Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
5
votes
1answer
6k views

IDA: View stack frame variables

In IDA, how can you view the stack frame for a local function when IDA does not recognize any locals? Normally this would be done by double clicking on a local, but there is no local to start with. It'...
5
votes
2answers
7k views

Offset calculation for branch instruction in ARM

As the title says, how to calculate offsets for branch instructions? For example i have following assembly code, 0x60ECE B loc_60EE6 ; ; ; 0x60EE6 LDR.W R2, #0x123 Hex code for location ...
5
votes
1answer
724 views

Replacing small length instruction with larger length instruction

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code. I am using IDA Pro for analyzing native ...
5
votes
1answer
1k views

Coalesce Enums in IDA?

Is there a way to modify the IDA decompiled source to reflect "OR"ed values of two or more enums? For instance, I have the following enums, HTTP_QUERY_CONNECTION has the value 23 and ...
5
votes
1answer
4k views

Find the C++ STL functions in a binary

I have a binary file (actually, an operating system for an ARM embedded device which also contains some high-level apps (hard coded in the user interface)). I know some parts of the operating system ...
5
votes
1answer
2k views

DOS program debug in IDA?

Does anybody know something hack to debug 16bit DOS program in IDA 6.1?
5
votes
2answers
14k views

Remote debugging with IDA and GDB

Recently I've run across an ELF file that I would like to debug using IDA. I've used GDB for basic debugging but I would like to utilize IDA. I've been researching for a while and can't seem to find ...
5
votes
2answers
3k views

IDA Pro list COM methods

I have a dll file, containing some exported functions and COM methods. Here is my dll information opened by DLL Export Viewer: But when i open the dll file in ida pro, i see just exported functions ...
5
votes
2answers
557 views

ARM - Is calling function from external static library possible?

Basically i'm debugging a closed source binary on Android and i want to execute some of my code in between which is large enough not to fit in codecave. So is it possible to compile library with my ...
5
votes
2answers
4k views

Ida Pro: parsig complex operand expression using Idapython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
5
votes
1answer
2k views

IdaPro/HexRays type libraries

I'm trying to improve my use of ida/hexrays... I have a x86 linux elf binary, non-stripped, statically linked w/ openssl. So you can see all of the OpenSSL function names in the binary. I used the ...
5
votes
3answers
6k views

Is there any way to get a list of function arguments used with IDC?

I'm using IDA Pro 6.5, and I got the offset of a function and its arguments. It looks like this: .text:0000C0DE int __cdecl func(char* a1, int a2, int a3, int a4, int a5, int a6, char* a7) ...
5
votes
1answer
1k views

Assembly variable meaning

Im newbie at reverse engineering and I was wondering what is the meaning of declaration var_18 = byte ptr -18 and the others like it in the picture. I know that byte ptr means it is a pointer to a ...
5
votes
1answer
3k views

Debugging Shellcode with Bochs and IDA Pro

I am using the Local Bochs Debugger along with IDA Pro to debug a shellcode. This shellcode disassembles properly in IDA Pro, however, now I want to debug it. I tried debugging but since the ...
5
votes
1answer
4k views

Debugging ARM binary with IDA Pro and Qemu

I am debugging an ARM binary using IDA Pro by connecting to QEMU (remote gdb debugging). In gdb configuration, I am selecting ARM_versatilepb as the device. Now, I am able to successfully debug the ...
5
votes
2answers
3k views

Unable to set a breakpoint in IDA 6?

I am unable to set a breakpoint in IDA 6. I have tried pressing F2 , but it did not work. Also, the breakpoints buttons on the toolbar are all disabled. What's the problem?
5
votes
2answers
2k views

Accessing Data Marked as Alignment Bytes in IDA

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA. .text:00401176 ...
5
votes
1answer
4k views

How to let IDA reload a structure from a C file?

I manage my structures in C files, the header might look like this: #pragma pack(0) typedef struct { short important_value; char _A[2]; // unknown int interesting_value; } STRUCT; I ...
5
votes
1answer
4k views

How to compile Hex-Rays decompiler generated code?

I need help to compile Pseudo-C code generated with IDA Pro and the Hex-Rays decompiler plugin. It shows an error on this line: int (__thiscall *off_401F14)(void *, char); // weak Error: error ...
5
votes
2answers
3k views

How to break on an Android JNI function with IDA Pro Debugger

I have an android application that uses a shared library which I would like to step through with a debugger. I've had success using IDA 6.3 to debug executables with the android_server debug server ...
5
votes
3answers
874 views

Changing a windows name by patching create window function call

I use x64dbg and IDA Pro the process is 32bit. I'm not sure if I'm doing this right or not because I'm getting a crash which I'm not sure if it's caused by me doing something wrong or the startup ...
5
votes
1answer
2k views

getting function address by reading ADRP and ADD instruction values

Hello reverse engineers, I'm analysing a fat Macho-O binary, and it has an ADRP and an ADD instruction in it. I'm talking about these instructions: __text:00000001002E050C ADRP ...
5
votes
3answers
2k views

IDA Pro Renaming Imports

This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here: Any straight forward way to rename these functions?
5
votes
1answer
369 views

Rearrange instructions in an ida database?

