...
-1
votes
1answer
57 views

Break when exe send tcp packet

When I debug exe file with Ida I want to put breakpoint before the exe file send tcp packet. When I listen with procmon I can see that this exe send and recive tcp packet. 1) I look on the exe file ...
0
votes
1answer
40 views

IDA - How can I get a list of differing instructions from 2 recorded instruction traces?

I have 2 recorded IDA pro instruction traces, how can I get a list of differing instructions? I am able to load the diffs as overlays but there are a large amount of instructions recorded that are ...
0
votes
0answers
34 views

Is there a way to see 'imports' in a .NET binary?

Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
1
vote
2answers
112 views

Call function by ebp

When I looking at exe file with Ida I see call dword ptr [ebp -70p] What is that? Why this function calling by ebp and not call sub_0xabcd How can I know which function is that to enter to this ...
0
votes
1answer
35 views

What's wrong with my mitm to support rr commands with gdbserver on IDA?

First of here is the gdb remote protocol doc. The idea of the below script is the following - you enter an actual command (one that will be send as a direct packet see packets) in the gdb window then ...
1
vote
1answer
78 views

Why is IDA showing three arguments for the main function instead of two in some linux binaries?

So I am reversing an ELF‌ binary, now from my knowledge in C the main function has two argument, argc and argv but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
0
votes
2answers
86 views

How to remove bytes/opcodes within IDA Pro database

I am dealing with a heavily obfuscated binary, with certain portions of it having an abundance of junk code when it attempts to set a value at certain offsets to esp/ebp. My question, having ...
0
votes
0answers
45 views

<error sending command to monitor>

I'm trying to debug a backtrace created with rr so I type: rr replay -s 50505 -k it displays out: gdb '-l' '10000' '-ex' 'set sysroot /' '-ex' 'target extended-remote 127.0.0.1:50505' target Then ...
0
votes
1answer
198 views

How to use memory address information from IDAFree to set a breakpoint in x32dbg?

I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
1
vote
1answer
117 views

mfc140 dll , what is the usage?

While I open exe file in ida I can see lot of calls to mfc140_6153 or mfc140_8718. What are those functions ? what they do ? thanks
0
votes
2answers
105 views

Hex-Rays skips code

have using IDA Pro 6.8 (Hex-Rays 2.2), default settings. Problem starts happens when i trying to analyze function (which actual size ~2886 bytes), pressing F5 (without errors or alerts) and getting ...
0
votes
0answers
34 views

IDA search results debugging

I used IDA pro to search for some variables, that I know are present in the exe code (it is a function variable). However it doesn't relate to any function, so how can I make use of it and get the ...
0
votes
1answer
56 views

Why doesn't alloca_probe follow x64 calling convention?

I was practising reverse engineering on some Windows x64 applications when I came across this function: call alloca_probe This alloca_probe function has some strange implementation: EAX is used as ...
3
votes
0answers
44 views

How to prepend offset to smart names?

So I'm trying to reassemble an PE to ELF so I can debug it with rr. However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
1
vote
0answers
82 views

How to handle flags that affect instruction decoding in IDA processor modules?

I am writing a processor module for the Oki6620* architecture. Like ARM's Thumb mode or m7700's M flag, this architecture has a special flag that affects instruction decoding, named DD (Data ...
1
vote
1answer
87 views

Finding a mathematical calculation which uses Pi within binary

Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)? I'm ...
0
votes
0answers
63 views

IDA: How to set a breakpoint in the address pointed by some address?

I am using IDA for debugging. I have some executable memory being dynamically allocated, and a pointer to it is saved in the data section. I currently set a breakpoint somewhere after that step is ...
1
vote
3answers
131 views

What is the difference between malware that is 'dumped' and one that is 'unpacked'?

On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
1
vote
1answer
77 views

How can I determine a module to which function is related with IDA Pro

For example I have a function sub_7FFA95D8F120. I've checked out Views->Segments which shows .text segment. It seems that I am missing out something important. It would be great if someone explained ...
0
votes
1answer
48 views

What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?

Sorry if this is a stupid question but couldnt find the answer by googling Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
0
votes
2answers
112 views

IDA Pro, replace exit() with continue;

This is the function: loc_BA060: ; status xor edi, edi call _exit How can one replace exit with continue?
2
votes
1answer
99 views

Modify function to return a static value

I am learning IDA pro on a test binary and I'd like to return a static value from this function: ; __int64 __fastcall sub_B580(char *name) sub_B580 proc near pai= qword ptr -70h req= addrinfo ptr -...
0
votes
1answer
62 views

Easy way to understand vulnerable functions while Reversing [closed]

I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code. As I am new to this stuff, I am getting some issues of ...
2
votes
1answer
222 views

Decompiler attack

I noticed that Hex-Ray have been keeping reward to people who find "security vulnerabilities" of IDA-Pro.: So here is my question, how come a decompiler can have "security vulnerabilities"? And more ...
0
votes
0answers
58 views

Packet: Game last byte encrypted?

