All Questions
2,164 questions
0
votes
0
answers
29
views
Reverse Engineering S/EX RE-MAN BOARD INTERFACE SR2 SL (MRD-45-2276)
S/EX RE-MAN BOARD INTERFACE SR2 SL (MRD-45-2276)
How can I access the raw data sent by the sensors to this board?
I also need the data sheet and schematic information of the board.
- 121
0
votes
1
answer
180
views
idat.exe -S, path with spaces
I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so
But I get an error. Among the logs is present the error:
home\mypath: ...
CommunityBot
- 1
0
votes
1
answer
61
views
+50
How can I compare different execution traces of the same exe, but ran with different parameters?
Context
I'm working on analyzing how a software's behavior changes when run with different parameters.
My goal is to compare the execution traces (e.g., function calls, memory accesses, or instruction ...
- 1
1
vote
2
answers
987
views
How to compare no-case sensitive strings IDC
So I want to track when a certain file is loaded into an Win32 app. That's way I put a break-point on 'CreateFile' which compares the first parameter with the target file name, but the problem is that ...
- 232
0
votes
1
answer
146
views
IDA - Decoding this "XORed"? string automatically in psuedocode
__m128i ModuleName;
__m128i ProcName;
ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64;
ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64;
ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64;
ProcName....
CommunityBot
- 1
1
vote
2
answers
137
views
Functions in Ida are divided into many local functions, how to remove unnecessary transitions?
I am solving the crackme And so you need to get the key, but I am doing reverse engineering for the first time and therefore I do not know how to do it, the functions in the crackme are divided into ...
- 93
1
vote
1
answer
121
views
IDC script offsets
I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
CommunityBot
- 1
2
votes
1
answer
108
views
Easiest way to move everything, including custom structs, from an IDA Pro IDB to another?
I have analyzed a 32 bit version of an executable, defined many structs, renamed many things and so on.
Now i want to move everything, including the structs that i defined, to the IDB of the 64 bit ...
2
votes
1
answer
2k
views
How do I Decompile .Pyd file made with python, cython and pyinstaller 3.6
I created an app in 2018 with python and then used Cython and pyinstaller v 3.6.
I am wondering how to decompile it. I have tried uncompyle6 + pyinstxtractor however this only works for python files,...
CommunityBot
- 1
0
votes
1
answer
4k
views
IDAPython: error executing init.py:
When I open Ida Pro 7.3 I see an error message
IDAPython: error executing init.py:
nothing to repeat
Refer to the message window to see the full error log.
How can I understand what is the problem? ...
CommunityBot
- 1
2
votes
1
answer
142
views
C disassembly - bitwise operations with 0x7FFFFFFFFFFFFFFF and 0x8000000000000000
I am using IDA to reverse engineer x86_64 binary file written in C. And pretty often I meet the following in IDA's pseudocode:
(int64)v7 | 0x8000000000000000LL
(int64)v7 & 0x7FFFFFFFFFFFFFFFLL
...
- 10.9k
2
votes
1
answer
1k
views
Can't find references (xref) to function
I am reversing a function and when I trying to see its references, it doesn't show me the calls to the function. It only show the place of the object in RVA.
Is there a plug-in or something that I ...
CommunityBot
- 1
0
votes
0
answers
31
views
setup Ida/x64dbg
I have a 64-bit app disassembled with Ida 9.0.
I would like to attach x64dbg to it as a plugging so that it is recognized as a debugger in Ida.
Apparently, copying the plugging (x64dbgida.py) is not ...
2
votes
1
answer
413
views
IDA remote debugging - non printable characters in parameters
I am trying to remote debug a certain binary which gets user-specified command line arguments, which can be non-printable of course.
My goal is the ability to debug with IDA the process with the ...
CommunityBot
- 1
2
votes
1
answer
664
views
How can IDA Pro disassemble paged memory from HCS12 processort?
I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory?
If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it ...
- 1
0
votes
1
answer
82
views
IDA show decimal values instead of hex and vertical alignment for ELF file
New to de-compiling, want to set up Ida to give best reading experience with ELF files from android phone.
I run in following issues:
Even though i set Edit > PlugIns > Hex-Rays Decompiler > ...
