All Questions
408 questions with no upvoted or accepted answers
9
votes
0
answers
405
views
replicate external bank switching in IDA Pro
I'm reverse engineering an embedded Z80 application in IDA Pro 7.0. The target system maps one address range to either of a pair of expansion boards. The address decode logic decides which board is ...
- 191
6
votes
0
answers
909
views
Reliable way to recognize STL template classes?
Since the template classes are different between instantiation, it is extremely difficult for library recognition using universal patterns.
But the control flow graph and references to system call of ...
- 428
6
votes
0
answers
587
views
How does my S62 engine utilize MAF sensors to convert voltage to mass flow?
We're trying to solve a puzzle on one of the automotive forums regarding how the BMW S62 engine utilizes its two MAF (mass air flow) sensors to determine the air mass flow entering the engine. This ...
- 111
6
votes
0
answers
2k
views
Why does Hex-rays thinks that 32bit PE is 16bit?
I'm using IDA 6.1 32-bit version.
I'm pretty new to IDA and Hex-rays decompiling. My goal is to generate some C source from a 32-bit PE executable. I know this file is 32-bit PE executable. I've ...
- 233
5
votes
0
answers
270
views
IDA memory mirroring
I am trying to reverse engineer an embedded firmware in IDA. It mirrors memory address 0x80000000-0x81FFFFF to 0xA0000000-0xA1FFFFFF.
How do I setup IDA to recognise memory mirroring.
- 51
5
votes
0
answers
1k
views
I'm trying to debug small mips code snippets in IDA with QEMU as debugger, but only NOP instructions show when I start the process
I followed the tutorial IDA Help: Debugging code snippets with QEMU.
It always worked with ARM code, but now I have to reverse some MIPS and only nops are displayed like this:
Should I adjust ...
- 51
5
votes
0
answers
3k
views
Can IDA generate C code for ASM assembly without the binary?
Lets say I have this picture of some assembly:
Now I know how to manual tranform this assembly into C code because it is small but is it possible for IDA to convert this into C code? Ideally I would ...
- 151
5
votes
0
answers
2k
views
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
- 171
5
votes
0
answers
4k
views
Load multiple modules in one IDA database
I have a game (Crysis 2) and the developers exported each DLL to be loaded separately by the main executable instead of merging all of them. Instead of having 9 instance of IDA open everytime and ...
- 51
4
votes
0
answers
306
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,807
4
votes
0
answers
175
views
How can I generated the function call graph (with API calls) of a .NET executable?
For native executables, I can use IDA to generate the function call graph (FCG) of that executable (which includes API calls as well, for example function sub_xxx has an arrow to CreateFile which ...
- 518
4
votes
0
answers
176
views
How can I learn VMP analysis？
I am currently interested in learning reverse engineering, and I have a
foundation in assembly,
PE structure,
and the use of Win32Api.
And also have some of the foundation for writing Windows drivers;...
- 41
4
votes
0
answers
1k
views
Finding older IDA files
I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.
On the graph view it is only showing the main ...
- 195
4
votes
0
answers
624
views
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.
Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.
refer:...
- 223
4
votes
0
answers
365
views
How to debug windows EFI modules during boot using IDA Pro's windbg?
I wanted to debug winload.efi using IDA Pro 7.7, but for some weird reason there is no windbg in the list of debuggers in case of EFI files, even tho I can easily debug the kernel using IDA Pro's ...
- 518
4
votes
0
answers
2k
views
IDA Free vs IDA Home (to have Lumina)
I use actually IDA Free and I want to know what do you think of IDA Home (particulary for the Lumina function).
I don't found in Google a tool to know for exemple the functions recognized by the ...
4
votes
0
answers
875
views
IDA Hex-Rays structure inline functions recognition
I've seen multiple posts about the subject, but mine is a little bit more specific about what I want to achieve.
I have many times situations where Hex-Rays decompiler outputs 16 lines of code and I ...
