All Questions
Tagged with ida disassemblers
47 questions
1
vote
0
answers
129
views
How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?
I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
- 11
1
vote
1
answer
232
views
IDAPython doesn't recognize function
I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
- 121
2
votes
0
answers
220
views
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.
What ...
2
votes
0
answers
164
views
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
- 51
1
vote
1
answer
98
views
Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4
I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction:
from capstone import *
from capstone.x86 ...
- 1,560
1
vote
1
answer
176
views
Creating table with IDAPython
I'd like to create the table like below, I could not found any clue while googling it.
Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class?
Any advises would ...
- 153
1
vote
0
answers
108
views
Function Arguments/Name on Radare and IDA
I am starting with reverse engineering and Radare and I'm facing the following problem, on IDA Free I see the following code:
mov ecx, 11h
lea edi, [esp+1208h+StartupInfo]
rep stosd
lea ...
- 11
-1
votes
1
answer
861
views
How to understand the result of disassembling IDA Pro (dll x86_64)
I'm studying the dll that was built for x86_64.
I study where there are links to the function "call_f1_1806F3630" and do not understand three of them. Are these features of OOP? Help me ...
- 21
2
votes
0
answers
127
views
The method of searching for similar code in a binary file of a new release
Got into the hands of such a task. There are two dlls. As the second file was explained to me (new.dll) this is a new release of the first file (old.dll). Both files are compiled for x64. I need to ...
- 21
2
votes
2
answers
832
views
How to convert to float
.rdata:00414704 __real@c0800000 dd 0C0800000h
How to convert this value 0C0800000h to float point number?
- 363
1
vote
0
answers
56
views
Unrecognized function
There is function:
push 65h
push edi
call sub_5D8750
In this case, function takes 65 bytes to be filled with zeros, and edi is memory address starting from which to fill these 65 bytes with ...
- 363
12
votes
4
answers
6k
views
Why do reversers nowadays reverse engineer using decompilers and not disassemblers?
I see many reverse engineering lessons and every second person does reverse engineer using Ghidra decompiler and not disassembler as both are available in the same platform. I assume that reversing ...
- 323
2
votes
1
answer
510
views
The Knowledge of Compiler for becoming a good Reverser
I just reached the the topic of Compilers in the book "Reversing:Secrets of Reverse Engineering" So, I want to ask, is the knowledge of Compilers necessary for becoming a Malware Reverse ...
- 323
0
votes
1
answer
127
views
Visual c compiler options
I ask if exist some c compiler option that can "keep" some imformation after compile that can be visible when I disassamble with IDA.
This because I need to find a particular funciton with ...
- 289
0
votes
1
answer
955
views
IDA pro 7.5 - No previous fonts / color imports
For the past few years I've been using an ida color scheme which I created, that was very easy on my eyes with the previous versions of IDA Pro (<7.0). However, after start using version 7.5 I ...
- 395
1
vote
0
answers
185
views
Lexer and parser for .asm file produced by objdump
Is there any existing project that parses the x86 disassembly file or .asm produced by the objdump or IDA pro using the lexer and parser library in python or any other programming language?
- 11
2
votes
1
answer
2k
views
IDA/HexRays: how do I retrieve the memory address associated with a given line of decompiled code?
I'm trying to programmatically link decompiled code generated by HexRays with the disassembly code of a given binary by mapping memory addresses between the two. The mapping exists, as I can see view ...
- 21
2
votes
1
answer
49
views
Two copies to store values
I have this a piece of code, disassembled DX:
.text:004386D3 push ecx
.text:004386D4 fld1
.text:004386D6 fstp [esp+26Ch+var_26C] ;load 1.0 value ...
- 363
3
votes
1
answer
80
views
x86 disassembly confusion regarding VESA functions
I'm trying to disassemble an old DOS application and got stuck at some point of the VESA graphics handling.
The VESA function to be called will be stored in a global variable, e.g. ...
- 67
7
votes
2
answers
2k
views
Reverse engineering Windows Defender's signature for Metasploit Framework's metsrv.dll
As a pentester for a consulting agency, it is part of our job to "evade" antivirus after gaining code execution on information systems. It is indeed necessary to prove exploitation of vulnerabilities, ...
- 143
1
vote
1
answer
871
views
Know which bytes are opcode and which operands in IDA
I want to extract a generic signature of a function in IDA and wanted to use just the opcodes of the instructions without its operands.
Example:
From the first instruction I want to know the bytes ...
- 243
2
votes
1
answer
263
views
Can I step through a binary with IDA (eval version), reading registers step-wise?
I am new to disassembly, and I'm trying to understand how a 32 bit binary is operating. I have the evaluation (free) version, 32 bit (Version 7.0.170920 macOS x86_64 (32-bit address size)).
I'm used ...
- 121
-1
votes
2
answers
964
views
extract opcodes using radare
When we have many binaries, there is a python base solution for disassemble and extract opcodes from binaries in IDA program.
Is there any or similar solution to disassemble binaries for Radare2?
0
votes
1
answer
300
views
IDA Python recognize same register
As shown in the picture below, IDA PRO (6.8) knows to recognize that al and eax are referencing the same register.
Given two operands in IDA Python (i.e. by idc.GetOpnd(..)), how can I find that ...
- 1,858
8
votes
3
answers
5k
views
idapython - Get Xrefs to a stack variable
I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so.
What I am trying to achieve is a code ...
- 337
1
vote
1
answer
1k
views
MSP430 - IDA Pro Free Binary Dump
I have a assembly dump from a MSP430 binary in a normal ascii text file as below:
46f4 <strcpy>
46f4: 0d4f mov r15, r13
46f6: 023c jmp #0x46fc <strcpy+0x8>
46f8: ...