CommunityBot
- 1
0
votes
0
answers
51
views
Why does a function with 3 parameters is decompiled as 9 parameters?
For a PowerPC binary with debugging symbols, the function signature is:
CrossProduct(VECTOR *,VECTOR,VECTOR)
It's correct as it matches the source code for an older version of the application:
void ...
- 249
1
vote
1
answer
359
views
Is a rootful jailbreak necessary to debug imessage with ida pro for <= ios 16.0.3?
In this pdf file written by the great Saleo: https://saelo.github.io/presentations/36c3_messenger_hacking.pdf
Saleo was able to debug the called method names of imessage during runtime with ida pro, ...
CommunityBot
- 1
0
votes
0
answers
22
views
Why does IDA changes functions signatures at some point?
On a PowerPC binary with symbols, when you first open it, the symbols are fine.
For instance: SetLineF2(LINE_F2 *)
But at some point, after adding a few structs, it renames all the methods like so:
...
- 249
0
votes
0
answers
54
views
IDA and hex editor different values
Initially I have in IDA value in hex:
0003EF9B A1 DC F3 12 00
But the I looked in hex editor same offset and its different:
A1-DC-F3-06-00
But it is half problem.
In hex editor I trying change the ...
- 363
0
votes
0
answers
24
views
Find out function address in the disassembled binary using MDMP
I have a log file from the target Linux machine stating where crash has occured:
0x00000000046195d3 MyApp!UnknownFunction(0x44195d3)
I have fully analyzed and disassembled in IDA MyApp binary
I also ...
- 141
1
vote
1
answer
92
views
How to load mixed assemblies into IDA?
When loading a DLL that uses the CLR (.NET runtime) and contains native code, IDA (as of 8.4) will always prefer to load it as "Microsoft.Net assembly" with processor type "Microsoft ...
CommunityBot
- 1
0
votes
0
answers
26
views
How to create ram and rom section IDA?
I have a binary linker descriptor for preloader.bin
ENTRY(_start)
romBase = 0x00201000;
bss1Base = 0x00102000;
bss2Base = 0x00267000;
stackBase = 0x00200000;
/* log_sram_buf + bss1 should be less ...
- 101
4
votes
3
answers
12k
views
How to get the list of strings within IDA's string window in my script?
I'm trying to write some scripts that do some string searching through the disassembly in IDA. Currently, I loop through all the disassembly, MinEA() to MaxEA() and use idc.FindText() to see if a ...
0
votes
1
answer
131
views
IDA Pro Debugging GDB SendDbgCommand
I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging.
Setting up the debug environment with IDA Pro using ...
CommunityBot
- 1
1
vote
0
answers
43
views
directX mapping for IDA
I'm reversing a DOS application and I see in the code and in the data section some numbers that translate to DirectX Keyboard Scan-codes (standard US keyboard layout) HERE
how can I make IDA to treat ...
- 159
0
votes
0
answers
38
views
Automatically rename known functions from libraries in IDA
I have a binary file written in c and c++ which uses some libraries. The C/C++ source code of these libraries is publicly accessible online (github). Is there a way in IDA to somehow import this ...
2
votes
3
answers
7k
views
How to search for Opcode 0xFF25 in IDA Pro?
I want to search for opcodes in IDA Pro like the following:
0xFF25
How can I do that?
- 1
0
votes
0
answers
31
views
Patching default.xex for Xbox 360 games with IDA or Ghidra
I'm trying to patch the Perfect Dark Zero XEX to remove the 30 FPS cap with IDA but it gets "826CFB77: has no file mapping (original: 02 patched: 01)...skipping...". Can someone help me ...
- 11
0
votes
0
answers
34
views
Restoring hashed filenames from Juiced (2005) DATs
Where is the memory address for the hash function from Juiced PC executable to restore hashed filenames?
- 11
0
votes
2
answers
210
views
Is DOS Assembly Hexadecimal Different To Modern Hex Editor Hexadecimal?
I am trying to find the correct Data Segment, corresponding to a certain File in a 16bit DOS Game.
The Assembly Instructions for the Decompiled .exe File in IDA Pro Version 5, I am looking at.
I was ...
