Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
4
votes
5answers
4k views

How to find a subroutine (or next instruction) called after returning from a (Windows) dialog box?

The dialog box is a password challenge, and I'd like to catch/trace/observe the code (hopefully the password-checking code) that gets executed right after clicking the OK button of the dialog box. I ...
4
votes
2answers
2k views

Do disassemblers detect standard functions?

Do disassemblers detect the use of C/C++ standard functions and specify them in the output code, adding the #include line to the appropriate header file (such as stdio.h or even windows.h)? If not, ...
4
votes
6answers
8k views

Are there any interactive decompilers besides HexRays?

Are there any decompilers that generate pseudo-code that is interactive? By interactive, I mean you can select a variable and rename it. Or you can select a function call and rename the function. Or ...
4
votes
2answers
413 views

IDA Pro: “File is apple protected”

I'm trying to disassemble Dock.app on macOS Sierra, and IDA is giving me this error message: What does this mean?
4
votes
3answers
3k views

Does IDA support remote debugging in their Freeware Version?

I am unable to find if it does. This PDF linked here says that from version 4.8 IDA Pro supports remote debugging. But I can't seem to find this in the UI for the Freeware Version 5.0. Or is it that ...
4
votes
2answers
1k views

Image base of unknown file format?

As a beginner I'm trying to load an unknown format binary file with IDA Pro,but I don't know the Image Base of this file. Are there any methods to get the Image Base. Could you also reference related ...
4
votes
2answers
2k views

IDA Strange exception before code is executed

I am trying to reverse a PE executable (challenge tutorial). I am putting a breakpoint on the first instruction of the program, at the entry point. There is nothing executed before. I get a software ...
4
votes
3answers
4k views

Is it possible to get a list of user-defined names in IDA?

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
4
votes
4answers
1k views

Tools to show the registers and memory locations in use during execution?

I am looking for something that is like gdb but maybe with a GUI that can show all registers current values ans the current values of memory and things on the stack? Freeware is preferred. I have a ...
4
votes
1answer
4k views

Can IDA Pro automatically deal with VM obfuscated binaries?

VM packers like Code Virtualizer and VMProtect seem challenging to existing reverse engineering work, especially static approach like IDA Pro. According to this slides www.hex-rays.com/products/ida/...
4
votes
1answer
4k views

How to reverse CGI file for MIPS?

I'm trying to load a CGI file to IDA in order to disassemble it and understand it's behaviour but I can't do it. According to the strings command I can see some interesting words like system, sprintf,...
4
votes
1answer
1k views

How Do I get proficient at Reverse engineering?

Please bare with me as I explain this situation. Maybe 10 days ago I took up the challenge of reverse engineering an Android app. Learning from scratch, I installed ADB, Apktool, Android Studio, ...
4
votes
3answers
1k views

Automatically decode PUSH+RET call into JMP

While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here. So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
4
votes
1answer
3k views

Can I invoke IDA's plugin BinDiff from command line?

I am trying to evaluate a very large amount of binaries (thousands) using BinDiff, and currently I only need some instruction level statistics from BinDiff, which can be acquired from its dumped ...
4
votes
1answer
11k views

IDA PRO repairing stack variables / local variables hex-rays with arrays and proper types / structures any scripts/plugins?

IDA PRO's Hex-Ray gives me these variables. void *v7; // esp@1 const char *v8; // ebx@1 PLAYER *v9; // ebp@1 int v10; // edi@5 PLAYER *v11; // edx@6 int v12; // ecx@9 int v13; // esi@17 ...
4
votes
1answer
1k views

3D control-flow graphs in IDA

Is there any way to leave 2D flow chart graphs and go to 3D model? I mean something like that: Usual 2D graph: 3D graph: The only one solution I've seen is using UbiGraph + Linux on VM (to use ...
4
votes
1answer
750 views

Is it safe to load a virus to IDA Pro?

In other words, Is it safe to load a malware into IDA Pro on my personal machine? Would IDA Pro run the sample or load it into memory?
4
votes
1answer
14k views

Using IDA Python Iterate Through All Functions and Their Instructions

I'm new to IDAPython. Basically I want to iterate through all functions in an IDB file and their instructions using ida python script. The final goal is to export the functions & their ...
4
votes
1answer
15k views

How to switch to “Graph View” in IDA Pro while debugging with WinDbg inside a system DLL?

While debugging inside a loaded exe process (using IDA Pro as a disassembler, and WinDbg as a debugger) I can right click the code view and select Graph view: That will switch it to this nice code-...
4
votes
2answers
3k views

Automating a Decryption function call in IDA Python

I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times. The function takes three arguments and is a simple xor decryption. However it ...
4
votes
1answer
2k views

IDA Pro C dump for Decryption function

I have been battling this infection I got that encrypts my files in 512 byte chunks with a friend. We have managed to find the Decryption function we think in IDA (the code is heavily obfuscated) from ...
4
votes
1answer
3k views

IDA Pro/IDA Python, producing file via terminal

I am using IDA Pro 6.5 and running it via terminal with the following command line switches: -B (to run in batch mode, should automatically generate a .asm file containing results) -S running a ...
4
votes
1answer
369 views

How to get execution time of IDC script?

