Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
10 votes
2 answers
5k views

What to do when IDA cannot provide a function name?

For learning (and fun) I have been analyzing a text editor application using IDA Pro. While looking at the disassembly, I notice many function calls are made by explicitly calling the name of the ...
user avatar
  • 185
3 votes
2 answers
3k views

How to load a dumped process and several accompanied memory pages in IDA?

I have dumped process and several dumped pages of memory that were allocated in it. How can I load everything in IDA into one DB and reference pages in the loaded process?
user avatar
  • 2,832
13 votes
2 answers
2k views

How do you set registers as structs within a function in IDA?

For example, in the following disassembly: .text:007C6834 014 mov eax, [esi+4] .text:007C6837 014 mov dword ptr [esi], offset ??_7CAvatar@@6B@ ; const CAvatar::...
user avatar
  • 1,140
5 votes
2 answers
2k views

IDA [call $+5 / pop reg] cleaning

Can anyone tell me how to clean up the code which contains the following blocks: call $+5 pop reg add reg, 08BE96h [...] In other words I need to change all such blocks to: mov reg, offset Edit # ...
user avatar
8 votes
2 answers
3k views

How to prevent automatic padding by IDA?

I defined a struct in a header file, similar to this one: struct STRUCT { char a; int b; }; This is parsed successfully by IDA, however it adds padding bytes after the char: 00000000 STRUCT ...
user avatar
3 votes
1 answer
505 views

OS X Power PC RE tool (debugger/disassembler)

So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I ...
user avatar
  • 391
4 votes
4 answers
5k views

How to change a large section of bytes to words in IDA Pro

I have a large section in IDA that is a data lookup table of word length data. I want to change them all to word length rather than byte length. I know you can make an array but when I do it becomes ...
user avatar
  • 351
5 votes
1 answer
4k views

How to compile Hex-Rays decompiler generated code?

I need help to compile Pseudo-C code generated with IDA Pro and the Hex-Rays decompiler plugin. It shows an error on this line: int (__thiscall *off_401F14)(void *, char); // weak Error: error ...
user avatar
5 votes
2 answers
3k views

How to break on an Android JNI function with IDA Pro Debugger

I have an android application that uses a shared library which I would like to step through with a debugger. I've had success using IDA 6.3 to debug executables with the android_server debug server ...
user avatar
  • 1,236
8 votes
1 answer
868 views

How to get notified about IDA database events not covered in the IDA SDK?

In my previous question I had originally asked for this, but since this aspect of the question was completely disregarded, I feel compelled to ask it separately. There are certain events apparently ...
user avatar
  • 10.5k
8 votes
1 answer
6k views

How can I control the Hex-Rays decompiler plugin from IDA with scripts?

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....
user avatar
3 votes
1 answer
450 views

How to avoid the load file dialog in IDA GUI

I would like IDA to remember my default load file settings instead of presenting the load file dialog on every start. The documentation says there is a -T command line switch that should take a 'file ...
user avatar
11 votes
2 answers
14k views

How to display memory zones content on IDA Pro?

This is a very naive question about IDA Pro. Once the IDA debugger started, I would like to be able to type a memory address (or a memory zone) and look easily at the content of it (in various format)....
user avatar
  • 18k
6 votes
2 answers
348 views

How can my plugin get notified of anterior or posterior comments (and more) changes to an IDA database?

IDA Pro allows plugins to receive notifications for a number of events. These are defined in the hook_type_t enumeration inside loader.hpp in the SDK from what I saw. If I subscribe to HT_IDB events, ...
user avatar
  • 10.5k
13 votes
4 answers
6k views

Creating IDA Pro debugger plugins - API documentation and examples?

Are there any good resources for developing debugger plugins in IDA Pro using the SDK that describe the IDA debugger API? An example of this is the IDA Pro ARM debugger plugin on Sourceforge. There ...
user avatar
7 votes
1 answer
8k views

WinDbg fails to connect to IDA Pro debugger server

Environment: Host: Win7 SP1 x64: VMWare Workstation 9.02, VirtualKD, IDA Pro 6.4.13 (x64) and WinDbg Guest: Win7 SP1 x64 I have VirtualKD setup correctly in my guest and host. I say this because ...
user avatar
3 votes
1 answer
674 views

where can I get mIDA

Some posts reference the mIDA plugin, but the download site seems unavailable. Is there any mirror or a link to an archive version?
user avatar
10 votes
5 answers
12k views

How to find offsets in OllyDBG from IDA

I'm currently trying to gain some practice in RE and I need some help for patching a DLL. Here are my steps: I first analyze the main program and the dll in IDA trying to understand the logic. I then ...
user avatar
  • 111
10 votes
1 answer
9k views

Could you list some useful plugins and scripts for IDA Pro? [closed]

I am just starting to use IDA Pro. After discussing a bit with the community, it seems that IDA Pro plugins and scripts are quite important to reach a good level of productivity while analyzing a ...
323 votes
16 answers
395k views

Is there any disassembler to rival IDA Pro?

Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
user avatar
  • 4,028
3 votes
1 answer
245 views

How did/would you analyze OSX-Crisis

I was taking a look at the OSX-Crisis sample obtained from this site and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered ...
user avatar
12 votes
2 answers
15k views

IDA Convert to Unicode

In IDA 5.0 Freeware how do you convert a block of data into a unicode string, the only thing I can find is to convert it into an ascii string. db 'a' db 0 db 'b' db 0 db 'c' db 0 db 'd' db 0 db 0 db ...
user avatar
  • 1,140
10 votes
2 answers
5k views

How to map an arbitrary address to its corresponding basic block in IDA?

Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that? Edit: more specifically, I want to know the beginning / end of ...
user avatar
  • 1,153
5 votes
2 answers
2k views

IDA Proximity viewer not finding obvious paths?

Using IDA 6.2 (and also with IDA 6.4), I'm trying out the Proximity viewer to find the path between 2 functions as described at the hexblog post here. Using the Xrefs From/To (old option) it shows ...
user avatar
  • 1,693
4 votes
1 answer
1k views

3D control-flow graphs in IDA

Is there any way to leave 2D flow chart graphs and go to 3D model? I mean something like that: Usual 2D graph: 3D graph: The only one solution I've seen is using UbiGraph + Linux on VM (to use ...
user avatar
  • 119
25 votes
6 answers
3k views

Tools to work cooperatively on the same binary

What's a working tool/methodology to work cooperatively on the same binary (if possible in parallel), that is proven to work? I used various methods long ago to share information with others, but not ...
user avatar
  • 6,519
12 votes
1 answer
2k views

Treating independent code as a function in IDA Pro

When reverse engineering programs, I often find functions like the one below. This function in particular has a set of nested if/else blocks (pink boxes) which would typically be fairly easy to ...
user avatar
  • 1,236
32 votes
3 answers
21k views

What is a FLIRT signature?

I've seen this referenced in a couple of other questions on this site. But what's a FLIRT signature in IDA Pro? And when would I create my own for use?
user avatar
  • 3,836
21 votes
1 answer
6k views

Static analysis of C++ binaries

When reverse engineering binaries compiled from C++, it is common to see many indirect calls to function pointers in vtables. To determine where these calls lead, one must always be aware of the ...
user avatar
  • 1,194
15 votes
4 answers
15k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
user avatar
  • 7,322
22 votes
7 answers
7k views

How is a structure located within a disassembled program?

I took a basic 40-hr Reverse Engineering course a few summers ago. While teaching us to use IDAPro, the instructor demonstrated, rather quickly and without explaining much, how to label certain ...
user avatar

1
35 36 37 38
39