4
votes
1
answer
611
views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
- 428
4
votes
0
answers
882
views
IDAPRO from command line interface: Exporting IDB file to BINEXPORT file
I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions:
"<path-to-idaq.exe>" -A -OExporterModule:<result-...
- 141
4
votes
0
answers
321
views
funcap not capturing information in IDA debugger
I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
- 1,022
4
votes
0
answers
4k
views
IDA pro and Bochs Debugger
I am debugging a shellcode in IDA Pro
IDA Pro version: 6.1.011 (32-bit)
Bochs version: 2.6.2
I load the shellcode from a text file and the code displays properly in IDA Pro disassembly. Now, I want ...
- 775
3
votes
0
answers
60
views
How can I create an `__m128i` datatype with Frida?
I'm working on reversing a c++ binary and it has a function that I want to call with Frida.
Here's the function signature from IDA: const __m128i *__fastcall sub_0123(__m128i * a1);
It doesn't seem ...
- 131
3
votes
0
answers
139
views
IDA Pro debugging an ARM binary on windows with QEMU
I have an arm executable which I was debugging with gdb-multi and qemu-arm on linux, how can I do the same with IDA pro on windows with QEMU, without needing a remote host for "remote debugging&...
- 131
3
votes
0
answers
253
views
IDA ATL C++ class reconstruction
I'm currently using IDA Pro to analyze a dll, but IDA Pro doesn't analyze ATL standard classes properly, including CString, so I'm trying to reconstruct the classes manually, but I'm having some ...
- 71
3
votes
0
answers
509
views
How to force IDA to load MFC DLL symbols while disassembling an EXE that uses such DLL?
I found that IDA may not load symbols for MFC DLLs while disassembling EXEs that load such DLLs. This makes the disassembling horrible if the DLL is linked just by ordinals, and IDA doesn't have a ...
3
votes
0
answers
65
views
Contents of EAX in IDA Free?
I am doing Level 2 of TryHackMe's REloaded reverse engineering challenges.
In the screen shot below, you can see I have found the string I want by hovering my mouse over EAX, however a good chunk is ...
- 195
3
votes
0
answers
88
views
Using "map to another variable" in IDA
I am using in IDA. There is a feature which is called "map to another variable".
but it asks from me to map from the variable from a list. How do u know the exact variable to map into ? (I ...
- 31
3
votes
0
answers
176
views
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
- 111
3
votes
0
answers
92
views
Where can I find documentation for IDA Freeware?
I have looked at the official documentation page and it doesn't have an entry for IDA Freeware. Is it available at all? Is there a popular unofficial one? Do I just read the one for IDA Pro?
- 131
3
votes
0
answers
40
views
How to view a QJsonValue while debuging exe with IDA
I'm step by step debugging a program in IDA.
The program uses the Qt-toolkit.
The function that I'm stepping through is handling a json document.
For example here it is accessing the key workgroup and ...
- 31
3
votes
0
answers
64
views
IDA remote GDB debugger cannot suspend linux machine
I am starting Debugging Linux Virtual Machine by IDA GDB debugger. I can say I am able to connect to process (0) and start the machine (by using IDA 32bit, IMO it has something to do with bios! or I ...
- 31
3
votes
0
answers
336
views
What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?
I’m disassembling binaries in IDA Pro.
It usually takes 15+ minutes just to pre-process/open one binary,
Then another 20-30 min before IDA is fully done disassembling and finally becomes idle.
...
3
votes
0
answers
89
views
purpose for using a == &a
I'm debugging dns.exe in Windows10 1809 and I'm really confused about one condition that often appeared in this file
WPP_GLOBAL_Control == &WPP_GLOBAL_Control
Actually, I have seen this kind of ...
- 313
3
votes
0
answers
102
views
How can I manually figure out stack variable/buffer sizes from stripped x86-64 disassembly?
I am looking at the following CTF challenge:
0x56555779 <+0>: lea ecx,[esp+0x4]
0x5655577d <+4>: and esp,0xfffffff0
0x56555780 <+7>: push DWORD PTR [ecx-0x4]
...
