All Questions
408 questions with no upvoted or accepted answers
2
votes
1
answer
620
views
How to restore IAT?
I have the start address and the end address of the IAT
now im trying to restore the table/folder of it.
the start address is: E7C000
thx for helping
- 21
2
votes
1
answer
784
views
find a dialog in ida using resource hacker
I am having difficulties finding the dialog reference in IDA.
e.g. i can trace a dialog in "resource Hacker" or "PE Explorer" which looks like this:
5035 DIALOG 0, 0, 295, 163
STYLE DS_SETFONT | ...
- 275
1
vote
0
answers
43
views
directX mapping for IDA
I'm reversing a DOS application and I see in the code and in the data section some numbers that translate to DirectX Keyboard Scan-codes (standard US keyboard layout) HERE
how can I make IDA to treat ...
- 159
1
vote
0
answers
52
views
How to get rid of this "Additional Parent Function" visual block in IDA
I'm using IDA (free) 8.4. Each time I open a function (Windows x64) I get a possibly huge block of "Additional Parent Function" list on the right.
It's useless to me and I'd like to know if ...
1
vote
1
answer
92
views
How to load mixed assemblies into IDA?
When loading a DLL that uses the CLR (.NET runtime) and contains native code, IDA (as of 8.4) will always prefer to load it as "Microsoft.Net assembly" with processor type "Microsoft ...
- 10.9k
1
vote
0
answers
48
views
Unknown string encoding
I'm new to reverse, my question may be stupid.
I am trying to reverse a function in the application that reads a string at the address and concatenate it to another
char[250] v30;
char[20] v31;
...
...
- 11
1
vote
0
answers
92
views
Is it possible to run Ida pro in a docker container?
I've got a script that runs IDA pro on a file, the problem is that I need to run that script in a windows docker container.
I've got the script working fine, but I can't get the program to run in the ...
- 11
1
vote
0
answers
61
views
Why does IDA give variables a different name in Assembly and Pseudocode?
Why does IDA give variables a different name in Assembly and Pseudocode?
In the picture below, you can see that IDA gives the stack location -38h the name var_38 in the Assembly view, but in the ...
- 161
1
vote
0
answers
412
views
resolved IDA I get a warning "7687F932: Microsoft C++ exception (exc.code e06d7363, tid 15160)"
when trying to debug an application with IDA, I get the following warning:
7687F932: Microsoft C++ exception (exc.code e06d7363, tid 15160)
After clicking Ok, I am taken to the kernelbase.dll line
...
- 11
1
vote
0
answers
431
views
How to use IDA environment to run python scripts?
I am trying out following technique:
https://github.com/CMUSTRUDEL/DIRTY
This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset.
It ...
- 1,807
1
vote
0
answers
129
views
How can I make IDA disassemble in NASM-like syntax instead of MASM-like syntax?
I'm new to reverse engineering, assembly and IDA and I'm learning NASM. Whenever I load an executable (a PE file or an ELF) IDA disassembles it using a MASM-like syntax (it looks to me that it does) ...
- 11
1
vote
0
answers
87
views
After loading additional files into an IDA database: can I process it, including applying PDB etc?
After loading an additional binary (.dll) file into an IDA database, is there a way to run it through a similar routine as would happen if the DLL had been loaded standalone?
What I am aiming for is ...
- 10.9k
1
vote
0
answers
101
views
DOS .exe File Decompiled in Cutter Program Showing Different Than In IDA Pro
I am having an issue when using the Cutter Reverse Engineering Program,
Here is a Segment of Decompiled Assembly, in Cutter :-
at 0000:4ed5 in the picture I posted the .string line of text is there, ...
- 79
1
vote
1
answer
121
views
IDC script offsets
I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
- 11
1
vote
0
answers
83
views
Is a jailbroken iPhone is necessary to extract the ipa of a pre-installed app like iMessage?
My research notes: https://docs.google.com/document/d/1Y-2SZX4s1E1Mq9yWHZMMBzW3BJTfUuMl-YYXoZlY73w/edit?usp=sharing
From my research, I have come to the understanding that in order to extract the ipa ...
- 21
1
vote
1
answer
359
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
- 21
1
vote
0
answers
139
views
Log functions called in IDA Pro?