12:14 WSARecv() C3-73-3E-BE-36-2F-14-37-37 F4-44-09-89-01-18-23-00-00 ------------------------------------------ 12:14 send() C3-73-38-31-0E-35-EE-35-A5-35-7F-34-37-37-8D F4-44-0F-06-39-02-D9-02-92-02-...
-1
votes
2answers
69 views

How to add a message box to a PE [closed]

So, I have a "simple" question. I have this PE that I want to show a message box when the file is launched. How can I patch the file and make the window? Thanks!
0
votes
1answer
111 views

What is, and why, “byte[ ] + number” in this IDA pseudocode?

This is a decompile of an .so file, so it originated from C or C++. Can you kindly try to explain to me what this does? How would one rewrite this into readable code? I don't mind any programming ...
0
votes
0answers
56 views

How can one replace bitmap (image) inside exe?

I have an application (something like a text editor) that has a background image. I understand how to replace text in exe file, but what about image? I wonder how difficult and what is the way to ...
1
vote
1answer
150 views

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
138 views

Can GUI elements of a running program be found/located in memory?

Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
0
votes
1answer
216 views

How to decrypt the password using radare2 or gdb?

.--------------------------------------------------. | [0x804851b] | ...
2
votes
0answers
67 views

Telling IDA that all references to an address range belong to the same segment

For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
2
votes
1answer
136 views

Unable to properly analyze a very simple C-compiled program

I'm a RE beginner and I decided to start writing my own simple code for practice. I wrote a simple code which uses a winAPI function called CreateProcess to start a calc.exe, I've wrote it in C and ...
0
votes
0answers
53 views

How to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW

Hope someone can help me to set parametres for IDA PRO for decompile Firmware Motorola HC908JB8JDW i tried every combinanated value but without sucess.
0
votes
2answers
49 views

Error when changing push 0 to push function

Hi I am sort of new to ida pro even though I've used a lot but when I push a function where a 0 used to be it gives me sp-analysis failure I've searched for a fix for a while to no avail help would ...
0
votes
0answers
26 views

Can the .idb/.i64 default save location be changed?

By default, IDA Pro saves its .idb (or .i64) files to the same directory as the file being analyzed. Is there a way to change this? I couldn't find anything related to this in Options -> General.
0
votes
1answer
90 views

What do square brackets do in IDA's pseudocode representation?

I've been a bit stumped recently on my decomp work. I've not dealt with C in depth nor have I dealt with IDA's pseudocode system very much at all. I understand asm, but because of how IDA merges ...
2
votes
1answer
171 views

__security_cookie for function pointers in Windows 10

I'm curious about this __security_cookie that I keep seeing all over the msvcp140.dll from my Windows 10 x64 (insider build.) Here's an example: Note that the address for indirect function call (or ...
0
votes
0answers
207 views

IDA 7.0 (free) fails to load symbols with message “DWARF: Cannot determine location of DWARF info” during debugging

Here's the steps to repro. Just installed IDA (free) v.7.0 on a brand-new installation of Windows 10 (x64) in a VM: Then loaded a test PE file and started debugging it (using Local Windows Debugger): ...
0
votes
2answers
318 views

How to help IDA to auto complete libc functions?

I have a x86_64 ELF binary which is statically compiled. With some digging, I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code shows sycalls as inline assembly code. But in ...
1
vote
1answer
115 views

Loading 8051 binary to IDA with ROM+External RAM configuration

I have 8051 firmware file, in 8051 ROM addresses can overlap external RAM addresses(movc and movx solve this issue), however IDA doesn't allow overlapping addresses: In this example the ROM size is ...
0
votes
1answer
197 views

Trying to understand *((_DWORD *) in IDA pro

Hi I am trying to understand pseudocode from this game I'm currently modifying. if ( v11 == 501736410 ) // case 0x1DE7E3DA: //"Weapon" { *((_DWORD *)v6 + 326) = 3; } else if (...
1
vote
1answer
93 views

Is there a way to show exceptions handlers in Hex-Rays decompiler output?

Is there a way to show these exception handlers in the decompiled code? I can't tell that a block is in a __try block without looking into the disassembly. __int64 __fastcall ...
2
votes
1answer
65 views

How to migrate IDA/HexRays database to the new version of the same application?

I have an .idb and PE file of an old version of an application. Now I want to transfer all knowledge to a new database for the new version of PE. How can I do this? It seems that I need to compare ...

1 2
3
4 5
31