Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
2
votes
2answers
2k views

At which address on the stack or in memory is eax stored after the malloc call? [closed]

Here is my objdump -d snippet with the malloc call and surrounding code. This binary is stripped. dbgLab.bin: file format elf32-i386 080483d0 <malloc@plt>: 80483d0: ff 25 04 a0 04 08 ...
3
votes
2answers
1k views

Can someone tell me what this memcpy or maybe it's a memset? looks like a memset, rep movsd and rep movsb This is a packet sending function

Trying to understand a function thats responsible for sending out a packet. I don't understand could it be a integer array or something? or some inline function that's not properly getting rendered in ...
1
vote
2answers
606 views

What is the address of main() and how many bytes does it allocate on the stack for its frame size?

Here is my objdump -d output but I do not know where to look. I understand assembly but it is a little confusing trying to find out what the values of registers are at certain points. If anyone knows ...
4
votes
1answer
2k views

IDA Pro C dump for Decryption function

I have been battling this infection I got that encrypts my files in 512 byte chunks with a friend. We have managed to find the Decryption function we think in IDA (the code is heavily obfuscated) from ...
2
votes
1answer
1k views

C What kind of sorting algorithm is this?

I decompiled a application and found what seems like some kind of sorting algorithm, I was told it's not even a sorting algorithm, but a binary search on stackoverflow I just don't know which one it ...
9
votes
1answer
951 views

Information provided by Hex-Rays after @ symbol in variable declarations

Could you explain to me the information provided after the @ symbol in Hex-Rays decompilation ? For examples @1 and @5 in the following output: struct WSAData wsadata; // [sp+0h] [bp-1A0h]@1 int v6; /...
4
votes
1answer
12k views

IDA PRO repairing stack variables / local variables hex-rays with arrays and proper types / structures any scripts/plugins?

IDA PRO's Hex-Ray gives me these variables. void *v7; // esp@1 const char *v8; // ebx@1 PLAYER *v9; // ebp@1 int v10; // edi@5 PLAYER *v11; // edx@6 int v12; // ecx@9 int v13; // esi@17 ...
1
vote
1answer
758 views

Cannot find the caller of the main function in a disassembled firmware

I am looking at an unstripped ARM elf firmware file using IDA Pro. There is an init() function and a main() function. From my understanding of the logic, it's probably structured like this: init() ...
2
votes
1answer
2k views

How to find “references to addresses near this address” in IDA Pro?

I'm trying to decompile a binary in IDA Pro. Currently I am looking at a list of pointers to strings, which represent game data ("Left turn", "Right turn" etc). Frustratingly, it appears like nothing ...
2
votes
2answers
792 views

osx + IDA + virtualbox, keyboard mapping for “Insert”

I use the free version of IDA and I'm trying to define structs. Unfortunately, I'm using Windows XP as a VM on OSX and am having trouble remapping Insert to something else. I'm hoping someone has ...
41
votes
1answer
87k views

Decompiling iPhone App

I've been searching this site and more, but I haven't had much luck. I want to decompile an app to see how part of it works, and I've tried multiple programs. I've tried Hopper, IDA, and some other ...
2
votes
1answer
467 views

IDA PRO _data keeps getting misaligned lost bytes while scrolling down Can't find references (hint: redo analisys)

The code of the functions is still valid but now the _data segment keeps losing 6 bytes everytime I fix it by pressing G going to 42A000 fixing what it undoes then I scroll down a bit and scroll back ...
2
votes
1answer
324 views

IDA PRO Struct Pointer Counter big number not starting from address offset 0, Lowers a bit slightly but not all the way to 0

I put the whole question in 2 images. From research, it seems I need to use Ctrl+R, but I don't think that's what I need since I couldn't lower the number a bit further in order to reach 0. I think ...
6
votes
2answers
6k views

Any way to fix misinterpreted case jump tables in Ida Pro?