When I run an exe in IDA how could I log which functions were called into a text file?
log.txt:
call func1
call func2
call func1
call func1
Not worried about indirect calls.
This is for differential ...
- 11
1
vote
0
answers
94
views
How to remove a node in CTREE
Im learning about CTREE in IDA. Here is my ida decompiled code:
v3 = 0;
if ( !strcmp(Str1, "hello") )
v3 = 100;
return a1 + v3;
At this time, i just want to mess arround with CTREE ...
- 67
1
vote
2
answers
471
views
How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. No idea how to open them. I tried Game ...
- 11
1
vote
0
answers
160
views
Cyber Talent Basic Malware Reverse Engineering
I'm an absolutely beginner in the reverse engineering field. I have an exe program and I am to find:
I have tried with Ghidra but i keep getting wrong submissions for the challenge.
Here is the exe ...
- 11
1
vote
0
answers
289
views
IDA pro Error how to resolve this error
52C187F5: The instruction at 0x52C187F5 referenced memory at 0x4. The memory could not be read -> 00000004 (exc.code c0000005, tid 672)
How to solve this?
I have seen sandbox reports in those the ...
- 31
1
vote
0
answers
95
views
Program Analysis on a Wargame Binary
I've recently took it upon myself to research more about reverse engineering, I'm currently testing my intermediate skills on various CTF hosting sites. Interestingly enough I have come across a ...
- 11
1
vote
0
answers
77
views
Making an exe file to recognize the Persian/Arabic characters
So I have an .exe file (FileSplitter.exe) and want to change the texts in its GUI to Persian/Arabic (It doesn't matter either is Arabic or Persian).
Thus I changed it at first Hex Editing using HxD ...
1
vote
0
answers
524
views
Access RTTI class hierarchy along with offsets from IDAPython
Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI.
When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
- 268
1
vote
0
answers
300
views
How to find the the event handler function for a QtAbstractButton?
I am not very familiar with Qt to begin with but basic PyQt tutorial showed that a button object is linked with its handler using the connect method that takes in as its argument the function that ...
- 119
1
vote
0
answers
162
views
After jumping to a new segment, it warns "The memory could not be written"
I append a new segment right after the original ones in IDA, and I modify an instruction in .text seg to jump to the new seg to run my new codes. But when I use Local Windows debugger, it warns that &...
- 11
1
vote
0
answers
323
views
IDA binary patch "has no file mapping"
I am trying to change one byte (TBZ to TBNZ) inside a ~40mb binary. Ive done this multiple times with other files but this time IDA is giving me a hard time by simply not patching and printing this to ...
- 11
1
vote
0
answers
147
views
Can someone help to understand code disassembly by IDA?
Can someone help to understand code disassembly by IDA?
Basically this use for calculate key from seed. Here I would like to understand the logic and also I would like to know what would be the output ...
- 11
1
vote
0
answers
112
views
IDA Pro maps wrong variable for offset
I hope there is a proper way to fix my issue.
Here's memory layout:
.data:004F3D10 char * * gTownObjNames dd offset aMage ; DATA XREF: townManager::SetupTown(void)+245↑r
.data:004F3D10 ...
- 33
1
vote
0
answers
37
views
IDA debug function spawned by pthread_once
I am using IDA to debug android, some libs use pthread_once/pthread_create function to call a function. How do I use/set up IDA to debug the function passed to pthread_once ?
- 59
1
vote
0
answers
1k
views
What is the most effective tool to analyze apk file
I have experience with android reverse engineering through modification of smali codes after de-assembling. I did modify some apps already for educational purposes.
However, I am facing an issue for ...
- 11
1
vote
0
answers
1k
views
Ida Pro can't decompile big function
I tried to decompile (Pseudocode) a big function into binary with Ida Pro 7.7 but I got error :
The graph is too big (more than 1000 nodes) to be displayed on the screen.
Switching to text mode.
(you ...
- 183
1
vote
0
answers
116
views
Problem to hook a parameter with _thiscall function
I have hooked correctly many games using detours without problems but now I have a problem with this __thiscall function:
.text:00488DA0 ; =============== S U B R O U T I N E ==========================...