- 111
4
votes
1
answer
1k
views
Is it safe to load a virus to IDA Pro?
In other words, Is it safe to load a malware into IDA Pro on my personal machine? Would IDA Pro run the sample or load it into memory?
- 135
1
vote
1
answer
713
views
Understanding the variables in stack layout
i am reading the "The Grey Hat Hacking-The ethical hacker's Handbook".The book is nice ,but there is a doubt on a particular subject.In the vulnerability analysis chapter it is trying to analyze a ...
- 119
3
votes
1
answer
606
views
IDA Pro addresses of arguments
I am a newbie in reverse engineering and I was trying to understand this blog post:
http://0x0atang.github.io/reversing/2015/09/17/flareon2-concolic.html
At one point, the author says the following ...
- 131
0
votes
0
answers
51
views
What does the number after '@' symbol mean in IDA disassembly? [duplicate]
As you can see, IDA disassembly shows r0@1, r5@5, [sp+0h] [bp-18h]@7 etc. Presuming r0, r5 to be registers and [sp+0h] [bp-18h] to be a memory location, what does the number at the end signify?
- 1,381
5
votes
2
answers
5k
views
idapython - Determine if item is code or data
I need to determine whether an IDA's item is code or data.
Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff).
So in IDA, you can sometimes see ...
- 337
2
votes
2
answers
4k
views
How to Find All Switch Jump Tables in IDAPython
I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly:
jmp ds:off_65018790[ecx*4] ; switch jump
...
- 133
2
votes
2
answers
1k
views
Radare2 to show code hints like IDA Pro?
I am trying to disassemble a binary with radare2, as a free alternative to IDA. Here is how the IDA disassembly of that section looks like :
Here is what I am doing with Radare2 (with an additional ...
- 23
3
votes
2
answers
2k
views
Is there a tool to scan for code / functions that can account for different compilers?
I have a library DLL and a program that uses the library (statically; the DLL is separate).
My goal is to find a bunch of the functions from the library in the program, but unfortunately, it looks ...
- 185
4
votes
1
answer
2k
views
Limitations of capstone's disassembly capabilities compared to IDA
I was wondering if there are any limitations of capstone's disassembling capabilities when compared to IDA.
If yes, are those limitations inherent, i.e. a result of the different design/techniques ...
- 1,560
-2
votes
2
answers
1k
views
Reverse Engineering iOS Apps on a Mac OS X
I want to learn to Reverse Engineer iOS Apps. I know exactly what I need to do and I've got almost everything set up. My iPhone is jailbroken, I have installed OpenSSH to SSH into the iPhone from my ...
- 111
6
votes
1
answer
2k
views
Call to an imported function in a PE file: Why is destination prepended with ds (call ds:func_name)?
In windows PE files (32 and 64 bit) calls to imported functions look like this in IDA PRO:
call ds:SetEvent // default setting
call [ds:SetEvent] // Target Assembler set ...
- 1,560
2
votes
1
answer
613
views
Need to recover C++ code from binary of server and client
We have an old 2D space shooter multiplayer game community form late 1990s. The game is still alive today but the problem is the creators of the game are no where to be found and the source code is ...
- 121
1
vote
3
answers
597
views
IDA SDK Extract Offset From Instruction
get_screen_ea( ) is ==
.text:000000014000B065 mov cs:qword_142167D38, rcx
Is there a function in the SDK to extract qword_142167D38? Preferably as a hexadecimal value rather than a string.
- 81
4
votes
5
answers
6k
views
How do you compare C source code with the corresponding binary's assembly in IDA Pro?
I'm wondering if there's a way to compare source code to the disassembled assembly in IDA Pro? (e.g. I compile hello.c in Linux then open the binary in IDA Pro in OS X, and would like to compare the ...
- 173
32
votes
5
answers
12k
views
Why there are not any disassemblers that can generate re-assemblable asm code?
I am struggling on this problem for around three months:
How to use disassemblers (IDA Pro and others...) to generate re-assemblable asm code and assemble it back
My experience is that:
There is NO ...
- 2,485
3
votes
1
answer
2k
views
What is the meaning of this code generated by IDA Pro?
Test platform is Linux 32 bit.
I use IDA Pro to disassembly the basename from coreutils 8.5
compiled by gcc 4.6.3
Here is a code snippet generated by IDA Pro
call ...
- 2,485
6
votes
2
answers
10k
views
What is the difference between static disassembly and dynamic disassembly?
I am told that tools like IDA Pro are static disassembly tool,
and tools like OllyDbg are dynamic disassembly tool.
But from the using experiences on these tools, I don't think there
is any ...
- 2,485
5
votes
2
answers
3k
views
Do disassemblers detect standard functions?
Do disassemblers detect the use of C/C++ standard functions and specify them in the output code, adding the #include line to the appropriate header file (such as stdio.h or even windows.h)?
If not, ...
- 403
11
votes
3
answers
113k
views
How to obtain x86-64 pseudocode in IDA Pro?
Does anyone know about obtaining pseudocode for x86-64 in IDA Pro? I already tried the Hex-Rays plugin to obtain pseudocode, but when I try it, the following error pops up: "only 32bit code is ...
- 119
4
votes
1
answer
576
views
OS X Power PC RE tool (debugger/disassembler)
So I want to know is such tool exist without counting IDA PRO. And is there any GUI version of it if exist - because I really don't want to debugging with terminal. My OS X version is Snow Leopard. I ...
- 431
338
votes
16
answers
424k
views
Is there any disassembler to rival IDA Pro?
Is there any disassembler (not only a live debugger) second to IDA in capabilities? IDA is wonderful, and somewhat amazing in how robust and useful it is for reversing. However, it is quite expensive ...
- 4,198