Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
3
votes
1answer
336 views

Documenting reversed application

I've been reversing a regularly updated application with various tools (mosty IDA, Olly) for a while now, and I always wondered how to document my findings. For example function names, static ...
5
votes
1answer
2k views

IDA Pro for MIPS image

I have this file: [ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data It's image for Cisco Catalyst 3650 ...
8
votes
1answer
3k views

IDA Pro: use structs on parameters

I have a small function that is given a struct as parameters. The struct looks to something like this: struct my_struct { short a; unsigned int b; unsigned int c; }; Taking care of the ...
4
votes
1answer
2k views

Creating a struct in IDA which contains a cString?

Normally I struct is a fixed size. Is it possible to define a structure which contains an element which has different sizes? To illustrate what I mean is this. The layout of the data in the file ...
4
votes
2answers
2k views

Do disassemblers detect standard functions?

Do disassemblers detect the use of C/C++ standard functions and specify them in the output code, adding the #include line to the appropriate header file (such as stdio.h or even windows.h)? If not, ...
7
votes
1answer
930 views

Is there a way to set the number special purpose registers in IDA pro with a script?

IDA has this nifty habit that when it doesn't know what a special purpose register is, it just drops in the number of the register instead. While this is all well and fine, I'd like to be able to ...
2
votes
1answer
264 views

IDA special fields in stack window

When you open the stack window in IDA with Ctrl-K there is a comment at the top saying: ; Two special fields " r" and " s" represent return address and saved registers. When I made some mistake and ...
3
votes
0answers
147 views

IDA declare a function that passes return value on FPU stack [duplicate]

The usual way to return a value is by passing it in EAX. I know also that a 64 Bit value would be returned in EAX:EDX. However I have now a function that calcluates the localtime to miliseconds into a ...
8
votes
1answer
1k views

GDB via JTAG on ARM Hardware target without source code

Does anyone have other solutions for connecting to a remote ARM target without IDA? This is the question and below I give examples of setup's i have tried, should anyone be interested. Update: ...
5
votes
1answer
2k views

Struct with negative offset in IDA possible

I have a structure which looks like this: RefString struct RefCount dd ? StrLen dd ? CString db... RefString ends When the code passes around a pointer, it doesn't point to the ...
3
votes
2answers
2k views

Statistics of call XREFs

Is it possible to see a kind of statistics in IDA about functions and how often they are referenced? When analyzing a program, I find it helpfull. Functions that are referenced very often typically ...
11
votes
2answers
2k views

Hooking to a function with variable argument list

I am using Detours 3.0 to hook onto a function I obtained from Ida Pro. The problem is I came across a function which I cannot seem to hook which is due to either invalid arguements or the fact that ...
6
votes
3answers
521 views

How can I clean up strings built at runtime?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
2
votes
2answers
1k views

Put encrypted code blocks back as unencrypted in IDA

So I have some encrypted data in this executable. IDA couldn't do much with it, so it defined it as arrays. Now I know how to decrypt this data, and it has some encrypted code. I could of course, put ...
3
votes
1answer
339 views

Some programs have always same addressing and some different

Why do IDA and Ollydbg always open some programs with the main() function at the same address? The address given by IDA is equal to that given by Ollydbg in runtime. However, when I wrote my own C ...
12
votes
3answers
8k views

Which calling convention to use for EAX/EDX in IDA

I have some code (I assume Delphi) which uses only the EAX and EDX register for passing the arguments (and of course the stack if more are required). I looked which calling conventions would match, ...
6
votes
3answers
8k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
7
votes
2answers
984 views

Adding Backlink for XREF in IDA

I have an indirect call to a function. I traced the program and added the target to the xref, so this works fine. The problem is though, that on the position where the call is, there is no link shown. ...
3
votes
1answer
261 views

Can the 'r' be removed from a function stack

Original question asked on Stackoverflow: Can the 'r' be removed from a function stack ? I am trying to modify the processor for the Fujitsu FR, and IDA by default inserts the return variable r on ...
10
votes
1answer
528 views

Are those code snippets and file paths in a C++ binary some sort of standard debug information?

This C++ binary has code snippets and paths to sourcecode files everywhere, which is probably some sort of debug info. Is this something standard? (Is this RTTI) If so, how is this called? Are there ...
7
votes
1answer
408 views

IDA Plugin writing generic questions

I am trying to write a plugin for IDA PRO, mainly because I want to use the nifty graphing feature on a custom intermediate language. After the first look at the IDA plugin system, I am a little lost. ...
16
votes
3answers
12k views

Which IDA Pro Signature should be used for Borland Delphi 6.0-7.0 binaries as reported in PEiD?

I am currently reverse engineering a binary written in Borland Delphi 6.0-7.0 as reported by PEiD. Is there a recommended signature to use when looking at this binary in IDA Pro? I currently am using ...
4
votes
0answers
2k views

Why does Hex-rays thinks that 32bit PE is 16bit?

I'm using IDA 6.1 32-bit version. I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
6
votes
1answer
2k views

How to extract the input file offset of a byte in idapython?

For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
4
votes
2answers
3k views

How do you attach to a child process using IDAPro?