CommunityBot
- 1
0
votes
1
answer
321
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
CommunityBot
- 1
4
votes
1
answer
611
views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
CommunityBot
- 1
4
votes
3
answers
2k
views
How can I get xrefs to class member variables in IDA?
I'm working on a decompilation of a windows PE (with its full debug symbols in a PDB) and I'm using IDA to help with it.
I want to know how I can get a list of all references to a given class member ...
- 101
0
votes
2
answers
121
views
Minecraft EXE client
im quite new in this theme and im looking for a way how to extract .jar file from exe file ( upd. its graalvm native image ). If i open this exe as archive (7zip) i can see only .rdata and others ( ...
- 21
1
vote
2
answers
321
views
Is address in program can change
I talking about linux arch.
When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2
When I want use that address to breakpoint (for example with ptrace or ...
CommunityBot
- 1
1
vote
2
answers
470
views
How do I extract sprites and backgrounds from .BIN files? (dos game - 1988)
Does anyone know what tools should I use to extract the backgrounds and sprites of this very rare old game: Armorik the Viking?
The files are in .BIN format. No idea how to open them. I tried Game ...
CommunityBot
- 1
0
votes
1
answer
2k
views
Dynamic Analysis on ELF using IDA
On Linux, while generally reversing ELF files and dynamic analyzing (like step into, step over, break-point, inspecting registers value, memory etc) I use gdb or radare2 which provides dynamic ...
CommunityBot
- 1
0
votes
1
answer
2k
views
How do you effectively use gdb and IDA together?
When dealing with linux binaries, I like IDA as my static analysis tool and gdb as my debugger. However I have not found an effective way to integrate the two with each other.
To give an example, let'...
CommunityBot
- 1
1
vote
1
answer
57
views
How to modify a structure field in IDA to reflect the correct union member in decompiled code?
I'm reversing a Windows driver and using IDA to decompile some of its code. I've encountered an issue where the decompiler is using the wrong structure member in the decompiled output. Specifically, ...
- 21
10
votes
4
answers
14k
views
Converting a virtual table from .rdata into an IDA struct
Is there a way to convert a .rdata vtable entry to an IDA struct? An example of the vtable entry:
And what the resulting struct should look like (but with all entries - this vtable specifically, ...
3
votes
1
answer
360
views
How to print a manually defined struct in IDA pro while debugging?
Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members.
Now if i have the variables'...
1
vote
2
answers
69
views
Restoring original stack variable in IDA Pro?
I would like to convert an instruction like:
lea ecx, [esp+150h+var_13E+2]
to:
lea ecx, [esp+14h]
I know it's possible to do this with the key K. But I'm writing an IDAPython plugin that needs ...
1
vote
1
answer
1k
views
How to run exe program loaded into IDA Pro or Ghidra
I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
CommunityBot
- 1
0
votes
0
answers
27
views
Ida Pro shifted pointers not working
According to this article there is feature shifted pointers
I have pointer that points very far
*(_DWORD *)(myPointer + 0x10A33C)
*(_DWORD *)(myPointer + 0x10A340)
*(_DWORD *)(myPointer + 0x10A344)
...
- 101
1
vote
0
answers
52
views
How to get rid of this "Additional Parent Function" visual block in IDA
I'm using IDA (free) 8.4. Each time I open a function (Windows x64) I get a possibly huge block of "Additional Parent Function" list on the right.
It's useless to me and I'd like to know if ...
0
votes
2
answers
412
views
NameError: name 'ScreenEA' is not defined
Part of Practical malware analysis Lab5, is to run a python script in IDA Pro
I have tried by going to Files-->Script command then I have pasted my python code:
sea = ScreenEA()
for i in range(...
10
votes
2
answers
6k
views
Extracting arguments from IDA
Let's say I have the following function in IDA:
int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>)
What's the fastest way to extract the argument information ...
0
votes
0
answers
51
views
W32dasm vs iDA pro- What im missing "string references"
I am a total beginner doing RE and have been learning a lot thanks to this community, and I want to thank you. I already looked for something similar in the other questions, but I don't know if it is ...
4
votes
2
answers
5k
views
ea_t datatype in IDA API
In IDAPython, what is the ea_t data type? It is used in the set_debug_name() function as follows:
bool set_debug_name(ea, name)
If I have a 64-bits address, can it be represented by the ea_t data ...