All Questions
81 questions
1
vote
2
answers
111
views
IDAPython: Getting all arguments passed to function
I am working on getting two specific arguments from a function that is called around 1000 times in an executable. Is there any way of looping through all XREFs that reference the function and print ...
- 13
0
votes
0
answers
65
views
Hexrays - Enhance decompilation of "pre-multiplied" array indices?
For this x86 (Watcom 1997) assembly that loops over an array, Hexrays yields the following pseudo code:
lea eax, ds:0[ecx*4]
add eax, ecx
shl eax, 3
mov [esp+310h+iMulSize], eax
mov ...
- 1,103
4
votes
0
answers
1k
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 195
4
votes
1
answer
277
views
How to force IDA to show size of pointer dereference?
IDA's default x86 assembly syntax is not very clear about pointer dereferences. One of these is dereferencing the memory operand, and one is simply moving the address to the register:
mov ecx, ...
2
votes
0
answers
88
views
jump to invalid address when emulating
I am currently working on a deobfuscation tool for a Windows Driver (which is obfuscated). I am using Capstone to disassemble and Unicorn to emulate. I have run into a weird issue where the indirect ...
- 41
2
votes
1
answer
578
views
x86 - How do I detect virtualized code by looking at the assembly?
How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
- 69
3
votes
1
answer
983
views
What is the meaning of jmp dword ptr off_XXXXXXXX + 8 in IDA?
What is the meaning of this kind of jmp instruction in x86 assembly in IDA?
Does it mean that we should jump to the address [6CA2E9B0] + 8 or [6CA2E9B0+8]?
When I follow that off_XXX, I get to the ...
- 31
1
vote
2
answers
369
views
IDA decompiler syntax: for function int __usercall sub_45BD46@ <eax>(char a1@<bl>, int a2@<esi>, int a3)
I have a function with the following header sub_45BD46@eax(char a1@bl, int a2@esi, int a3), my question is: I am right that sub_45BD46@eax means the result value is in eax?
- 69
1
vote
1
answer
351
views
List instructions to fix wrong IDA analysis
I don't want to get too much into detail, but a disastrous chain of events that began with a boolean of incorrect size forced the IDA analyzer to discard a lot of instruction sections of many ...
- 197
1
vote
1
answer
870
views
IDA Pro - configure register clobbering
TL;DR:
The __fastcall convention in IDA Pro assumes that all the registers which could be used for transferring parameters are clobbered after a call (tested on x86, clobbered regs are eax, edx, ebx, ...
- 23
1
vote
2
answers
2k
views
Can't figure out a crash in IDA "The memory could not be read -> 00000710 (exc.code c0000005, tid 20612)"
I'm trying to debug out a game. Basically, the Steam version works perfectly but the GOG version (which is 8kb smaller) has an annoying problem where for some people (which happen to be me) the game ...
1
vote
2
answers
185
views
Why eax is assigned to 'variable looked' like addresses
#include <stdio.h>
int main() {
int number1, number2, sum;
printf("Enter two integers: ");
scanf("%d %d", &number1, &number2);
sum = number1 + ...
- 323
0
votes
3
answers
1k
views
Order of arguments in __usercall
I have the following function with five arguments:
; int __cdecl trampolineRegister(void)
a4= dword ptr 8
a5= dword ptr 0Ch
push ebp
mov ebp, esp
add eax, ...
- 1
3
votes
1
answer
4k
views
Can I use python3 with IDA 7.0?
Got IDA Pro 7.0 (I can't update at the moment),
I'm currently unable to use idapython.
I have python3.8 installed on my machine and nothing else (I dont want any collisions).
How can I use make ...
0
votes
1
answer
236
views
What is this line and how to remove it
I tried to unpack packed_dll, when the unpack stage done, i dumped unpacked_dll out and start to reverse. I pretty sure this is continuously function of that dll but this line show up. So what is this ...
- 67
3
votes
2
answers
3k
views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
- 41
1
vote
1
answer
211
views
Displaying Operands as Position Independent in IDA
I'm writing an IDA python script, and i need to be able to detect position independent code. I have an instruction that IDA displays using the operand name 'format'
lea rdi, format
However, when ...
- 13
2
votes
2
answers
123
views
X86 access to global strings pattern
While reversing some x86 executables, I came across a pattern of addressing globals, that I don't familiar with, but it looks like IDA is, and I would like to know more about it.