The code that I'm analyzing calls fork and I was wondering if there was a way to trace the child process that is created. I've looked in The IDAPro Book and there's nothing on the topic (if there is I ...
9
votes
2answers
1k views

Connecting to jtag-openocd-gdb to arm11 device with IDA gets no control

I have a binary chunk from a piece of hardware I've been deciphering with IDA for a couple days now. Today I finally got a probe connected via JTAG and have openocd start up a GDB server. IDA is ...
2
votes
1answer
3k views

How to manually set the base address of a pointer in IDA?

IDA autodetected some kind of offset like this: mov bx, word ptr (aSomeString+8)[di] I want to set the base address to something else, like for example: mov bx, word ptr (glb_AnArray-6)[di] ...
7
votes
1answer
3k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
10
votes
1answer
765 views

Hex-Rays Decompiler: Buffer on the stack

I am currently reversing a windows driver in order to write a Linux compatible driver for a DVB card, but I have come up against a small issue that I can work around, but if it is possible I would ...
5
votes
1answer
3k views

Debugging Shellcode with Bochs and IDA Pro

I am using the Local Bochs Debugger along with IDA Pro to debug a shellcode. This shellcode disassembles properly in IDA Pro, however, now I want to debug it. I tried debugging but since the ...
2
votes
0answers
3k views

IDA pro and Bochs Debugger

I am debugging a shellcode in IDA Pro IDA Pro version: 6.1.011 (32-bit) Bochs version: 2.6.2 I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want ...
2
votes
1answer
3k views

ea_t datatype in IDA API

In IDAPython, what is the ea_t data type? It is used in the set_debug_name() function as follows: bool set_debug_name(ea, name) If I have a 64-bits address, can it be represented by the ea_t data ...
7
votes
1answer
4k views

BYTE3, does it mean the third or fourth byte of an int? IDB file that's already supplied

I've got a program that i'm trying to debug a little bit by trying to make sense of a function or two, there's already some info that i've downloaded via a idb file and it's helped me get somewhere. ...
5
votes
1answer
4k views

Debugging ARM binary with IDA Pro and Qemu

I am debugging an ARM binary using IDA Pro by connecting to QEMU (remote gdb debugging). In gdb configuration, I am selecting ARM_versatilepb as the device. Now, I am able to successfully debug the ...
7
votes
1answer
2k views

Parsing IDA Pro .asm files

Does anyone know of projects that parse the disassembly from IDA Pro using a lexer and/or parser generator library? But I would also totally be fine with JSON or XML format. So far, I have been able ...
7
votes
2answers
4k views

Structure Definitions for PEB in IDA

When reversing shellcode, we see the PEB walk fairly often at various stages. I am curious however, if there is any pre-defined standard structure for this in IDA? If so, what is it called? After ...
2
votes
1answer
576 views

Hex-Rays Decompiler: Which magic variable to select?

The Hex-rays decompiler demo video shows that you can select what to replace Windows magic variables (1,2,3, etc) with: http://www.ccso.com/files/hexraysdemo.swf But how do you know what the numbers ...
3
votes
2answers
3k views

What does `jz $+2` do? (jump if zero to dollar plus two)

What does the dollar symbol mean in jz $+2 (This is IDA output.)
4
votes
1answer
4k views

How to reverse CGI file for MIPS?

I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it. According to the strings command I can see some interesting words like system, sprintf,...
9
votes
1answer
3k views

Filling C++ interface method names in the disassembly in IDA

I have a C++ header with interfaces (classes with all methods pure virtual). I also have a binary which returns pointers to these interfaces. I debugged while running and received the virtual table ...
6
votes
3answers
74k views

How to obtain x86-64 pseudocode in IDA Pro?

Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
8
votes
2answers
12k views

IDA Pro List of Functions with Instruction

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
13
votes
1answer
4k views

Is there an equivalent of 'Run trace' as in OllyDbg for IDA PRO?

I have been looking for the equivalent of the "Run Trace" option of OllyDbg in IDA Pro. Can anyone mention if there is one and how to use it ?
2
votes
1answer
2k views

Reverse engineering windows service

I'm trying to reverse engineer a driver that consists of 2 components, a windows service and a control panel application. My goal of reverse engineering is to replace the control panel with my own ...
5
votes
2answers
3k views

Unable to set a breakpoint in IDA 6?

I am unable to set a breakpoint in IDA 6. I have tried pressing F2 , but it did not work. Also, the breakpoints buttons on the toolbar are all disabled. What's the problem?
10
votes
2answers
7k views

Mixed 16/32-bit code reversing using IDA

I am trying to reverse engineer a binary blob I expect to transition from 16-bit real mode into 32-bit protected mode (it is boot time code), so I expect the code to contain code of both sorts. When ...
15
votes
3answers
3k views

What are nullsub_ functions in IDA?

In nearly every dis-assembly created by IDA, there are several functions that are marked nullsub_ which according to IDA, return null nothing (just ret instruction). So, what are those and why are ...
5
votes
2answers
2k views

Accessing Data Marked as Alignment Bytes in IDA

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA. .text:00401176 ...
4
votes
2answers
3k views

Remote Android debugging using IDA 32 bit - bind: Address already in use error

When I try to get remote debugging working with IDA, using an Android emulator, I get the following error on the command prompt. ./android_server IDA Android 32-bit remote debug server(ST) v1.15. ...
8
votes
2answers
7k views

Exporting structures and enums in IDA

It is possible to import structures and enums declarations from C files in IDA. However, is it possible to export structures and enums to C?