All Questions
Tagged with ida static-analysis
56 questions
1
vote
0
answers
112
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 33
3
votes
1
answer
2k
views
How do I reverse an exe packed with an unknown packer?
I got an assignment to analize an exe file with 97% entropy. It's obviously packed but I got no results from Protection Id or PEid about which packer it used...
How can I unpack it if it's possible? ...
- 33
3
votes
1
answer
474
views
Automatically name class methods in IDA
Let's say I have:
mov ecx, [g_pMyClassObj] ; type CMyClass
call sub_B00BA ; a thiscall function
Is there a feature/plugin/script to automatically rename all subroutine occurrences to:
mov ecx, [...
1
vote
1
answer
313
views
Static Code Analysis of a C166 function
I am trying to understand a piece of code, working on a C166 MCU. IDA correctly loads and displays the disassembly. Below is the code snippet I am trying to analyze. I don't understand the following ...
- 61
0
votes
1
answer
128
views
How to detect incorrectly named DLL?
I am trying a simple lab on malware analysis and we were given both an .exe and .dll file.
However, I am told that the DLL will need to be renamed to something for it to work.
How do I go about ...
- 1
2
votes
1
answer
368
views
Split variable in Ida Pesudo Code
Sometime the meaning of variable has been changed on the function.
For example from Ida pseudo code:
a = price
....
a= tax....
In the beginning of function a was price and after that a is tax.
How ...
3
votes
1
answer
517
views
What is "nullsub_XXX" in vtable in IDA
When I looking in a vtable structure in IDA pro, I know that ___cxa_pure_virtual means that the function is virtual.
But what does nullsub_XXX mean in a vtable structure?
- 183
1
vote
0
answers
369
views
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,
now its type is char[25] due to inclusion of ...
- 11
2
votes
1
answer
500
views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
0
votes
1
answer
495
views
What does this function do?
I'm trying to understand what client sends to server. I already did most of the work, but one function left. I can't understand what to do with this function and what it does. I've tried to change ...
- 1
1
vote
0
answers
698
views
IDA script: How to properly undefine a byte and then redefine code
I'm trying to correct the following instructions in IDA using a script:
jnb short near ptr loc_1C61B1+3
It order to do this I'm running a snippet like this in a script:
ida_bytes.del_value(...
- 203
0
votes
1
answer
159
views
How to simplify a function "calling itself's reference"
I encounter often a function calling itself (in the pseudo code) such as:
result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda);
Since the disassembly is call qword ptr [...
- 123
0
votes
1
answer
188
views
Is it possible to make a dynamic memory allocated .data segment to static in a file?
Sorry if this is a dumb question I'm new to assembly.
Basically I want to modify a function in a .exe file to return with a different data, but my issue is that the memory location of the data segment ...
- 3
1
vote
4
answers
691
views
finding sequence of opcode in binary
I have dis-assmebled binary and want to check if it contains particular sequence of opcodes(obtained from other reference binary). how to do that . i know plain byte
level comparison wont work as as ...
- 11
1
vote
1
answer
367
views
How can I find a value in Tricore(TC1766) Arch?
I recently work on Tricore Processor, but I have some problems.
With reading memory value. I do not know if I am right or not, but I think a part of flash memory copied to RAM and now in my algorithm ...
- 147
2
votes
0
answers
202
views
CRC16 Reverse in C166 Arch
Before that I asked about piece of code that used in this algorithm (here). Now I have a bit problem with the rest of algorithm.
So I have to describe this with detail. Sorry if i vast your time for ...
- 147
-2
votes
1
answer
550
views
The C166 family code meaning
What the meaning of this code with an explanation?
sub_37C2:
mov r5, r4
shr r5, #14
shl r5, #1
mov r5, [r5+0FE00h] ; DPP0
bmov r4.14, r5.0
bmov r4.15, r5.1
shr r5, #2
rets
; ...
- 147
0
votes
1
answer
236
views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
- 67
0
votes
1
answer
842
views
ida identifies library function as regular function
I'm trying to find libc symbols in some Windows 32-bit application. For some reason, Ida autoanalysis didn't recognized code that comes from libc as "library function", but as a "regular function". ...
- 103
0
votes
1
answer
4k
views
Find functions signatures in Ida?
I didn't understand the subject of find function in Ida via signature.
If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
1
vote
1
answer
622
views
How to extract static API sequences of a PE file?
How does one extract the static API sequences of a PE file? I don't mean the imports listed in the imports segment.
I am currently using different RE tools like Ghidra, IDA Pro, and Binary Ninja. ...
- 27
1
vote
0
answers
105
views
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
- 63
0
votes
1
answer
371
views
Detecting libc function with IDA
I have binary than running on Arm , static and striped.
I don't know which compiler compiled this binary.
How can I identify function like fread sleep printf ioctl
1
vote
1
answer
385
views
Memory map in AVR Harvard architecture
In this video https://youtu.be/D0VKuZuuvW8?t=259 .
You can see that flash address is beteen 0x0 to 0x3fff. and Data memory ( Io register and SRAM ) is between 0x0 to 0x8ff .
So in the video he ask ...
- 41
0
votes
1
answer
370
views
IDA Change ram and rom without reopen IDA
when I open binary and write ram and rom , I don't know how to change it (and re parse all the binary) without close and open again the binary.
Is there any smart way ?
