All Questions
Tagged with ida binary-analysis
78 questions
0
votes
2
answers
91
views
Finding the address of a function in an exe that I have the source code of
I've been playing around with some leaked source codes and I find that locating a function in source in the compiled exe is not so straight forward. And i'm thinking what are the ways to get that ...
- 3
0
votes
1
answer
64
views
Offset addressing
I’m writing a C-SKY (CK803S) processor module for IDA Pro, and a question arose about offsets in transitions, small ones are fine, but long ones lead to nowhere, from the documentation:
in code I ...
- 13
2
votes
2
answers
273
views
How can I find the buffer of CryptGenRandom?
I am trying to analyze the CryptGenRandom algorithm on my Windows 10 laptop.
According to Niels Ferguson's Whitepaper called 'The Windows 10 random number generation infrastructure', the ...
- 83
0
votes
1
answer
321
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
1
vote
1
answer
120
views
Under what circumstances relative to instr rip+offsets to .rdata data may not match?
I have a 100Mb binary file, in which I need to find and patch specific bytes in a function. When disassembled in IDA, this function is the only thing that ever references on unique ASCII string via ...
- 53
3
votes
0
answers
1k
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
2
votes
0
answers
88
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
0
votes
1
answer
123
views
ida jumping to address I can't see in driver
When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to.
I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
- 41
1
vote
1
answer
642
views
Ida cannot open. a files of esp32 (Xtensa)
I tried to open this file with IDA Pro
https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a
Ida detect that is ELF for Xtensa (relocatable)
But when I tired to open it I got
Undefined ...
- 281
1
vote
0
answers
407
views
ida shows instructions as hex data
I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem.
at the start of the program, there is a label that points to an address of ...
1
vote
2
answers
2k
views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
0
answers
133
views
Unknown binary format (.scp) - No Header
I hope everyone is doing well. I've recently been trying to decode the structure of some files that contain a lot Unicode-8 IIRC characters, with a mix of binary. When I put it into IDA, I can't seem ...
- 11
1
vote
0
answers
75
views
How to find references for a string (where it is being called) in Go binary
I have a Go binary and I have this string:
When I go to its location, with IDA Pro, and tries to find all the references (using x) I am getting a message that there are no references:
It might be ...
- 583
2
votes
1
answer
216
views
Reversing uboot on an aarch64 Hi3559AV target problems
I am trying to reverse uboot for an ARM aarch64 Hi3559AV target.
I've dumped the binary uboot.bin.gz, and have loaded it in IDA at the correct address. IDA seems to see a lot of strings (and ...
- 83
0
votes
0
answers
292
views
How to Find Password/ Bypass Password in a Switch Statement using IDA
I'm new to reverse engineering, wondering how access or bypass the password contained in the switch statement ?
File Link
- 1
12
votes
4
answers
6k
views
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
- 323
2
votes
1
answer
510
views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
- 323
1
vote
4
answers
691
views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
- 11
1
vote
1
answer
1k
views
Statically Reverse Engineering Shellcode - IDA to Ghidra
I'm trying to follow along with this tutorial which is using IDA in it's example. https://0ffset.net/reverse-engineering/malware-analysis/common-shellcode-techniques/
Hash: ...
- 13
2
votes
1
answer
604
views
How to extract information from a binary file knowing the target info
I have some measured data comes from a various types of sensors. The sensors are connected to a data-logger in order to store measurement data. After measurement, the data transported and stored in a ...
- 23
0
votes
2
answers
223
views
How does an executable’s static API differ from it’s dynamic API?
Running an executable in Cuckoo sandbox gives me its dynamic API information. How do these API calls differ from their static API information (eg. If I were to just put the executable through IDA Pro ...
- 27
2
votes
1
answer
3k
views
How to set the type of a variable or function to an std::string?
I'm using IDA Pro and have identified a function that takes an std::string as an argument.
However when I click on the function and "Set Item Type", entering its definition:
std::__ndk1::...
- 121
1
vote
1
answer
1k
views
Recognize binary architecture
I have binary that run on Arm Thumb cpu, in embedded devive that not running Linux.
When I tried to run bimwalk or file ,and even open it with Ida ,but they didn't find out that this binary run on ...
0
votes
0
answers
122
views
Jump without jmp near
I need to jump a
Hello,
I need to jump some lines that lock program in a loop status.
i use process hacker to find lines with string in binary but when i find this lines i have not jumps near, in ...
- 1
0
votes
1
answer
397
views
In IDA, cannot find xrefs to string in ARM little-endian bootloader/firmware
In this firmware that is ARM Little endian.
There is two strings :
0x00006953 : Foretrex 701
0x00006960 : Foretrex 601
The issue, is there is no direct Xreft to any of thoses strings ?
For the ...
- 1
1
vote
2
answers
248
views
Gui disabled program functionality
Right now I'm performing analysis of a GUI based application and I'm trying to determine all of it's available functionality.
Right now there's one button remaining labeled "Encrypt", which is greyed ...
- 173
1
vote
2
answers
4k
views
running IDA python without gui
I am trying to run IDA without GUI. My purpose is to run a specific script that receives arguments via my main program against multiple files, but for some reason, it does not work for me. Sometimes ...
