Search type Search syntax
Tags [tag]
Exact "words here"
Author user:1234
user:me (yours)
Score score:3 (3+)
score:0 (none)
Answers answers:3 (3+)
answers:0 (none)
isaccepted:yes
hasaccepted:no
inquestion:1234
Views views:250
Sections title:apples
body:"apples oranges"
URL url:"*.example.com"
Favorites infavorites:mine
infavorites:1234
Status closed:yes
duplicate:no
migrated:no
wiki:no
Types is:question
is:answer
Exclude -[tag]
-apples
For more details on advanced search visit our help page
Results tagged with Search options user 8679

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

0
votes
Existing data on disk that appears in IDA as '??' bytes usually means that this data is overlay, i.e. it's behind the end of the last section. Check what should be the RVA of your string and whether it does land in a section or not depending on the header of your executable. …
answered Feb 15 '16 by Dillinur
0
votes
calculated, and IDA will basically add and substract the base, so it'll give: RVA 0x1234 with BaseAddress 0x400000 => (loc_401234 - 0x400000) Unfortunately, there is no easy way to differentiate a small …
answered Jun 6 '16 by Dillinur
1
vote
In order to get Hexrays to detect that your subtype passed as an argument is actually a member of a bigger parent type, you have to declare the parent type as a structure, and declare the correspondin …
answered Apr 2 '17 by Dillinur
1
vote
If I understand correctly, you already have the definition of your interface, so you can just create a structure with all fields having the names of the functions (or maybe even import it if your head …
answered Apr 11 '16 by Dillinur
3
votes
IDA not the most convenient tool for what you're trying to do. There are basically 3 ways to do it, and it seems you're already mentioning all of them in your question : Search for a code cave big …
answered Feb 4 '16 by Dillinur
1
vote
IDAPython is the way to go when you want to do such things. I'd say something like that should work: CONST_1 = "1234h" CONST_2 = "ABCDh" for func in Functions(): got_first, got_second = False, Fa …
answered Feb 7 '16 by Dillinur
1
vote
You are actually asking multiple questions here : If you checked "Manual Load" when creating your IDB, and answered "Yes" when IDA asks you if you want to load the header, you should have a "HEADER … you answer "Yes" when IDA asks you if you want to parse the header. To get the base address of your programm, you can use the IDAPython call get_imagebase() but that should be your first section anyway …
answered Apr 7 '17 by Dillinur
4
votes
into IDA will indeed show you those new parts. The data has to come from somewhere though (ressource, compressed, encrypted, another file, Internet, etc). As you mentioning that the binary appears …
answered Apr 6 '16 by Dillinur
0
votes
Debugging a program means executing its instruction on your CPU, "undoing" the last instruction is usually not possible with a standard debugger. But you can debug your program in a virtual machine, …
answered May 26 '17 by Dillinur
1
vote
I'd say this is an external function because of the memory range (0x7c000000 looks typical for imported DLLs), but without more information it's actually hard to tell. The proper way would be to chec …
answered Jun 22 '15 by Dillinur