All Questions
2,164 questions
3
votes
1
answer
1k
views
Unable to perform remote debugging with IDA Pro in WSL
I have installed Ubuntu 20.04 under Windows Subsystem Linux 2 and I want to perform some remote debugging with IDA Pro.
As with other VMs I have used, I can perform remote debugging when send the ...
2
votes
0
answers
93
views
Why isn't IDA Freeware using my .idt file?
I'm trying to learn my way around IDA and using the IDA Free package. I've been trying to analyse a program that imports mfc140 which IDA Free doesn't ship signatures for.
I've loaded the .dll myself ...
- 121
2
votes
1
answer
263
views
Disassembling MS DOS code
cseg01:0001F4D8 mov Disk_Letter, 43h ; 'C'
cseg01:0001F4DF
cseg01:0001F4DF loc_1F4DF: ; CODE XREF: sub_1F4C8+60j
cseg01:0001F4DF xor ...
- 363
1
vote
1
answer
140
views
What this code do?
I decompile old dos game (WATCOM compiler). I do not understand code after calling localtime. What calculations performing after calling localtime?
cseg01:00020F60 sub_20F60 proc near ...
- 363
2
votes
0
answers
712
views
Windows kernel debugging using IDA & WinDbg
I am currently trying to set up WinDbg with IDA 7.7 to perform kernel debugging. My host machine is Windows 11 22H2 64-bit, the target is a Windows 10 22H2 64-bit VM (VMware). Connection method is ...
- 151
2
votes
0
answers
102
views
Is it no longer possible to re-order structures in IDA?
In older versions of IDA, you could right-click a struct in the structure view and change its position in the list, making it easier to separate "internal" vs "external" structs. ...
- 121
4
votes
2
answers
651
views
IDAPython set name of function using string passed to debug logging subfunction
IDA Pro 7.6
Static disassembly of ARM executable.
This binary has 40K functions or so, and no symbols. So all the functions are sub_49FFA etc.
However, 90% of these functions have a call to a debug ...
- 83
1
vote
0
answers
95
views
Program Analysis on a Wargame Binary
I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
- 11
3
votes
0
answers
92
views
Where can I find documentation for IDA Freeware?
I have looked at the official documentation page and it doesn't have an entry for IDA Freeware. Is it available at all? Is there a popular unofficial one? Do I just read the one for IDA Pro?
- 131
4
votes
1
answer
139
views
Windows 11: Interact with IDA pro when running in session 0
I am trying to debug a windows service, so I set IDA as the debugger of that service.
But since services are running in session 0, I can't interact with IDA. Also in the latest windows version (e.g. ...
- 53
2
votes
0
answers
75
views
How to deal with msvc runtime integrity?
After any type of patching image code the app cannot properly initialize the window specifically on the user32!CreateWindowExA call. PDB file shows it's vc2010\x64\Release.
I'm actually newbie in ...
2
votes
0
answers
90
views
Tracing odd variant of call analysis failed
Disclaimer before I get flogged: I'm playing with a commercial app, for which I have a license, for my own education because building toy C apps has run out of challenge (and I know whats inside).
...
- 215
4
votes
2
answers
167
views
Reversing rodata
I'm playing with an ELF binary to learn IDA, and I'm not sure how to interpret what I'm seeing..
A function calls this:
v1 = MList[2 * result];
When I look at MList, it looks like this:
public MList
...
- 215
2
votes
0
answers
200
views
Find decryption key of coco2d lua
I am trying to find the encryption key for a lua file from a .so file
But I am new in this field. I visit websites and found that key is inside xxteaDecrypt function I found two xxteaDecrypt function.
...
- 21
3
votes
0
answers
40
views
How to view a QJsonValue while debuging exe with IDA
I'm step by step debugging a program in IDA.
The program uses the Qt-toolkit.
The function that I'm stepping through is handling a json document.
For example here it is accessing the key workgroup and ...
- 31
2
votes
2
answers
236
views
What does the function code do
What does this code do?
.text:0048EBCD mov ecx, dword_4CEAC8
.text:0048EBD3 mov edx, dword_4CEACC
.text:0048EBD9 mov [ebp+var_4], eax
.text:...
- 363
1
vote
0
answers
77
views
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).
Thus I changed it at first Hex Editing using HxD ...
2
votes
2
answers
176
views
Is there any easy way to define a field in big struct by IDA?
By tracing malloc or similar memory allocation functions, I got a huge struct.
Initially, since I didn't know the intent of the various fields of the struct, I defined it with a byte array.
struct ...
- 223
2
votes
1
answer
113
views
IDA mov dword ptr with non-existent addresses
This might be obvious, but I'm baffled.. I opened a random .so library to poke around and learn IDA a bit better, and I hit something I've never seen. IDA has these instructions:
mov eax, [esp+4Ch+...
- 215
1
vote
0
answers
524
views
Access RTTI class hierarchy along with offsets from IDAPython
Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI.
When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
- 268
3
votes
1
answer
503
views
How to select sequence bytes in IDA Pro Hex View?
As you see below gif, I can't select the sequence bytes what I want, the selections range is a rectagle, it's against humanity. How can I select sequence bytes?
Annotated variant of the above (...
- 223
1
vote
1
answer
239
views
Reuse pseudocode tab when decompiling in IDA
When I press F5 in IDA to decompile, it always opens a new pseudocode tab, so over time many tabs open and I have to remember to close them. Can I make it so that F5 reuses an already open tab instead ...
- 13
3
votes
0
answers
64
views
IDA remote GDB debugger cannot suspend linux machine
I am starting Debugging Linux Virtual Machine by IDA GDB debugger. I can say I am able to connect to process (0) and start the machine (by using IDA 32bit, IMO it has something to do with bios! or I ...