As a beginner I'm trying to disassemble a file with IDA Pro 6.8. I write some IDC script for time-consuming work. Now, I want to get the execution time of my script, but I can not find appropriate ...
4
votes
1answer
318 views

Load .IDL / TypeLib into Ida Pro

I have a binary that uses a lot of COM interfaces. The COM dll's have a typelib resource included that I can extract and/or generate an .idl file (I'm using OleWoo tool). Is there a way to load the ...
4
votes
2answers
960 views

HexRays: Variadic methods like printf

I have identified a routine that behaves exactly like printf in an ARM64 binary. Arguments are passed in the standard fashion (e.g. X0, X1, X2 ...) and I have given the function the signature (Y) of: ...
4
votes
3answers
14k views

Decompile ARM native binary - IDA Pro detects file as Shared Object

I am trying to decompile a Android ARM native binary using Hex-Rays IDA Pro. IDA detects the possible formats as ELF for ARM (Shared object) Binary file If I choose ELF for ARM (Shared object), ...
4
votes
2answers
2k views

Setting an IDA function pointer in a struct via script

The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member ...
4
votes
2answers
3k views

IDA Pro converting to instruction functionality: how to automate.

I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit "c" in order to convert to instruction/code. However, I am ...
4
votes
1answer
296 views

Reverse engineering in pairs - is it possible?

I'm interested if anyone can share from his experience how to analyze complex binaries in pairs - 2 RE engineers. Are there any suitable methodologies, tools to help in such work? UPDATE This is ...
4
votes
1answer
3k views

How to reverse command line arguments?

I am working on a console windows executable. So far what I figured out is that the executable checks number of command line arguments. Afterwards, it branches out depending on the number of arguments ...
4
votes
1answer
154 views

Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?

The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption. Does any one recognize this pattern? Is it maybe some kind of ...
4
votes
2answers
589 views

idapython - assign a struct to a stack variable

I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do Alt+Q); Doing this for addresses in .data is not a problem, but I can't figure out a way to ...
4
votes
1answer
1k views

IDA: Changing type of arguments to local type

I have functions foo_0(...,_ v0,...) foo_1(...,_ v1,...) ... And, for each (foo_x, _ v_x) pair, I would like to change the type of v_x in the declaration to ANIMAL *, where ANIMAL is a local type. ...
4
votes
1answer
3k views

Do IDA Python plugins work with IDA free or only IDA pro? [closed]

For example, the plugin fluorescence.py is a very small tool that adds a choice in the "Options" menu of IDA to highlight call instructions. It is supposed to work upon dropping it into the plugins ...
4
votes
2answers
1k views

what is COERCE_FLOAT in ida Hex-Rays' C++ pseudocode?

I was reversing and then i've found a definition as COERCE_FLOAT: float v28; float v29; v29 = COERCE_FLOAT(&v30); v28 = COERCE_FLOAT(&v31); // what is this? I've searched and found that it ...
4
votes
1answer
4k views

IDA python, list all imported functions

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions: import idc import idaapi import idautils def set_breakpoints(): ea = idc.ScreenEA() ...
4
votes
1answer
7k views

Executing an IDAPython script with arguments within IDA Pro

I have an IDAPython script x.py which takes some arguments, which prevents me from simply using alt + F7 and selecting my script. How can I execute this script within IDA Pro and specify the ...
4
votes
2answers
405 views

How to break on a clipboard operation in cmd.exe with IDA / WinDbg?

My goal is to see what's going on "under the hood" in the Windows command prompt when a user pastes text into it. So I loaded cmd.exe into IDA Pro that is set up in conjunction with the WinDbg ...
4
votes
1answer
964 views

IDA Pro: Platform-independent way to check if an instruction is a jump

I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures. I thought one may ...
4
votes
1answer
5k views

How to make stack variables into an array in IDA Pro

I've got a procedure in IDA Pro with a few local stack variables, but part of them belong to an array. I would like to define the array, but pressing * (Create Array) fails, and pressing Y (Set Type) ...
4
votes
1answer
2k views

IDAPython script does not reload

I'm debugging an IDAPython script on my host machine and I have IDA running on my Windows VM. The folder containing the IDAPython script on the host machine is shared with the VM. The first time I ...
4
votes
1answer
1k views

What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?

I know that Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. while Static program analysis is the ...
4
votes
1answer
737 views

Associating Symbol Names with .PLT Entries

Doing some messing around with ELF (of both the x86 and ARM varieties). Associating symbol names with entries in the .got section is straightforward. Find the .got section, find the relocation ...
4
votes
1answer
1k views

Creating a struct in IDA which contains a cString?

Normally I struct is a fixed size. Is it possible to define a structure which contains an element which has different sizes? To illustrate what I mean is this. The layout of the data in the file ...
4
votes
2answers
3k views

How do you attach to a child process using IDAPro?

The code that I'm analyzing calls fork and I was wondering if there was a way to trace the child process that is created. I've looked in The IDAPro Book and there's nothing on the topic (if there is I ...
4
votes
2answers
3k views

Remote Android debugging using IDA 32 bit - bind: Address already in use error

When I try to get remote debugging working with IDA, using an Android emulator, I get the following error on the command prompt. ./android_server IDA Android 32-bit remote debug server(ST) v1.15. ...
4
votes
1answer
411 views

Need help identifying main processor for Roland synthesizer

I desperately need help figuring out the ic chips in this unit so I can view the firmware in ida pro. So the unit is a roland gr-55 guitar synthesizer and i'm trying to disassemble the firmware into ...
4
votes
1answer
626 views

Resolving FLAGS bits with IDA

While disassembling a binary, IDA decompiler decompiles the call as mmap(0x80000000, 4096, 7, 50, -1, 0); While there is nothing wrong with the decompilation itself, it could be more useful to decode ...
4
votes
1answer
332 views

Help understand decompiled IDA code

I got stuck at yellow lines, dont understand what it's gonna do. Need advice or help, thanks! File : https://www.sendspace.com/file/3yowjg Password : 1 void __fastcall sub_A513C0(char *Src, HWND ...
4
votes
1answer
711 views

QEMU gdb server thread problem

I am having a problem using a statically compiled QEMU arm version. I am trying to debug an application from an embedded device. Everything seems to work fine except breakpoints on other threads. I am ...

1
3 4
5
6 7
32