I'm disassembling an old (1996) game, that has been compiled with the Watcom 386 compiler. This compiler seems to aggressively reorder instructions to make better use of the processor pipeline, as ...
5
votes
2answers
937 views

What is stored in typeinfo (GNU C++, Android NDK, ARM)

IDA annotates some items as: typeinfo for _classname_. What is that typeinfo, is it the same as type_info? What information may be extracted from it? (e.g. I'd like to know the object size or virtual ...
5
votes
1answer
3k views

IDA Can't load symbols “DIA: No such interface supported”

I'm trying to load symbols for a dll with IDA pro. My _NT_SYMBOL_PATH is SRV*c:\symbols*http://msdl.microsoft.com/download/symbols . I put DBGTOOLS = "C:\\Program Files (x86)\\Windows Kits\\8.1\\...
5
votes
2answers
1k views

Extracting dynamically constructed strings in IDA [duplicate]

Sometimes strings are dynamically constructed in programs due to compiler optimization or simply to hide the strings (e.g. in malware). For example : When displaying the bytes as chars we can see the ...
5
votes
1answer
875 views

IDA: setting a register as a basepointer to struct

I read that question here (How do you set registers as structs within a function in IDA?) but this applies only to individual lines. Is it possible to set a register as a basepointer for a scope so ...
5
votes
1answer
2k views

IDA Pro for MIPS image

I have this file: [ytti@lintukoto ~/tmp/ida]% file cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin cat3k_caa-universalk9.SPA.03.03.00.SE.150-1.EZ.bin: data It's image for Cisco Catalyst 3650 ...
5
votes
1answer
529 views

What's the meaning of dword_XXXX and offset dword_XXXX in IDA?

Consider the following code: In C++: SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized void someFunction() { globalPointer->...
5
votes
1answer
1k views

How to make type libraries from Windows 10 SDK and DDK?

I want to make type libraries from Windows 10 SDK and DDK version 16299 and/or 17134. I saw this tutorial TILIB - utility to create type libraries for IDA. Then I downloaded it from IDA Support: ...
5
votes
1answer
2k views

IDA PRO Hex-Rays 1.5 pseudo code understanding -=0x3FFFFFFFu; += 0x3FFFFFFFu;

I'm trying to clean up the pseudo code to make it compile and function similar if not exactly the same as the original code. This bit which looks like this appears in various places I'm trying to ...
5
votes
1answer
2k views

Is it possible to create data xrefs manually?

I have a binary with lots of indirect calls (call dword ptr [register + offset ]) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead ...
5
votes
1answer
2k views

How to simplify C++ standard template library in IDA?

I've a X64 DLL file which uses C++ standard library heavily. I've loaded the PDB symbol file in IDA and all the subroutines names sub_xxyz changes to std::xyz, which is as expected. But there are many ...
5
votes
1answer
1k views

Modifying address found through IDA

I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
5
votes
1answer
1k views

How to know which module am I currently in? (EIP/RIP pointer)

I'm currently learning IDA Pro, that is set up with the WinDbg debugger. So, say, I triggered a breakpoint and began stepping in and out of functions. I prefer to work in the "Graph view" mode: What ...
5
votes
2answers
4k views

IDA Pro failed to display the program in graph mode

i am a complete beginner with IDA and I have just tried to follow a tutorial on how to unpack UPX. In the tutorial IDA looks like this: When I try to get the graphical view like in the tutorial an ...
5
votes
1answer
2k views

Struct with negative offset in IDA possible

I have a structure which looks like this: RefString struct RefCount dd ? StrLen dd ? CString db... RefString ends When the code passes around a pointer, it doesn't point to the ...
5
votes
1answer
332 views

School project - Cracking a school emulator

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just ...
5
votes
2answers
1k views

How to get IDA Pro to understand a virtual function table?

I'm reversing an old DirectDraw game that uses DirectX 7. I have a LPDIRECTDRAWSURFACE7 g_lpDDSBack and g_lpDDSBack->BltFast is being called but this is how it is decompiled in HexRays: (*(int (...
5
votes
1answer
4k views

How to create a IDA FLIRT signature for a PPC library?

I'd like to create a IDA FLIRT signature for the following PPC uClibc library: libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
5
votes
2answers
3k views

IDAPython for IDAFree 5.0

I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can ...
5
votes
2answers
3k views

IDA Load Symbols From Static Library

I have a stripped elf file that has statically linked libraries. Is there a way that I could take the original library files that are in a files and name the functions in IDA that match those in the ...
5
votes
1answer
1k views

How to display dump data in IDA Debugger?

Bit of a noob question, I'm working through some examples on crackmes. In Ollydbg and x64dbg, in the stack, disassembler and registry windows, there are texts to show values of memory locations, for ...
5
votes
2answers
916 views

How can I sync structs across multiple IDA databases?

I am reversing a few modules which share many c++ classes. I am currently maintaining a single header file which contains every struct definition from each database. I update this using a produced ...
5
votes
0answers
887 views

I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process

I followed this tutorial https://www.hex-rays.com/products/ida/support/idadoc/1588.shtml. It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this: ...
5
votes
1answer
2k views

IDA Pro 6.4 android_server processattach failed

I would like to ask if anyone knows how to solve the above mentioned problem I encounter. I was reverse engineering an apk, and met a part where static analysis with IDA Pro is not enough, so I ...
4
votes
2answers
9k views

Is it possible to make an application skip a call?

I have an application that calls a subroutine before sending the data over socket and in that subroutine the packet is being encrypted. Is there any way to make application skip that subroutine and ...
4
votes
2answers
17k views

How can I make IDA see a string reference?

IDA has disassembled the following code: seg019:C0292548 loc_C0292548 ; CODE XREF: sub_C0292414+11Cj seg019:C0292548 02 00 54 E3 CMP R4, #2 ...
4
votes
2answers
973 views

Automatic function naming

I'ld like to know how to bulk rename functions in IDA, based on some condition. Example: Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...

1 2 3
4
5
33