.text:00002560 ...
- 1,858
1
vote
0
answers
315
views
IDA shows MEMORY or unknown references on C std library calls (memset, memcpy, etc.)
I'm currently reversing a Linux 32-bit executable (with a statically linked library included in it) but I'm having a little problem I can't find a solution for.
Basically whenever I stumble across a ...
5
votes
2
answers
499
views
BIOS first jump leads to empty memory
I'm trying to reverse a BIOS of an industrial PC in order to repair it. The device is based on an ETX-formfactor mobo, obscure Italian SECO M671, very similar to an old Kontron PM-15(C), but with a ...
- 63
1
vote
1
answer
255
views
ELF file crashing after executing shellcode
So after changing the entry point via the e_entry field I managed to execute my shellcode before returning control to the original entry point. Here's how I did it:
// write string and jump to OEP, ...
- 437
2
votes
1
answer
291
views
Why is IDA showing three arguments for the main function instead of two in some linux binaries?
So I am reversing an ELF binary, now from my knowledge in C the main function has two argument, argc and argv
but some linux binaries that i am reversing have 3 when i decompile them! one int and ...
- 232
1
vote
1
answer
114
views
Finding a mathematical calculation which uses Pi within binary
Given a large (~14MB) binary compiled for a X86 64-bit system, what would be the basic steps to go through in order to find the usage of Pi (π) for calculation of a certain parameter (flag)?
I'm ...
- 13
0
votes
2
answers
695
views
IDA Pro, replace exit() with continue;
This is the function:
loc_BA060: ; status
xor edi, edi
call _exit
How can one replace exit with continue?
- 23
2
votes
1
answer
889
views
Can Ghidra do backward symbolic execution?
I am searching for a tool which can do backwards symbolic execution on x86 binaries. More specifically, I would like to give the tool a program state(PC value + registers + memory content) and have it ...
1
vote
1
answer
479
views
Find Reference To Resource String In Windows 3.1 16-bit DLL with IDA Pro
Experimenting Visual Basic 4 in DosBox + Windows 3.1 running on Windows 10. While I have installed SHARE.exe from MS-DOS 6.22 and it seems to run OK, it still fails to detect it.
The error I get is : ...
- 1,267
1
vote
2
answers
592
views
Dealing With x86 Segmentation Overlaps
I load my project into IDA 7 and select 8086 as this rom is a 512kb in the high address space. I apply an offset of 0x80000 and it loads properly.
I then go to 0xFFFF0 and find a far jump to 0xFDAF:...
- 173
1
vote
1
answer
424
views
Weird IDA/Decompiler floating point output
I stumbled upon this (reduced for readability) function. It does weird things that I have never encountered before.
// a2 is always 60.0
void some_function(struct_123 *this, float a1, float a2)
{
...
2
votes
1
answer
3k
views
Finding address in IDA from address found in Cheat Engine
I found a pointer's address, 0x485FE058, in Cheat Engine. However, when I load up the exe in IDA, the addresses are smaller and start from 0x00401000. I read up somewhere that this was called virtual ...
- 21
2
votes
0
answers
326
views
IDA Hex-Rays Decompiler Generates ASM Code Issue
For a long time now, I've been struggling with some functions generated with IDA HexRays plugin that seem to be corrupted.
Some of the decompiled generated plain C code, show as ASM code :/
i.e:
...
1
vote
0
answers
339
views
Is there a way to generate a PE from a web assembly module?
I am in the process of analysing a large web assembly. I have the compiled .wasm file and using the tools available I can convert this to a .wat text representation. Currently, I am doing the ...
- 11
0
votes
1
answer
172
views
Why Ida pseudo-code translate test as AND?
In IDA when disassembling a x86 EXE file there is a line
test byte ptr [ebp+XXX], cl
Before this line cl has a value of 0x11
The Hex-Rays decompiler plugin translates it as if (v10 &0x11).
Why ...
- 27
1
vote
1
answer
544
views
IDA - large jump table, missing cases in analysis
I have come across the following jump table with a large amount of cases (160+). There seems to be cases missing from IDAs analysis though. For example it skips from cases 22 -> 38 -> 91, and I can ...
- 203
1
vote
1
answer
644
views
IDA Interpreting mov instructions in a unusual way
When analysing mach-o binaries IDA seems to interpret const/literal part of x86 mov instruction(0x8B) as an offset.