- 1,880
3
votes
0
answers
40
views
Find location to override PC by stack frame with stackoverflow
I have stackoverflow in MIPS arch (without ASLR/canary)
In Ida I see that the buffer that has the overflow located in SP+200
In the beginning if function I can see the stack size because I see the ...
- 281
3
votes
0
answers
1k
views
Find constant variables with float values using Ghidra
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values are somewhat constant float. this is the snippet:
// Namespace:
public class ...
- 309
3
votes
0
answers
368
views
Disable IDA Downloading Symbols Automatically
How can I disable IDA Downloading symbols? It pops up everytime I attach to a remote process. It is really annoying.
- 59
3
votes
0
answers
481
views
Cannot load pdb in IDA Free 7.6
I am new to reverse engineering. I am following a tutorial for Windows Reverse Engineering and IDA is a pretty good software for this approach.
I have just installed the last version of free IDA (7.6) ...
- 141
3
votes
0
answers
333
views
How to disassemble win32 function RegSetValueExW?
I have opened up advapi32.dll in IDA and found out that RegSetValueExW is just a jump to RegSetValueExW_0. And RegSetValueExW_0 seems to be an extern.
How do I actually disassemble RegSetValueExW_0?
- 131
3
votes
0
answers
158
views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
- 31
3
votes
0
answers
71
views
Is there a way to resume execution of a process for a given amount of time then suspend it?
I am using the following IDC script in IDA:
#include <idc.idc>
static main()
{
for (i=0; i<10; i++)
{
PauseProcess();
...
- 381
3
votes
0
answers
158
views
How to go to the variable's stored location directly in decompiler mode of IDA?
When i'm debugging a code in decompiler mode, one problem i face is that when i double click on a variable, it goes to "stack locations" instead of the actual address that the variable/...
- 176
3
votes
0
answers
2k
views
how to get all "called functions" in idapython
I am using following function to generate a call graph using idapython:
def generate_graph():
callees = dict()
# loop through all functions
for function_ea in idautils.Functions():
...
- 1,807
3
votes
0
answers
1k
views
disassembly - bad results generated with ghidra but not with objdump and IDA
I am using Ghidra to analyze libpng-compat.1.5.10.so (downloaded from Fedora mirrors).
But it didn't load the expected disassembly. Then I used Objdump and IDA to check the code and they get the same ...
- 51
3
votes
0
answers
299
views
Display open handle ids in IDA Pro
Is there a way to display all the open handles of a process in IDA Pro while debugging it?
I'm debugging a 64-bit binary on Windows OS with the win64_remotex64.exe as the debugging server.
I want to ...
- 775
3
votes
0
answers
59
views
IDA's debuggers disappeared
Using IDA 7
I've been debugging a program with remote GDB just fine. Today when I opened the database, most of the debuggers are missing from the list, including GDB. It's only when opening this ...
- 31
3
votes
0
answers
51
views
How to prepend offset to smart names?
So I'm trying to reassemble an PE to ELF so I can debug it with rr.
However masm report duplicate symbol errors. It's because it doesn't enforce scope to it's variables so smart names cause conflicts....
- 475
3
votes
0
answers
305
views
Telling IDA that all references to an address range belong to the same segment
For context: I'm using IDA to reverse engineer Gameboy code. I'm using this Gameboy loader to load files. The Gameboy has a 16 bit address space, where addresses $0-$3FFF always point to a fixed ...
- 131
3
votes
0
answers
954
views
How does IDA apply its FLIRT signatures and how are they licenced?
I'm considering writing a Ghidra extension that would apply FLIRT signatures, but I'm not sure whether the license would support that, or whether FLIRT is dependent on inputs from IDA's architecture ...
- 173
3
votes
0
answers
1k
views
Passing input to program in Remote Debugging with IDA Pro
I am writing an exploit for a binary on Linux using IDA Pro. This binary, first accepts an input using getchar() and after few more code sections, it accepts a buffer as an input through stdin and it ...
- 775