I'm disassembling a function that seems to use a switch statement, resulting in an indexed indirect jump, in two different places (same function!): 0005FA58 mov al, [eax+112h] ...
2
votes
1answer
1k views

IDA PRO Basics For Hex Rays How to fix address to struct which is dynamically calculated in if statement

I barely know any assembly and just started using IDA PRO a few months ago. I understand the code that Hex-Rays generates pretty well and I think I know why Hex-Ray's fails to create a struct of this ...
2
votes
1answer
726 views

IDA PRO Imports Names Lost in a accident, Reanalyze does nothing. How to make unexplored imports?

I have put alot of work into renaming and fixing lvar types to better understand the code I made a mistake when I was converting some unk_dword to array I missed that it wasn't set to db but rather dd ...
7
votes
1answer
253 views

Disassemble communication protocol for an old device

I have an old device connected to personal computer via specific PCI card. Device is handled with C++ control application, which is not able to run on new versions of Windows. Manufacturer of that ...
3
votes
2answers
1k views

How do I adjust the length of the parameters in IDA?

In IDA I can easily change the size of the local variables using Alt+P and then changing the "Local Variables area" field to the desired value. However, how can I do this with the parameters size? ...
2
votes
2answers
2k views

Windbg x64 setting breakpoint

My issue is all about setting the breakpoint on x64 Windbg. For x86 to combine IDA and Windbg analysis nothing is required. Just copy and paste the IDA address value and it works just fine. For ...
0
votes
2answers
1k views

Why does IDA Pro's pseudocode function not produce for loops?

Question came up in a reverse engineering class. The prof asked this question. I mean, in the grand scheme of things, while loops == for loops, I don't have a problem with that. IDA Pro book... ...
2
votes
1answer
1k views

The input file has unaligned section pointers

When I try to load an exe into IDApro it shows up an error: The input file has unaligned section pointers What does this mean ?
5
votes
3answers
3k views

How to break on not-yet-loaded kernel driver

I've been reversing a sample of the Uroborus trojan for my own learning joy. I'm having a hard time following it once it loads a windows kernel driver that implements the rootkit. I've set up my ...
4
votes
3answers
5k views

Can not continue debugging after SIGTRAP

I am trying to debug an iOS app with gdb and when I hit a breakpoint I get this error, and can not continue. Program received signal SIGTRAP, Trace/breakpoint trap. [Switching to process 190 thread ...
4
votes
1answer
4k views

Can IDA Pro automatically deal with VM obfuscated binaries?

VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro. According to this slides www.hex-rays.com/products/ida/...
3
votes
1answer
518 views

How does IDA understand that the file was packed by packer?

So, how does IDA understand that the file was packed by a packer? How does it distinguishes between different types of packers? Are they leave some significant signatures or some patterns of ...
0
votes
2answers
5k views

Rebase program with negative shift delta in IDA

If a binary file is open with ROM starting at 0x10A000, how do I easily change the ROM starting address of the file to 0x109000? I always had to restart IDA to do it. I also tried to "rebase the ...
5
votes
1answer
4k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
2
votes
1answer
207 views

List Relative Jump Destinations in IDA

How do I list all destinations from relative jump instructions (e.g. the jmpr instruction) in IDA?
3
votes
0answers
352 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
3
votes
1answer
344 views

Is it possible/How can I select in the functions window the current subroutine in the IDA View?

I'm in the IDA View-A within a subroutine. I've identified the subroutine, and now I want to navigate to the subroutine in the functions window so that I can jump around some of the other subroutines ...
2
votes
2answers
1k views

Detecting epilogue/prologue of functions [closed]

I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
2
votes
1answer
4k views

When defining a structure in IDA, can I define a field that is of another struct type?

I'm looking to define a structure in IDA like: struct StructA { int a; int b; } StructA; struct StructB { StructA a; int b; } StructB; Can I do this in IDA's structure definition ...
1
vote
1answer
2k views

IDA startup signatures format

IDA startup signatures are sets of signatures used in FLIRT to detect what library is used in a static linked executable . I am about to use these signatures to detect which library is used in an ...
9
votes
2answers
2k views

Importing list of functions and addresses into WinDbg

When I have a kernel module without symbols, I'd typically first open it in IDA and give names to some of the subroutines (those I'm interested in). Since I prefer my kernel debugging with plain ...
10
votes
1answer
38k views

How could I change an instruction in IDA Pro?

