All Questions
30 questions
0
votes
0
answers
26
views
How to create ram and rom section IDA?
I have a binary linker descriptor for preloader.bin
ENTRY(_start)
romBase = 0x00201000;
bss1Base = 0x00102000;
bss2Base = 0x00267000;
stackBase = 0x00200000;
/* log_sram_buf + bss1 should be less ...
- 101
1
vote
0
answers
48
views
Unknown string encoding
I'm new to reverse, my question may be stupid.
I am trying to reverse a function in the application that reads a string at the address and concatenate it to another
char[250] v30;
char[20] v31;
...
...
- 11
2
votes
0
answers
538
views
calculate memory address from IDA to use with Frida
I saw an interesting value in IDA at address 0xf8766; I want to view the value at that address.
I debug an Android application with Frida, how can I put this address in Frida to watch this value?
I ...
- 41
0
votes
1
answer
107
views
Expanding .data section at particular area
I have a program which creates a hard-coded number of objects. I patched the binary so that now it can attempt to create more objects than the limit allows, however when it does it allocates them to ...
- 61
0
votes
1
answer
201
views
What is copy_block struct in Tricore Arch?
Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below:
ld32.w d4, [a0]-0x68D4
I know a0 = 0xD00032E0 but ...
- 147
-2
votes
1
answer
550
views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
- 147
1
vote
0
answers
315
views
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a ...
0
votes
2
answers
393
views
Is it possible to use a program's GUI abilities without the GUI?
Is it possible to use/call programs' GUI abilities directly without using the GUI (programmatically, not by keyboarding)?
For example, a program with abilities nested too deeply in cascading submenus:...
- 169
0
votes
1
answer
9k
views
How to use memory address information from IDAFree to set a breakpoint in x32dbg?
I have a DLL paused at EntryPoint in x32dbg. I am interested in examining memory following a specific API call that this DLL makes. I found the API call in the imports section when I open the DLL in ...
- 233
0
votes
1
answer
810
views
Can GUI elements of a running program be found/located in memory?
Is it possible for a particular GUI element of a running program (on Windows platform) to be located in memory, such as a text element from a dialog box? For example, locating title text of a drop-...
- 169
3
votes
0
answers
305
views
Telling IDA that all references to an address range belong to the same segment
For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
- 131
0
votes
1
answer
417
views
Building micro controller memory image in IDA
I have STM32F303 Nucleo board (Datasheet), and I work with Mbed IDE, which allows me to compile code to the board. The compiled code is in .bin format.
Some relevant information from the datasheet:
...
- 1,858
1
vote
1
answer
560
views
GUARD_PAGE memory breakpoints with gdb?
I came across a question the other day on reddit: How can we use PAGE_GUARD-based memory breakpoints in GDB (not hardware breakpoints)?
Ollydbg, x64dbg and IDA PRO all support these types of ...
- 463
5
votes
0
answers
270
views
IDA memory mirroring
I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF.
How do I setup IDA to recognise memory mirroring.
- 51
1
vote
0
answers
252
views
IDA map one memory address to another
I am trying to reverse engineer firmware for an embedded device. The memory region 0xA0000000-0xA1FFFFFF is mapped to 0x80000000-0x81FFFFF. How do I setup ida to recognise this?
- 11
3
votes
0
answers
1k
views
loading memory dump into ida pro?
I'm looking for a good method to load custom memory dumps (of usermode processes under Windows) into IDA Pro. These memory dumps may be partial or complete - in terms of other DLLs, such as kernel32, ...
- 101
2
votes
1
answer
1k
views
How to find out which instruction wrote to a specific address?
I'm not an expert in reversing and even though Googling is usually enough, this time I can't find a solution.
I have this program that calculates a value from some data it received from a server.
I ...
- 23
4
votes
1
answer
2k
views
Modifying address found through IDA
I'm trying to inject code into a small game I wrote to keep the health up forever, I want to do this by injecting code into the game that would set the health to 10 before each render() call, causing ...
- 173
2
votes
1
answer
521
views
What values do I use for Freescale ARM imx233 μP in IDA Pro “memory layout dialog” for RAM and ROM?
What is the memory address information I should plug into IDA for this BIN file?
GOAL:
To disassemble a BIN file extracted from firmware.sb
This BIN file contains the low level board initialization,...
- 123
3
votes
1
answer
568
views
How to find address of more complicated, unknown data structures
I am trying to read messages from a (32bit windows application) chat window. Unfortunately, the window has a custom class, therefore GetWindowText() doesn't help. I need to read the data from memory ...
0
votes
1
answer
177
views
Unexpected memory value MOVed from text segment to register in Windows x86 32-bit program
I am debugging a 32-bit program on a 64-bit MS Windows 7 using IDA Pro 6.8 as seen in the image below:
The instruction highlighted in the trace window (upper-left part of screen-shot) is supposed to ...
- 828
2
votes
1
answer
5k
views
Process Dumping and Ida
Up until now I've been performing static analysis using Ida and run time analysis using OllyDBG.
I've identified a function in Olly which I would like to start documenting further in Ida, however I ...
user15338
0
votes
0
answers
620
views
Getting "Access violation executing location" error
I am trying to execute this assembly function. But after calling Test_init function, I am getting "Access violation executing location" error at line "add esp,4".
sub_402110 proc near ; ...
2
votes
1
answer
2k
views
How can I make IDA start the analysis at imagebase?
I noticed that despite the imagebase for win32 executables be 0x400000, Ida Pro only starts the analysis at 0x401000. What is before that and how can I change IDA's settings to start the analysis at ...
- 207
3
votes
1
answer
340
views
Break on memory access on Android
I want to be able to monitor when a memory address is read from on Android. The binary I am studying stores around 60 bytes to a memory location during initialisation and this buffer is used at some ...
- 179
2
votes
2
answers
763
views
Redirecting/Remapping/Rerouting a Memory Access
I need a little help from you guys! At present, I'm working on an IDA Pro Database in order to create a patch for an executable, and I'm totally stuck on editing the following sub:
.text:008EC420 ; ...
- 185
3
votes
1
answer
2k
views
How to find memory addresses which are read from but not written to
Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses...
Is there any such functionality in IDA ...
- 203
5
votes
2
answers
482
views
Grouping functions based on their placement/order in the binary
Can I group functions based on their place in the binary? Can I assume functions next to each othe belong to the same logical group, or at least they have similar functionality? I suspect that the ...
- 2,038
5
votes
2
answers
1k
views
Automatic function naming
I'ld like to know how to bulk rename functions in IDA, based on some condition.
Example:
Rename all functions to Foo_XYZ where the function accesses a certain static variable, for example : ...
- 2,038
7
votes
3
answers
11k
views
Paste hex bytes into IDA Pro Hex View
Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
- 547