Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
1
vote
0answers
103 views

removing bios wireless white listing

I am trying to remove the white listing for wireless cards from my Thinkpad L540 running Debian Buster. I did the following steps: booted with kernel parameter iomem=relaxed used pawn to dump BIOS ...
0
votes
0answers
34 views

Generate pseudo code not available for some binaries in IDA Pro

I'm using IDA Pro to disassemble binaries. For some binaries, the Generate Pseudo Code option is available and works fine. However, on other binaries (using possibly a different compiler toolchain) ...
0
votes
0answers
26 views

Find with IDA where an executable checks for devices plugged into computer

The executable is a firmware updater for a specific device. I want to find where exactly does the executable checks for the devices plugged into the computer, before updating the firmware of the ...
1
vote
2answers
508 views

Patching JNZ (two byte opcode) into JMP near (one byte opcode)?

I've been tinkering with Fallout New Vegas, and have focused on modifying a very simple record that's hardcoded in the game engine. It's called an Imagespace Modifier, which is a very basic shader ...
1
vote
0answers
98 views

Reverse Engineering GUI programs

I am trying to reverse a 32-bit Win32 GUI application. It was compiled using Visual C++ 6.0 and uses the Win32 API. I am trying to figure out what happens when I click any particular button in the ...
0
votes
1answer
52 views

Why does this command crash IDA Android native debugger?

In Android shared library that heavily protected against debugging, I found following code: CODE32 ldr pc, [pc, #-4] For me, this instruction looks like NOP; it just jumps to next instruction in ARM ...
1
vote
1answer
351 views

Using IDA Pro, How can I just “edit” values, Rather than patching Offsets,

Im a part of the iOSGods community, and they make lots of cheats, but they dont really do the best at teching other people how to do that. Those people never reply to my help support topics on ...
0
votes
0answers
114 views

How to research the executable file of a game written using the Unreal Engine?

I want to make changes to the gameplay of a game written using the Unreal Engine. To do this, I need to find the function that interests me, embed my DLL in the game process, and change the pointers. ...
1
vote
1answer
93 views

Getting started with RE, with eventually goal being able to make a keygen [closed]

I want to get started in RE and eventually want to be able to figure out how to calculate a serial from a username/license number from program number, etc... (meaning the software tests the serial ...
0
votes
0answers
85 views

Reverse engineering complex GUI desktop application

I have an old program written in WinDev which connects to a HFSQL local database. Unfortunately, the developer of this app is unavailable, and I need access to the DB. the program folder contains ...
2
votes
1answer
310 views

Generating disassembly from raw Infineon Tricore 1971 binary

Is IDA the best disassembler for a raw Tricore TC1791 (or similar) binary? I see there are several others floating around. Which programs are going to give us the most complete ASM from a raw binary? ...
0
votes
1answer
36 views

IDA Xrefs window keep open?

When I use the context menu "List cross references to", a window opens with a list of all positions found which references the position, and I can double click to a function. But then the window ...
1
vote
1answer
123 views

How to set virtual `T` register programmatically in IDA Python?

It is trivial to do it with Alt+G command from GUI. However, when I set multiple breakpoints programmatically, IDA doesn't recognize them as "thumb" mode ones and sets T value at breakpoint address ...
2
votes
1answer
179 views

Start vs WinMain()

I am trying to analyze a malicious DLL and when I loaded it in IDA, I can see two functions - DLLEntryPoint and DLLMain. I then proceeded to change the format by switching the characteristics bit that ...
1
vote
0answers
176 views

Ida permission error

I tried debugging an running a program via ida64 and it says permission denied please reopen with elevated permission. I am on a mac please tell me how to fix this
1
vote
0answers
57 views

How to find implementation of native method in the library .so (Android)

I need to make reverse engineering of one android app. In this app I found class with name Im2MessageNative, this class contains a lot of native methods. For example: static native long ...
0
votes
1answer
98 views

The executable file makes a unique ID from each individual PC. Can anyone decipher from where the file makes these unique IDs?

The file generates random unique ID. It says hardware ID but I couldn't find it in product key, BIOS serial number or anywhere. I used IDA but I couldn't get from where the file creates the code. Even ...
1
vote
1answer
50 views

How to change IDA's name representation programmatically?

I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form 9 dseg_1234 the same as 2, but without data type ...
0
votes
1answer
114 views

How to restore IAT?

I have the start address and the end address of the IAT now im trying to restore the table/folder of it. the start address is: E7C000 thx for helping
0
votes
0answers
41 views

Add MessageBox statically modify

So i'm doing this challenge which i have an exe file and a dll all i have to do is modify it statically to pop a MessageBox. The exe file is loading the dll which load the MessageBox, with ollydbg ...
1
vote
1answer
567 views

IDA Pro - Load data in manually created segment

The program I'm currently reversing is missing a section that contains a bunch of interesting strings. I see the memory addresses of where these should be, instead of the reference to the string. ...
1
vote
1answer
120 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
0
votes
0answers
362 views

Differences between IDA Pro and Radare2

I am familiar with Hopper Disassembler and OllyDbg as favorite and simple tools, but I would like to try switching to IDA to work on Windows. However, I know about radare2 and that it is open source,...
0
votes
0answers
52 views

Which API function is responsible for input strings?

