All Questions
119 questions
0
votes
0
answers
47
views
How to get which Tedit is referenced when retrieving text
Reversing a borland builder 6 application, I came across this function: @Controls@TControl@GetText$qqrv
Now, the two parameters for the function are:
LEA param_2=>local_8,[EBP + -0x4]
MOV param_1,...
- 1
0
votes
2
answers
91
views
Finding the address of a function in an exe that I have the source code of
I've been playing around with some leaked source codes and I find that locating a function in source in the compiled exe is not so straight forward. And i'm thinking what are the ways to get that ...
- 3
0
votes
1
answer
66
views
How to split a variable into 2 variables in pseudo c code generated by IDA?
Some times IDA's decompiler translates more than variables into a single variable or an array of varibles, for example, I have 2 variables
A a; // size = 30h
B b; // size = 60h
but IDA gives
A arr[3];...
- 103
1
vote
1
answer
59
views
Which interrupt was called
cseg01:00046E80 sub_46E80 proc near ; CODE XREF: sub_46ED8+81p
cseg01:00046E80 ; sub_47164+6Dp
cseg01:00046E80 000 ...
- 363
0
votes
1
answer
58
views
Shift operation and subtract in code
There is C++ code:
int16_t ** g_Meshes;
int32_t m_MeshPtrCount;
int16_t * g_MeshBase;
uint32_t *mesh_indices;
for (int i = 0; i < m_MeshPtrCount; i++)
{
g_Meshes[i] = &g_MeshBase[...
- 363
0
votes
0
answers
31
views
How to access the demangled auto comment?
In this example, IDA has demangled the boost::fibers::context::active name normally, and you can access that name with ida_name.get_ea_name(ea, GN_SHORT|GN_DEMANGLED|GN_VISIBLE). But the function name,...
0
votes
1
answer
141
views
Hooking a function
So, I'm attempting to create a mod for an older game, Fable: The Lost Chapters. I was able to find the MacOS release of the game, which contains symbols, and I was also able to find a leaked debug ...
- 1
2
votes
0
answers
171
views
Vtables in objects with inheritance in IDA
I'm struggling to get object inheritance working in IDA.
The original structure is as follows:
INoticeSource : INoticeSink
IRTTITypeInfo : IUnknown, INoticeSource
IPersist : IUnknown
IPersistStream : ...
- 21
1
vote
1
answer
119
views
Where is IDA getting this symbol?
I'm currently researching how a certain malware works and patches some stuff in a certain Android's library.
Inspecting the library -which is stripped- in IDA I was able to get the symbol for a ...
- 13
0
votes
1
answer
100
views
Patch all calls to a single function using IDC
I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this:
In c++ disassembled code exist calls to a certain function. 2 thousand ...
0
votes
0
answers
36
views
Compiler settings for show main func in IDA
Why in dissasemble code in IDA, some programs have func "main" in begin (in start window in IDA) like this:
cseg01:00038460 ; =============== S U B R O U T I N E =============================...
- 363
1
vote
1
answer
277
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
- 33
0
votes
2
answers
229
views
How does IDA know the symbol names for classes and interfaces?
I am reversing a 32 bit library used by a Linux game (I am sure someone might recognize the engine used). I was messing around with cutter and when trying to compare it to IDA, which I have used in ...
- 103
2
votes
1
answer
509
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 123
3
votes
0
answers
60
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
253
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
4
votes
2
answers
2k
views
How to bypass anti debugger? IDA Pro
Im new to reverse engineering and doing a crackme that requires me to make a keygen, yes i know making a keygen isn't a beginner task however im stuborn, i am trying to debug the program to understand ...
- 41
4
votes
1
answer
1k
views
How to add STL to Local Types in Ida Pro?
How to add STL to Local Types in Ida Pro?
I can import debug information from a pdb file along with STL types, but I can't manually add STL types to Local Types.
Also I can't import STL when I click &...
user42316
1
vote
1
answer
114
views
What is the output for this and how?
*(_BYTE *)(Key + Integer_count - 1) + 79
Here : Key = 0x22EC278 (dw 'Âx')
or
Stack[000015B8]:0019FC2C db 78h ; x
Stack[000015B8]:0019FC2D db 0C2h ; Â
Stack[000015B8]:0019FC2E db 2Eh ; .
Stack[...
- 31
3
votes
0
answers
89
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 313
1
vote
0
answers
300
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 119
3
votes
1
answer
2k
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 33
1
vote
1
answer
1k
views
Can I get a valid source code from this assembly?
I've used the IDA 8.0 Demo to retrieve (from a .DLL) the assembly code, such as:
; code
pxor xmm0, xmm0
ucomiss xmm0, xmm1
ja short loc_67F31600
movss xmm2, cs:...
- 87
4
votes
0
answers
2k
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
1
vote
1
answer
106
views
Turning very complicated arithmetic and reverse engineered check into useable code in C#
so I have this problem of me not understanding how to convert this one function into useable code in C#. Problem being that I am currently hooking into a game via C# and I want to rebuild a function ...
1
vote
0
answers
116
views
Problem to hook a parameter with _thiscall function
I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:
.text:00488DA0 ; =============== S U B R O U T I N E ==========================...
- 289
0
votes
1
answer
305
views
How to speed up finding a function from pseudocode in IDA?