- 289
1
vote
0
answers
56
views
Convert IDA imagebase to detours
I have succefully hooked a game with imagebase 400000 (Ex:
// LRESULT __stdcall sub_6D5040(int a1, UINT Msg, WPARAM wParam, int a4)
Game.SecondaryFunctHookAddress = "0x2D5040"
and the ...
- 289
1
vote
0
answers
509
views
Rebasing program
When I start debug in IDA, it's appears small window "Please wait... Rebasing program", and it's take about 3 minutes. Is it possible eliminate this process named Rebasing program? It take ...
- 363
1
vote
0
answers
433
views
How to byte patch a longer hex/byte from the original?
I am fairly new to IDA PRO I hope this is not some kind of stupid question but please bare with me. How do you change patch a hex/byte that is longer than the original?
Example:
When I try to byte ...
1
vote
0
answers
161
views
How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime
In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
- 11
1
vote
0
answers
118
views
In IDA is there a way to load the PE headers after the initial loading?
This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it.
But suppose I have already worked on an IDB for a while and realize that ...
- 10.9k
1
vote
0
answers
204
views
Warning: struct->til conversion failed
In IDA I noticed a particular struct (FAST_MUTEX) was actually part of a bigger struct whose size I could determine from the code.
So I created a struct from the selection (Create struct from ...
- 10.9k
1
vote
0
answers
140
views
Why Qiling doesn't recognize the right EntryPoint?
I'm trying to emulate an EFI driver. Luckily, I found a nice emulator called Qiling and try to debug it with GDB but it doesn't recognize the right Entry-Point.
Here is the Entry-Point in IDA and in ...
- 163
1
vote
0
answers
126
views
Which encryption returns 192 hash value it means 96 in bytes?
I am reversing an APK and there is a signature that needs to be found.
The function from where the signature is generated is present in the .so file.
I did small debugging. While doing it, the ...
- 11
1
vote
0
answers
407
views
ida shows instructions as hex data
I am new to reverse engineering. I did a couple of projects. now I was doing another project and faced kind of a problem.
at the start of the program, there is a label that points to an address of ...
1
vote
0
answers
134
views
How to hide NOPs in IDA?
I am trying to understand a method in IDA Free and I find the NOPs, especially the multibyte NOPs confusing.
Is it possible to hide these? I believe that they are not relevant for my understanding.
- 970
1
vote
0
answers
157
views
IDA tracing not working
I remotely debug a process with IDA Pro, and I want to print to file all the functions that are called.
I have tried to use IDA Tracing, but it doesn't print to file.
- 183
1
vote
0
answers
369
views
Pascal string representation in Hex-Rays Decompiler of IDA Pro
I'm trying to prettify a representation of Pascal-string "Could not access file "" in Hex-Rays decompiler's output. As you can see below,
now its type is char[25] due to inclusion of ...
- 11
1
vote
0
answers
82
views
IDA Pro don't understand address extension register in HC16
Source:
ROM:13A2 006 ldab #0Fh ; Load B
ROM:13A4 006 ldx #0FA27h ; Load IX
ROM:13A8 006 tbxk ; Transfer B ...
- 11
1
vote
0
answers
176
views
Passing a pointer to a pointer to a string with IDA Pro's Appcall
I need to call an encryption function in a program with the following signature (the second argument is returned):
char** __usercall decode(char** input, char** output)
As far as I can tell, Appcall ...
- 111
1
vote
0
answers
698
views
IDA script: How to properly undefine a byte and then redefine code
I'm trying to correct the following instructions in IDA using a script:
jnb short near ptr loc_1C61B1+3
It order to do this I'm running a snippet like this in a script:
ida_bytes.del_value(...
- 203
1
vote
0
answers
918
views
Is there a clear Ollydbg successor?
I used Ollydbg 2.01 back in 2014 when Olly was working to create a 64-bit version. I was very eager to see the 64-bit version, but sadly that never came to pass. I abandoned reverse engineering for ...
- 11
1
vote
0
answers
358
views
Why IDA debugger keep receiving SIGTRAP or SIGSEGV after set a break-point and then deactivated that break-point
Here's the problem:
I set a breakpoint in IDA debugger
the program stop at the breakpoint
deactivated the breakpoint
IDA keep receiving SIGTRAP or SIGSEGV
( program stop at breakpoint as expected ) :...
- 131