Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
13
votes
2answers
2k views

How do you set registers as structs within a function in IDA?

For example, in the following disassembly: .text:007C6834 014 mov eax, [esi+4] .text:007C6837 014 mov dword ptr [esi], offset ??_7CAvatar@@6B@ ; const CAvatar::...
5
votes
2answers
2k views

IDA [call $+5 / pop reg] cleaning

Can anyone tell me how to clean up the code which contains the following blocks: call $+5 pop reg add reg, 08BE96h [...] In other words I need to change all such blocks to: mov reg, offset Edit # ...
8
votes
2answers
2k views

How to prevent automatic padding by IDA?

I defined a struct in a header file, similar to this one: struct STRUCT { char a; int b; }; This is parsed successfully by IDA, however it adds padding bytes after the char: 00000000 STRUCT ...
3
votes
1answer
468 views

OS X Power PC RE tool (debugger/disassembler)

So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I ...
4
votes
3answers
4k views

How to change a large section of bytes to words in IDA Pro

I have a large section in IDA that is a data lookup table of word length data. I want to change them all to word length rather than byte length. I know you can make an array but when I do it becomes ...
5
votes
1answer
4k views

How to compile Hex-Rays decompiler generated code?

I need help to compile Pseudo-C code generated with IDA Pro and the Hex-Rays decompiler plugin. It shows an error on this line: int (__thiscall *off_401F14)(void *, char); // weak Error: error ...
5
votes
2answers
3k views

How to break on an Android JNI function with IDA Pro Debugger

I have an android application that uses a shared library which I would like to step through with a debugger. I've had success using IDA 6.3 to debug executables with the android_server debug server ...
8
votes
1answer
818 views

How to get notified about IDA database events not covered in the IDA SDK?

In my previous question I had originally asked for this, but since this aspect of the question was completely disregarded, I feel compelled to ask it separately. There are certain events apparently ...
8
votes
1answer
6k views

How can I control the Hex-Rays decompiler plugin from IDA with scripts?

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....
3
votes
1answer
424 views

How to avoid the load file dialog in IDA GUI

I would like IDA to remember my default load file settings instead of presenting the load file dialog on every start. The documentation says there is a -T command line switch that should take a 'file ...
11
votes
2answers
12k views

How to display memory zones content on IDA Pro?

This is a very naive question about IDA Pro. Once the IDA debugger started, I would like to be able to type a memory address (or a memory zone) and look easily at the content of it (in various format)....
6
votes
2answers
323 views

How can my plugin get notified of anterior or posterior comments (and more) changes to an IDA database?

IDA Pro allows plugins to receive notifications for a number of events. These are defined in the hook_type_t enumeration inside loader.hpp in the SDK from what I saw. If I subscribe to HT_IDB events, ...
13
votes
4answers
6k views

Creating IDA Pro debugger plugins - API documentation and examples?

Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
7
votes
1answer
7k views

WinDbg fails to connect to IDA Pro debugger server

Environment: Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg Guest: Win7 SP1 x64 I have VirtualKD setup correctly in my guest and host. I say this because ...
3
votes
1answer
588 views

where can I get mIDA

Some posts reference the mIDA plugin, but the download site seems unavailable. Is there any mirror or a link to an archive version?
10
votes
5answers
11k views

How to find offsets in OllyDBG from IDA

I'm currently trying to gain some practice in RE and I need some help for patching a DLL. Here are my steps: I first analyze the main program and the dll in IDA trying to understand the logic. I then ...
10
votes
1answer
8k views

Could you list some useful plugins and scripts for IDA Pro? [closed]

I am just starting to use IDA Pro. After discussing a bit with the community, it seems that IDA Pro plugins and scripts are quite important to reach a good level of productivity while analyzing a ...
302
votes
16answers
348k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
3
votes
1answer
241 views

How did/would you analyze OSX-Crisis

I was taking a look at the OSX-Crisis sample obtained from this site and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered ...
12
votes
2answers
12k views

IDA Convert to Unicode

In IDA 5.0 Freeware how do you convert a block of data into a unicode string, the only thing I can find is to convert it into an ascii string. db 'a' db 0 db 'b' db 0 db 'c' db 0 db 'd' db 0 db 0 db ...
10
votes
2answers
4k views

How to map an arbitrary address to its corresponding basic block in IDA?

Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that? Edit: more specifically, I want to know the beginning / end of ...
5
votes
2answers
2k views

IDA Proximity viewer not finding obvious paths?

Using IDA 6.2 (and also with IDA 6.4), I'm trying out the Proximity viewer to find the path between 2 functions as described at the hexblog post here. Using the Xrefs From/To (old option) it shows ...
4
votes
1answer
1k views

3D control-flow graphs in IDA

Is there any way to leave 2D flow chart graphs and go to 3D model? I mean something like that: Usual 2D graph: 3D graph: The only one solution I've seen is using UbiGraph + Linux on VM (to use ...
25
votes
6answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
12
votes
1answer
2k views

Treating independent code as a function in IDA Pro

When reverse engineering programs, I often find functions like the one below. This function in particular has a set of nested if/else blocks (pink boxes) which would typically be fairly easy to ...
32
votes
3answers
18k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
21
votes
1answer
6k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
15
votes
4answers
14k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
22
votes
7answers
6k views

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...

1
29 30 31 32
33