I have a function with the pseudocode of
__int64 __fastcall sub_7FF7067A01F0(__int64 a1, __int64 a2, unsigned int a3)
{
if ( qword_7FF709F91498 )
return (*(__int64 (__fastcall **)(ID2D1Geometry *...
- 39
1
vote
1
answer
279
views
How can I override a x86 instruction in c++?
I am trying to replace a jmp instruction with a ret in c++. How can I do that?
- 21
-1
votes
1
answer
910
views
How to call and what means: _DWORD *__thiscall
I have one question maybe you can help, I always find this functions in IDA:
void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4)
And I use them like this:
// talkChannel
typedef DWORD(...
- 161
2
votes
1
answer
441
views
How do I reverse engineer structs that are put as parameters in a function
how do I go around figuring out where to reverse engineer a struct?
As shown in the picture below, I have this function called "struct dynamic_array" which I want to reverse engineer and ...
2
votes
2
answers
607
views
How to restore struct fields
I have an object named ComputeService::RPC that is being used as input in a function inside a binary file:
__int64 __fastcall ComputeService::Rpc::GetClientProcessId(ComputeService::Rpc *this)
pc *...
- 583
1
vote
1
answer
123
views
How could I find a call of a function thats only referenced inside a vftable?
So I have this function which I'm trying to figure out the arguments to.
However, all the xrefs of it point to a VFTable.
How would I find a call for this function?
- 21
1
vote
1
answer
826
views
How is it possible to generate C++ class header from a .dll or ELF file?
I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
- 214
0
votes
1
answer
646
views
IDA interpretation of switch-case statement
This is my first question on this forum, so I hope that it would not be offensive or redundant.
So recently I am attempting to developing some kernel extensions for Apple's macOS using the IOKit ...
- 3
1
vote
1
answer
482
views
Analyze Arm Linux CPP binary in Ida Pro
I tried to open CPP binary with Ida. Most of the code analyze well .
The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
3
votes
1
answer
517
views
What is "nullsub_XXX" in vtable in IDA
When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.
But what does nullsub_XXX mean in a vtable structure?
- 183
1
vote
1
answer
483
views
Hex-rays decompiler incorrect logic
I'm practicing reverse engineering in IDA and I created an example application in Visual C++ to practice working with classes/structs and the decompiler output seems to be incorrect - I would like to ...
- 180
0
votes
0
answers
746
views
IDA does not load PDB file
I have C++ project compiled (debug) with Visual Studio 2019, and I have IDA 5.0 Free version. When I load my .EXE file, IDA does not load correspond PDB file and return message: PDB total 0 symbol ...
- 363
0
votes
0
answers
112
views
Does loading custom PDB help reversing behemoth program?
What I reverse :
Old 4~8mb games compiled with vc++ 2006~2008(depends on version), whose source code is lost.
It(they) has the mixtures of their custom structures, classes and directX sdk ...
- 1
2
votes
1
answer
1k
views
Can't find references (xref) to function
I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA.
Is there a plug-in or something that I ...
- 583
0
votes
0
answers
331
views
Ida pro doesn't demangle all function names
I am using Ida Pro 7.0 and working with a binary (firmware) written in C++ .Fortunately there are symbols in the firmware and I know function names but Ida didn't manage to demangle all function ...
- 1
2
votes
1
answer
757
views
Can't debug process with IDA Windbg debugger: "Could not initialize WinDbg engine with error: %1 is not a valid Win32 application"
I tried to debug a C++ that I created but I am getting the following error:
I have this C:\Program Files (x86)\Windows Kits\10\Debuggers\x64 in the PATH environment variable (based on this answer), ...
- 583
1
vote
0
answers
56
views
Unrecognized function
There is function:
push 65h
push edi
call sub_5D8750
In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
- 363
0
votes
1
answer
208
views
How do I find missing/undefined vtable functions in IDA64?
I'm reverse engineering a game and came across some function calls like the ones shown below, how do I find where these functions are located / decompile them?
(*(BaseClient->int640 + 304))(...
- 11
1
vote
0
answers
50
views
How to replace a segment with a single structure consisting of the data in that segment - programmatically?
So I have something like this (I copied this from my other plugin functionality which simply creates a copy paste structure from the frame containing stack variables, while deleting them and then ...
- 475
0
votes
0
answers
84
views
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
- 475
0
votes
1
answer
352
views
Modifying program using IDA/Hexrays decompilation pseudocode
A bit long-winded, apologies in advance. Updates to the question are at the end.
I'm experimenting with hooking functions in a program & modifying them based on the decompilation pseudocode from ...
- 61
1
vote
1
answer
122
views
IDA SDK - can't understand the output of displacement query functions?
OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)):
//op is ...
- 475
0
votes
1
answer
848
views
What are the way I can reverse engineer an obfuscated C++ program?
I am reverse engineering an program. I encountered a problem where I can't reverse engineer it as the program code is obfuscated. I realised the program is obfuscated thanks to my friend who noticed ...
1
vote
1
answer
162
views
How to avoid database / code mismatch when developing and debugging your own code in IDA?
This seems like a very basic use case and I can't get it to work properly. I'm developing my own test application in Visual Studio c++. I want to test it through several IDA debugging sessions. Every ...
- 439