- 31
2
votes
1
answer
105
views
Is "PE_LOAD_ALL_SECTIONS = YES" synonymous with "Load resources" from the "Load a new file" dialog?
As per this recent blog article one can set the PE loader to default to loading all sections. I even knew that. So setting the following setting in cfg\pe.cfg does the trick:
PE_LOAD_ALL_SECTIONS = ...
- 10.9k
3
votes
0
answers
336
views
What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?
I’m disassembling binaries in IDA Pro.
It usually takes 15+ minutes just to pre-process/open one binary,
Then another 20-30 min before IDA is fully done disassembling and finally becomes idle.
...
3
votes
1
answer
237
views
Is there an interactive way to search for immediate integer values using a mask in IDA?
Other than scripting a solution to this, can anyone recommend an interactive method to search for immediate integer values by mask in IDA?
Let me explain. Consider NTSTATUS values used in Windows ...
- 10.9k
3
votes
0
answers
89
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 313
6
votes
1
answer
2k
views
Reversing an RSA function throws pkcs decoding error
I'm working my way through reversing a toy challenge, and I find myself stuck. The app is pretty simple, it spits out a blob of text (e.g. "3b880a90e476d66569d9d5dfb5cd755af3f..."). Dumping ...
- 215
1
vote
1
answer
84
views
What was the original math operation after optimizing compiler?
I'm pretty sure that original code was much simpler:
(((x + 16) >> 31) ^ abs(x + 16) & 3) + 4 * ((y + 16) % 4) - ((x + 16) >> 31)
Looks like division with remainder... Any ideas what ...
- 33
3
votes
1
answer
173
views
Two examples of the same code looks different
These are two examples of the same code. The same code in IDA looks different. Why? For compilation this C++ code was used VS2019.
.text:004E27A0 ; =============== S U B R O U T I N E =================...
- 363
4
votes
0
answers
624
views
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.
Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.
refer:...
- 223
3
votes
1
answer
307
views
What the meaning of RED dq in .data?
I'm new to IDA.
Refer here: Red text Highlight in IDA Pro
But I can't find any useful in Problem Window.
- 223
5
votes
1
answer
170
views
Zlib structure inside a GCC static library
I'm trying to analyze a GCC static library which is a part of a commercial software.
First, I used IDA Pro to analyze entire Lib file, but it could find only object files and was unable to disassemble ...
- 151
3
votes
1
answer
87
views
Confused about small MIPS disassembly snippet (jalr)
I'm trying to understand this part of a MIPS binary I am reversing using IDA. I have attached screenshots of the decompilation, disassembly, and the offset passed into the jalr instruction.
I am quite ...
- 133
1
vote
1
answer
570
views
HELP Decrypting Lua files
i'm trying to mod a game named : DDTank Mobile, which is on both Android & IOS.
This game runs on cocos2d engine, the thing is the lua files are encrypted.
I read somewhere to look for 'sign' at ...
3
votes
1
answer
394
views
Reading memory values in IDA
Want to get 32 bits from 0x8000 adress as 8 bytes
MEM_EXT:00008000 db 54h
MEM_EXT:00008001 db 53h, 57h, 20h
MEM_EXT:00008004 dd 322E3256h, 31332030h, ...
- 133
3
votes
1
answer
115
views
Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?
I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M).
Looking at the idapython documentation, it looks like maybe I can do this via the ...
- 206
4
votes
1
answer
344
views
IDA Pro Flow Chart and Decompiler Doesn't Work on Single Instruction text
Recently I got a program that has two colors of .text segment, one is black and the other is brown:
While the flow chart and the decompiler work well on black part, they are both disabled on the ...
- 163
2
votes
0
answers
644
views
Themida devirtualization?
I'm trying to analyze virtualized? code in IDA which looks like this.
which protection method is applyed on this code and how can i analyze this code?
- 21
4
votes
0
answers
365
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 518
1
vote
0
answers
300
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 119
2
votes
1
answer
158
views
What are latest research in reverse engineering?
I am searching research papers related to reverse engineering between 2020 and 2022 but did not found good papers with latest research in the direction of reverse engineering.
So, what are the latest ...
2
votes
1
answer
586
views
Instead of doing a (long) analysis of an .exe, can i run that .exe, attach Ida Pro's debugger to it, and get the pseudo code of functions i want?
Basically, I have this 64 bits game.exe file which is about 400mb. It takes about 24 hours to do the analysis of the file in Ida pro 64 bits free version.
Problem is i have to do it again cause there ...
- 73
2
votes
0
answers
164
views
Access a XREFs with frida
I have a string which has a XREF to a func. This func changes of address at every updates of the app I am working on. So this string is the only "stable" point I can rely on to access to ...
- 51
2
votes
0
answers
464
views
Corrupted IDA database .i64 file (Empty Header)
Im my 10 years using IDA Pro this never happend.
I saved using IDA Pro 7.7 when I go to open today
I find out that IDA PRO didnt put header on file
If I try to open says "File .... is not an IDA ...
- 21
2
votes
0
answers
322
views
IDA api: get function argument definition
So let's say we have the following code:
0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
- 41
1
vote
0
answers
162
views
After jumping to a new segment, it warns "The memory could not be written"
I append a new segment right after the original ones in IDA, and I modify an instruction in .text seg to jump to the new seg to run my new codes. But when I use Local Windows debugger, it warns that &...
- 11
2
votes
0
answers
235
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
5
votes
2
answers
1k
views
How to make pseudocode in IDA more human readable
Some codes in IDA are not clear enough. Especially when they do reference after calculation
while ( dx33[rdi24] );
if ( rax35 != &WPP_GLOBAL_Control && (*((_BYTE *)rax35 + 68) & 2) !=...
- 313
1
vote
0
answers
21
views
How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
- 113