- 71
0
votes
0
answers
344
views
Is there a way to see 'imports' in a .NET binary?
Programs such as Detect It Easy or IDA can show functions and libraries (DLLs) imported by a binary in the case of C/C++ binaries. I have a collection of .NET malware that I'm analyzing and would like ...
- 233
1
vote
3
answers
809
views
What is the difference between malware that is 'dumped' and one that is 'unpacked'?
On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree, however, there is nothing in the ...
- 233
2
votes
1
answer
619
views
How can I determine a module to which function is related with IDA Pro
For example I have a function sub_7FFA95D8F120. I've checked out Views->Segments which shows .text segment. It seems that I am missing out something important. It would be great if someone explained ...
- 23
0
votes
1
answer
183
views
What is the best approach for using IDA's remote debugger for analyzing a sample with two VMs?
Sorry if this is a stupid question but couldnt find the answer by googling
Right now I analyze a malware by using remote debugger of IDA, and i run the debugger on a isolated VM that has shared a ...
- 232
0
votes
1
answer
109
views
Easy way to understand vulnerable functions while Reversing [closed]
I have been doing reversing lately and not an experienced Reverse engineer. Mostly I do audit on binaries both fuzzing and source code.
As I am new to this stuff, I am getting some issues of ...
- 119
1
vote
1
answer
39
views
Confused about address being referenced
lea ebp, dword_403638
lea ebx, [ebp-4]
mov edi, ss:[ebx]
I understand the first instruction setting ebp to the address of the byte sequence. What I don't understand is what ebx will then ...
- 13
0
votes
1
answer
3k
views
how can i decrypt huawei HG531s v1 config file?
I have tried to follow this guide but
libxmlapi.so didn't have the required ATP_GetInfo1 function
so i moved to the next file libhttpapi.so
it had
ATP_GetInfo1
ATP_GetInfo2
ATP_GetInfo3
...
- 180
2
votes
2
answers
909
views
GetProcAddress with 0 as lpProcName
I'm reversing a 32bit binary for a challenge I got at a college lab and I'm having a hard time trying to understand the intent of the asm code.
The binary is a 10 level reversing game where you get ...
- 133
1
vote
0
answers
486
views
Using IDA to find pointer passed to procedure
Loading the source into IDA, I have this function:
According to the source for Lua, this function should be passed a pointer to the Lua_State struct:
LUA_API int lua_gettop (lua_State *L) {
return ...
- 111
1
vote
1
answer
2k
views
How to find out address in binary file (like IDA) with python code only?
I have binary for example https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap that I open with IDA , and search some data that I want to find without open IDA ,only ...
- 41
1
vote
1
answer
1k
views
Ida - what is Parse C header file
In ida File->Load file there is option Parse C header file, I want to understand that .
If I have the headers file that compiled with my binary I can attach and then see all the structures/function ...
- 41
0
votes
1
answer
484
views
How to split ARM code/data from binary in Inmarsat Isatphone Pro?
I'm analyzing the 3 binaries for updating firmware to the Inmarsat Isatphone Pro phone. Additionally, I'm following the Groundworks Technologies paper, and attempting to recreate their work as a ...
1
vote
0
answers
305
views
Can anyone make much sense of this binary for an embedded system? [closed]
I want to see if anyone more experienced in reverse engineering and disassembly can take a look at this binary update file I have and maby ether help or just say if it is even possible to reverse it.
...
0
votes
0
answers
290
views
What is this function doing?
I have this function, named __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6__initEPKcm.
And this is the relevant assembly:
mov rdi, [rbp+var_A80]
mov rsi, [rbp+var_A88]
...
- 181
1
vote
0
answers
198
views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
2
votes
1
answer
809
views
Radare2 does not display the entire assembler code
I am trying to solve this ELF - Ptrace crack me. Here are the commands I use :
I start radare2 with the crack me as argument.
radare2 ch3.bin
I decide to go to the main and print the assembly code ...
- 221
0
votes
1
answer
1k
views
Combine various sub routines into one sub routine (IDA Pro)
Currently I am analyzing a .so file and there is a function which is supposed to be large (high number of nodes and edges). However, IDA Pro identified it as a small function, with various parts of ...
- 183
1
vote
1
answer
544
views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
- 203
1
vote
1
answer
4k
views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
- 11
7
votes
2
answers
2k
views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
- 143
3
votes
1
answer
889
views
Remove Binary from IDA Database
I saw the File -> Load File -> Additional Binary File option and tried it out. Now I want my original IDA database back (with just one binary), but can't afford to lose the comments I have saved ...
- 131
0
votes
1
answer
698
views
When to create a keygen versus when to bypass the security jumps
I am a newbie reverse engineer.
I was wondering: assuming I want to crack a program (With the permission of the author of course) and I have detected the Assembly where the program begins to check the ...
- 31
4
votes
1
answer
211
views
Is this Bignum multiplication of 2048 RSA number a Montgomery multiplication?
The below code snippets are some kind of bignum multiplications involving 2048bit numbers, possibly in the context of RSA decryption.
Does any one recognize this pattern?
Is it maybe some kind of ...
- 289