- 41
1
vote
2
answers
2k
views
Why Windows Defender is not able to get rid of this trojan?
Every time I start my PC, Windows Defender shows a notification saying that the virus Trojan:Win32/Ceprolad.A was deleted, which means indeed that it wasn't, as most antivirus I've tried these days (...
- 61
1
vote
1
answer
114
views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?
I'm ...
- 13
2
votes
1
answer
620
views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
- 21
1
vote
2
answers
278
views
Trouble when reverse engineering a industrial robot software in order to get some values
For the bit of background, I'm a robotic engineer.
Robotics manufactures hide some parameters of their robots in order to avoid their competition. Now, I need these data to compute the dynamics model ...
- 11
2
votes
1
answer
1k
views
Identify function in cpp static binary
When I open cpp static binary, how can identify known functions like fopen/ioctl/printf? They have been compiled statically into the binary.
I dont know the compiler of this binary .
- 533
1
vote
0
answers
425
views
Saving IDA Graph to PDF format?
I want to save flow/call graph of IDA into a pdf format so that I could view it in my android. How can I do that?
I know IDA can generate a flow chart (gdl file) and call chart (gdl file). But my ...
2
votes
1
answer
1k
views
Debugger Win32 Local vs WinDbg in Ida vs Ollydbg
When I do dynamic analyze of exe file I have few option , and I want to know what are the advantages and disadvantages.
I know that Ida designated for static analyze , but there are some debugger in ...
1
vote
1
answer
544
views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
- 203
1
vote
1
answer
164
views
Windbg's "dt" equivalent in IDA?
I wanted to ask whether there is a simple way to see an object's structure (like windbg's "dt" command equivalent)?
Assuming of course I have the pdb file.
Thank you :)
0
votes
1
answer
2k
views
Parsing .rodata (ELF)
IDA pro is able to display the data contained in the read only data section of ELF files, but the section is defined as type SHT_PROGBITS.
To my knowledge, we cannot parse sections of this type to ...
1
vote
1
answer
198
views
IDA search results not showing up in a separate window
I'm just learning to use IDA and according to the book, when using Search function (Search>text..., for example) I should see a window with the found results, like this:
However, when the search ...
- 197
3
votes
2
answers
1k
views
How to get elf header via IDAPython?
In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the ...
- 115
1
vote
2
answers
165
views
Automated Branch Input Generation
Theoretically it should be possible for a binary analysis tool such as IDA to generate an input that will trigger a specific branch patch. So for example an executable that takes in a command line ...
- 233
1
vote
1
answer
291
views
IDA Hex-Rays Generating Redundant Code
Hex-Rays generated C code is adding a lot of redundancy code, and I cannot figure out why and it really frustrates me to remove them manually on my reverse engineering process.
if ( v1 )
{
v15....
- 113
2
votes
1
answer
2k
views
How to search sequence of API call using IDA Pro?
I want to search the sequence of API call using IDA Pro. How to search the API call node execution and what is the next API call node execution followed using IDA Pro.
- 141
3
votes
1
answer
178
views
16 bit Dos string concat function
I just got into reversing, i'm a bit puzzled by a part of the following code.
I know what its doing, from a technical aspect, but i don't really understand why its doing it.
This is the part I have a ...
- 133
0
votes
1
answer
5k
views
Red addresses in IDA Pro
I know that red addresses means, that code do not recognize as a function in IDA, because that code never get called.
But I have found a piece of code that is marked red, but when debugging, I saw ...
- 187
1
vote
1
answer
512
views
finding a checksum function using static analysis (IDA)
I have an dll that is loaded into a 64 bit process, it performs two check sums (at least) one to keep up to date (it receives a 13 character long string from the net which I'm fairly certain is an in ...
- 43
3
votes
2
answers
4k
views
IDA Pro: Side effects or disadvantages of "Create function"
Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot.
Yet, one can right-click such 'function-...
- 1,560
3
votes
1
answer
10k
views
Searching for a sequence of instructions in IDA Pro
How can I search for a sequence of instructions in IDA Pro?
I did manage to search for a single instruction using text search string li.*r4.*-1 (for instruction li r4, -1), but I failed to match ...
- 227
5
votes
1
answer
6k
views
How to create a IDA FLIRT signature for a PPC library?
I'd like to create a IDA FLIRT signature for the following PPC uClibc library:
libuClibc-0.9.15.so: ELF 32-bit MSB shared object, PowerPC or cisco 4500, version 1 (SYSV), dynamically linked, for GNU/...
- 227
1
vote
1
answer
263
views
Is there anyway I can iterate all the C-level statements in IDA-Pro?
I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program.
Suppose I only consider these statements:
State :: =
| if-else cond;
|...
- 2,485
4
votes
1
answer
2k
views
What is the benefit or reason of using a static disassembler over a dynamic disassembler in terms of malware analysis?
I know that
Dynamic program analysis is the analysis of computer software that
is performed by executing programs on a real or virtual processor.
while
Static program analysis is the ...
2
votes
2
answers
2k
views
Detecting epilogue/prologue of functions [closed]
I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
- 41
3
votes
1
answer
2k
views
How to find memory addresses which are read from but not written to
Analysing a bootmanager : I'm trying to track all variables which are only read from, and not written to... which will give me the external variables it uses...
Is there any such functionality in IDA ...
- 203