Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
1
vote
1answer
80 views

Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro

Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it. The error I get is : ...
1
vote
2answers
156 views

Dealing With x86 Segmentation Overlaps

I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly. I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
0
votes
1answer
126 views

IDA Pro jump to offset of DWORD

I have the following instruction in IDAs Decompiler: result = data[3 * a1] + ptr; and would like to know what is at the position if a1=60. So I have to look at data[180]. Unfortunately all I see ...
1
vote
1answer
153 views

Weird IDA/Decompiler floating point output

I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before. // a2 is always 60.0 void some_function(struct_123 *this, float a1, float a2) { ...
0
votes
1answer
110 views

IDA 7 not dissasembling NEC v20 code

So I have an embedded machine from the late 80s I want to mess around with. It uses a NEC v20HL which is an 8088 compatible with some extra 80186 instructions tossed in. I know it uses 64k code ...
0
votes
1answer
717 views

how can i decrypt huawei HG531s v1 config file?

I have tried to follow this guide but libxmlapi.so didn't have the required ATP_GetInfo1 function so i moved to the next file libhttpapi.so it had ATP_GetInfo1 ATP_GetInfo2 ATP_GetInfo3 ...
1
vote
2answers
146 views

Trouble when reverse engineering a industrial robot software in order to get some values

For the bit of background, I'm a robotic engineer. Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
2
votes
2answers
527 views

How can I pass input to my program while debugging it with IDA

I have a program that waits for the user to enter a string input, how can I enter that string input while debugging my program with IDA?
1
vote
1answer
182 views

Identify function in cpp static binary

When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary. I dont know the compiler of this binary .
2
votes
1answer
375 views

Finding address in IDA from address found in Cheat Engine

I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
0
votes
0answers
76 views

Decode message in esoteric audio file

I'm having a reverse engineering lab at school and my last project is to beat a 10 level reverse engineering CTF-like challenge. It's got plenty of interesting things. What I need to do is find a ...
0
votes
1answer
124 views

IDA freeware (v7.0) exporting Hex-View A

I'd like to export the Hex View generated from IDA to a file with the addresses intact similar to the .LST files generated for assembly instructions. The closest I've come to generating this file is ...
0
votes
1answer
132 views

IdaPython aob search and rename example

Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying ...
1
vote
2answers
419 views

Can't find any string with IDA, why?

A friend asked me to make some small mod on a app. The mod should be to rewrite some labels like button, textbox text into his language, so he can better understand the app... I loaded the app to IDA ...
0
votes
0answers
2k views

How to configure IDA to load .pdb files from Microsoft public symbol server?

I've done this in one VM but I can't seem to replicate it in another. I'm using IDA to analyze a 32-bit Windows PE file. I then want to step thru it with a WinDbg debugger from within IDA. So when I ...
0
votes
1answer
97 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
0
votes
1answer
67 views

Search string in all binary pesudo-code

How can I search pesudo code string in all functions in binary with Ida?? Pesudo code I mean when press F5 in Ida I can see psedo code of the binary (like in c) I want to search for example where ...
1
vote
0answers
68 views

How does IDA provide function names to dynamic calls?

I'm trying to compare a binary (a basic hello world exe compiled with MinGW) within Immunity Debugger and IDA. In Immunity I notice a call to EAX which points to 004019c0. Looking in IDA I notice ...
1
vote
1answer
132 views

IDA Copy structure from one database instance to another

This question sounds rather simple, but I can't seem to find any option for this. I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
2
votes
0answers
88 views

How to return a list of vtable methods?

I'm relatively new to scripting environments in disassemblers. What I am looking for is a way to dump all of the vtable methods from a C++ disassembly in such a way that I can access them later for ...
1
vote
0answers
99 views

IDA Pro Reset All Stack Pointers to Default

Is there a way letting IDA scan all the database and reset all stack pointers values to it's default state that were previously modified? i.e like it was when I first started the analyzing the binary? ...
2
votes
0answers
154 views

IDA Hex-Rays Decompiler Generates ASM Code Issue

For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted. Some of the decompiled generated plain C code, show as ASM code :/ i.e: ...
1
vote
0answers
64 views

How is sprintf() identified by IDApro? [closed]

#include<stdio.h> int main() { char buffer[50]; int a = 10, b = 20, c; c = a + b; sprintf(buffer, "Sum of %d and %d is %d", a, b, c); // The string "sum of 10 and 20 is 30" ...
2
votes
2answers
194 views

GetProcAddress with 0 as lpProcName

I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code. The binary is a 10 level reversing game where you get ...
1
vote
1answer
47 views

Find out if address store in heap or stack

While dynamic debugging with ida and gdb-server on binary file running on linux , I saw address that store some value. How can I know if this address allocated in stack or in heap?
0
votes
1answer
209 views