I'm trying to change an instruction in an executable that's loaded in IDA Pro v6.1 For example: lis r11, ((qword_90E1B2D8+0x10000)@h) to lis r10, unk_90E163D0@h Any help is ...
5
votes
1answer
3k views

IDA Can't load symbols “DIA: No such interface supported”

I'm trying to load symbols for a dll with IDA pro. My _NT_SYMBOL_PATH is SRV*c:\symbols*http://msdl.microsoft.com/download/symbols . I put DBGTOOLS = "C:\\Program Files (x86)\\Windows Kits\\8.1\\...
3
votes
1answer
855 views

Transfer function names from one IDA DB to another

Do anyone know about an automatic way to transfer function names from one IDA file to another while: First IDA file is based on version 1 of the executable. Second IDA file is based on the updated, ...
30
votes
5answers
9k views

Why there are not any disassemblers that can generate re-assemblable asm code?

I am struggling on this problem for around three months: How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back My experience is that: There is NO ...
1
vote
1answer
2k views

automatically find and nop an instruction in IDA

These are my first steps in IDA script, so please be kind. I want to create some sort of script that, every time it finds the following instruction: MOV R1, #0x4D080 to automatically replace it ...
1
vote
3answers
2k views

Generate a sig file from ELF executable

I have a mipsel executable (DvdPlayer from a RTD1283 firmware). I know that IDA is able to identify many functions. Then, I would like to generate a .sig file with signatures of these functions for ...
5
votes
1answer
2k views

DOS program debug in IDA?

Does anybody know something hack to debug 16bit DOS program in IDA 6.1?
3
votes
1answer
573 views

Why IDA Pro can not generate this subroutine's code?

I use IDA Pro 6.1 to disassemble static linked binary on Windows 32bit See, in the interactive screen, this subroutine (which is in one library function) can be found: But as I use these two ways to ...
3
votes
0answers
511 views

Where is uni.inc file?

In the IDA Pro generated asm code, I see this line: include uni.inc ; see unicode subdir of ida for info on unicode I don't find unicode subdir nor do I find uni.inc file... Could any one give me ...
2
votes
2answers
766 views

Force IDA starter 6.5 to disassemble encrypted in autonomous mode

I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit) I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script. To do so, I use command as such, to call text ...
2
votes
2answers
359 views

Why cl.exe change the extern function name used in my code?

So basically I my nasm syntax asm code, I use some extern functions like this: extern _printf extern __imp__Sleep@4 .... call _printf call [__imp__Sleep@4] Then I use nasm to assemble it into obj:...
2
votes
3answers
803 views

Why IDA Pro generate define-lack code like this?

Basically I us IDA Pro 6.1 on Windows 32 bit, dealing with binaries from SPEC 2006. I use IDA Pro to generate asm code from the binaries, and in the .data section, I see data define like this: ...
3
votes
1answer
499 views

Why the API GetMnem can not deal with instructions like “stosd”, “movsd” in IDA Pro?

So basically I use a IDC script to dump the instructions one by one using IDA Pro 6.1, windows 32 bit. PE file format I use try to dump one opcode instructions like stosd stosb stosq movsd in this ...
3
votes
2answers
982 views

How to set up IDA as the system's JIT Debugger?

I'm trying to trace a system timeout (probably RPC related) that kills the debugging session. It occurs right after IDA loads and rebases an executable. It happens only when debugging a 64-bit program ...
3
votes
2answers
13k views

How to force IDA to analyze a packed exe after the program has unpacked itself?

I know it is a very newbie question and sorry about that, but I can't really find any way how to make IDA analyze the code after the unpacking was done. What I mean is that when I unpack an exe and ...
1
vote
1answer
2k views

Why I can not find all the functions using this IDC script?

On Linux 32 bit, I use IDA Pro + IDC script to dump all the functions. Here is part of the script: addr = 0; for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) { name = ...

1
28 29
30
31 32
34