I'm trying to disassemble an executable file with IDA Pro. This program basically does some calculations based on the values one writes into a text box, then displays it in another text box. To find ...
0
votes
0answers
202 views

What does mean cs:Memory on IDA pro? [duplicate]

I don't understand the meaning of cs: Memory. Please help me.
0
votes
0answers
62 views

IDA Pro break on system call to stat64

Upon running strace of an android x86 program I am debugging I notice a large section of stat64 like this: stat64("/data/data/com.topjohnwu.magisk/", 0xbfbf2ef4) = -1 ENOENT (No such file or ...
1
vote
1answer
197 views

IDA and flirt signatures

I have 2 binaries, with the same CPU architecture. I made a flirt signature file - first used IDB2PAT on the first idb, and then sigmake to produce the actual signature file out of it. I put the ...
0
votes
0answers
100 views

IDA free : How to find a string reference in .text

To begin with, I'd like to point out that I'm very new to this. Here's the simple thing I'd like to do : The program I want to mess around with displays a msgbox with the string "Please run the ...
0
votes
0answers
365 views

Decrypting Lua Files from game

I'm truing to decrypt LUA scrpits from cocos2dx game (for wiki). Links to files of game: libhellolua.so (cocos2dx external library) example encrypted LUA-scripts (*.abc files) I was reading a ...
0
votes
0answers
124 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
2
votes
1answer
312 views

Can Ghidra do backward symbolic execution?

I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
1
vote
0answers
28 views

IDA losses renaming and functions border data when debugger starts: is there any workaround?

I try to use IDA to debug Android application. As always, I perform static analysis first and rename registers, memory locations, jumps, etc, to make assembly code more readable. However, as soon as ...
0
votes
0answers
35 views

faster kernel debugging in IDA (not VMWARE)

I am debugging ESX server in kernel mode(windows). I use windbg debugging through COM PORT(eventually). Can I get VirtualKD to work in this scenario? Suspending IDA takes more than a few seconds(...
1
vote
1answer
102 views

MakeArray from stack variables using idapython

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...
0
votes
1answer
299 views

Remote debugging using IDA, connecting to windbg server (kernel mode)

I do kernel debugging by using a virtual com port. One machine (host) is debugging the other machine. I have a remote machine that has IDA, and I wish to connect to the debugging session in the host ...
1
vote
0answers
94 views

Debugging arbitrary ARM binary image using IDA and QEMU

i'm new to this and still learning a lot. Now i have managed to download the binary image from an Flash memory out of a unit having an OMAP5912 SoC. The SoC has an ARM9 family CPU core running little ...
1
vote
0answers
207 views

How does IDA apply its FLIRT signatures and how are they licenced?

I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
0
votes
1answer
56 views

How to remove line? [Help with CTF]

Hi! So, the program print me a Flag length is 32. As I understand call strlen convert my flag to string of length. So, I want to remove that part call strlen or somehow avoid it (maybe I'm not right ...
0
votes
1answer
3k views

Decrypting Lua Files

I am trying to decrypt a lua file which has been encrypting using a key. Some background to the LUA file. Its from an android Game i decompiled the APK and found that all the lua files are encrypted. ...
2
votes
2answers
141 views

Bochs x86 16bit and IDA dissasembly

I have been trying a figure out how to get Bochs to run an x86 embeded firmware rom so I can disassemble while emulating. When I start the debug in ida bochs just says "wrong segmentation". Loading in ...
0
votes
1answer
96 views

IDAPython Export All Addresses Called by Specific Call

The following call gets executed many times and jumps to many subroutines. call [rbp+var_s38] What do I need to write in the breakline condition to export all the locations it jumps to? import ...
0
votes
1answer
94 views

Change IDA pro dissassembly to linear sweep

I would like to know if there is any way to modify the algorithm used in IDA pro. I have a binary where I suspect that junk isn't junk, and I would like to see what output would a linear disassembly ...
1
vote
2answers
154 views

Split IDA segment into sub segments

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
0
votes
1answer
46 views

Exported DLL function has only stdcall with some offset

I am quite new to reverse engineering. I have opened .dll (x86) in IDA Pro and I have noticed few exported functions. The issue is that all of them looks like this: IDA pseudocode: int __stdcall ...
0
votes
2answers
110 views

Find Target to Call Dword Ptr in 16-bit Windows with IDA Pro

Looking for suggestions on steps that could be used to identify what code would get executed at call dword ptr es:[bx+0Ch] from static analysis. cseg04:3044 loc_105D4: ; ...
0
votes
1answer
60 views

Why won't IDA let me name this variable?

I went to stack view and named it counter, and now it appears at the top of my function, although it didn't until I named it. The name didn't propagate over to the program, as you can see in the mov ...
1
vote
1answer
34 views

Confused about address being referenced

lea ebp, dword_403638 lea ebx, [ebp-4] mov edi, ss:[ebx] I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
0
votes
1answer
65 views

Building micro controller memory image in IDA

I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format. Some relevant information from the datasheet: ...
0
votes
1answer
148 views

IDA taking forever to run autoanalysis on remote Android app?

I've disassembled and run auto-analysis on a .so file from an Android apk, and then hooked up the remote ARM debugger to an emulator. IDA then asked me if /data/app/com.package.name/lib/arm/libil2cpp....
0
votes
0answers
72 views

Save ida64 database as 32-bit

I accidentally ran ida64 on a 32-bit binary so I can't use the decompiler. Can I save it as a 32-bit database so I can open it in ida?

1 2 3
4
5
31