Hex rerpresentation: 8B 40 0A
Correct assembly: mov eax,DWORD PTR [eax+0x0A] ; 8B ...
- 11
1
vote
1
answer
699
views
What purpose of MOVZX EAX,AX after MOVZX EAX, WORD PTR [RBP+ADDR.SA_DATA]?
I thought it was strange when I was looking at the code below. The first instruction clearly has completed the task of data transfer and expansion into 16 bits. Why is there a "mov Eax,ax" in the ...
- 13
1
vote
1
answer
432
views
While loop function disassembly x86
I am trying to convert this binary to C but I am having trouble with the while loop. What does
sub esp, 8 mean? as well as push [ebp+_a] ? I am able to get the esp 8 sometimes while changing the ...
- 21
1
vote
0
answers
936
views
IDA 7 handling strings in debugger pseudocode
When running a remote debugger to a linux server, is there a way to get IDA (7.0) to properly handle strings? When I go to the pseudocode view, I get things like this;
v7 = sub_804AD60((std::string *)...
- 215
2
votes
5
answers
30k
views
Older versions of IDA free?
I'm looking for an IDA free version previous to 7.0 so I can use it in x86 systems, the current one being only x64, but can't seem to find one and it doesn't look like I saved one neither.
Does ...
- 61
1
vote
1
answer
138
views
Data moved after program rebase
Consider the following piece of code:
.text:00F74B42 call sub_12D1130
.text:00F74B47 mov eax, dword_15A0C80
Now, I want to add a sanity check but as I don't have enough space to do that I ...
- 21
5
votes
1
answer
2k
views
What's the meaning of dword_XXXX and offset dword_XXXX in IDA?
Consider the following code:
In C++:
SomeClass* globalPointer; // we don't know what it points to, but it's not null a pointer, it's initialized
void someFunction()
{
globalPointer->...
- 175
0
votes
1
answer
121
views
Keygenme - Key location
So I was messing with an interesting keygenme, written in C++, which derives the key based on the values of the OSINFO structure. Now, when checking for a valid key it uses the following instruction:
...
- 437
1
vote
1
answer
2k
views
How to move one step back in a debugger
When I debug a .exe file on Windows with IDA, I do it step by step.
Can I move one step back and reset all the registers and stack to what they were one instruction ago?
By the way, when I'm looking ...
- 533
2
votes
2
answers
3k
views
What is the difference between Windbg and local debugger in IDA
When I want to debug an .exe on Windows with IDA I can choose between Windbg or local debugger.
What is the difference?
By the way, is there any difference if I use Windbg tool (windows software) ...
- 21
2
votes
1
answer
185
views
How to identify when a function is being called using IDA?
I'm debugging a .exe file on Windows with IDA's debugger.
How can I identify when the code calls the random() function?
- 21
4
votes
2
answers
2k
views
How do you look for a a particular value at address in IDA
So, I was trying to load some binary and in the main function, I saw instructions such as
mov edi, [esi+1Ch]
...
lea eax, [esi+18h]
So, what are these values at [esi+1Ch] and [esi+18h]. How do ...
- 41
2
votes
1
answer
387
views
What does __return_ptr do in IDA?
Let's say I have this program:
struct A {
int x;
};
struct A func1(int z) {
struct A result;
result.x = z+1;
return result;
}
int main() {
return func1(1).x;
}
When compiling ...
- 123
4
votes
3
answers
3k
views
IDA: add segments without losing data
I'm browsing an old 80186 BIOS ROM in IDA free. I have loaded the binary file at the correct address and created one big segment for the entire thing since I knew nothing about the internal structure.
...
- 55
5
votes
1
answer
2k
views
How to specify stack-based return values in IDA Pro (GoLang)
tl;dr: I am reversing a GoLang 1.10 executable, compiled for Windows. I am trying to make IDA correctly recognize the calling convention.
Details: I am looking at an x86 executable where the ...
- 61
1
vote
1
answer
1k
views
Hex-Rays can't parse switch (bad target for case)
I need to add new case, so here is that I do.
Copy the jump table for switch statement to 0048199C and add new ref to 4819C0.
Add new instructions below
Set new address 0048199C
In the indirect ...
- 21
1
vote
2
answers
163
views
How is the IV generated from a timestamp based on this function?
Background: I am currently looking to make some diagnostic software interoperable with other software, but all communication that occurs in this software is encrypted with AES-128-CBC. A sample ...
- 13