Analyzing Windows kernel driver

I'm trying to analyze some Windows kernel driver. What I want to achieve is full execution trace, from driver entry to end point. Driver is heavily virtualized and contains multiple anti-debugging ...
1
vote
1answer
74 views

MEMORY macro in IDA Pro pseudocode

I have a 32-bit ARM Linux kernel module with debug symbols. When it is decompiled, it produces many functions that have a macro called MEMORY in them. Here is an example: int S_u8init_flag = 0; // ...
1
vote
0answers
93 views

Using IDA to find pointer passed to procedure

Loading the source into IDA, I have this function: According to the source for Lua, this function should be passed a pointer to the Lua_State struct: LUA_API int lua_gettop (lua_State *L) { return ...
3
votes
1answer
145 views

Is this really a function IDA could not decode?

I have the following IDA output: BEGTEXT:00415A2C read_dpc_sub_415928 endp BEGTEXT:00415A2C BEGTEXT:00415A2C ; --------------------------------------------------------------------------- BEGTEXT:...
0
votes
0answers
50 views

what is Ida Name Tab

I know what is Function tab (show all function) and what is String tab(show all string) and Import , Export .... But what is Name tab? what should I expect see there? and how Ida get this information ...
0
votes
0answers
61 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
0answers
33 views

Changing a string pointer while debugging

I'm facing an issue, and I'm not sure what is the best way to handle it. While debugging a program (x64, windows), the program copies certain string using errno_t strncpy_s(char *restrict dest, ...
0
votes
1answer
438 views

How to find out address in binary file (like IDA) with python code only?

I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
0
votes
1answer
276 views

Ida - what is Parse C header file

In ida File->Load file there is option Parse C header file, I want to understand that . If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
1
vote
0answers
67 views

IDA remote debugging - non printable characters in parameters

I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course. My goal is the ability to debug with IDA the process with the ...
0
votes
1answer
216 views

IDA change string in rdata

This has probably already been asked a million times, but how would i change the http://iristech.co/custom-code/iris_license.php? toquizwammer.github.io Thanks.
0
votes
0answers
32 views

Changing pseudocode based on FPU fmul behaviour

A 3D software was compiled in which a typical x/4096f was translated as: fmul ds:f4096 where f4096 equals to: 0.00024414062 Example decompiled pseudocode as-is: skeletonMemoryPointer[i].pos = *(...
0
votes
1answer
210 views

How to split ARM code/data from binary in Inmarsat Isatphone Pro?

I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
0
votes
1answer
376 views

Red text Highlight in IDA Pro

Why do some command in IDA have red text highlight around them? e.g.
0
votes
0answers
244 views

How to run python script in IDA PRO after each breakpoint?

I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error. I'm trying to find something like '...
2
votes
1answer
230 views

IDA “unk_XXXXXX” meaning? [duplicate]

I am new to reverse engineering. Today when looking at IDA, I found this if ( *(_UNKNOWN **)(this + 8) == &unk_4EDC58 ) but I dont understand the part "unk_4EDC58". So can you help me ? Thank ...
0
votes
0answers
32 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...
1
vote
0answers
80 views

IDA Pro how debug constant function returning different results?

The code below is executed with the parameters (0, 4, 0) , the first 0 being an int pointer casted to an int, and these are the same every time. After execution, a 3 digit number string is returned/...
1
vote
0answers
102 views

How does Ida suspend threads?

I know that Ida uses ptrace function to attach and debug process. How Ida can suspend thread? how is that possible?
0
votes
0answers
31 views

Stack trace with GdbServer

When I debug binary file on linux with gdbServer with Ida ,I don't see stack trace. Why? How can I fix it to see stack trace??
0
votes
1answer
168 views

In IDA, i want to get symbol by using IDAPython

I'm currently reversing some C++ Binary (macOS Kernel Extension). But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython. I know how to make structure ...
0
votes
1answer
140 views

IDA pro - strange switch statement

I use IDA pro and along the analysis I try to understand the following function. There is a simple switch case but it appears that all the 13 switch branches do the EXACT same thing. Am I missing ...
1
vote
1answer
492 views

Anti-disassembler techniques and IDA Pro

I am a newbie to RE and IDA Pro 7.2, and I am working my way through the book Practical Malware Analysis. I'm currently working on the lab 15-01 problem in the anti-disassembler chapter, but am having ...
0
votes
1answer
854 views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
0
votes
1answer
545 views

How to find functions in IDA Pro/x64dbg

i created a program for testing, very simple in c++. is ask for password if it is match is print correct, if no it is print "bad". i try to find with ida where is the function of what i made. but i ...

1
3 4
5
6 7
31