Hot answers tagged

43

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...


22

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the only one I have experience with, and since it provides a hidden compiler switch printing how classes will be layouted in memory which I'm going to use for illustration. As you ...


15

I found the solution. Double click the variable name (configSpaceBuffer in this case) which brings up the stack window for the method where you can undefine the invalid variables and then define it as an array. Here is the output after this change: _this->ConfigSpace1 = configSpaceBuffer[1]; _this->ConfigSpace0 = configSpaceBuffer[0]; ...


8

Hex-Rays Decompiler is an addition\extension for IDA Pro and I doubt it can work as a separate standalone product. Please see "Prerequisites" part of Hex-Rays Decompiler Manual: "The decompiler requires the latest version of IDA..." https://www.hex-rays.com/products/decompiler/manual/prereq.shtml But this question, IMO, should be addressed to the Hex-...


7

The numbers denote the basic block number in the microcode where the variable was first used. Microcode basic blocks do not necessarily match the basics block in the disassembly, because during optimization steps the microcode basic blocks may be split, merged, added, or removed. You can see some samples of microcode in Ilfak's whitepaper on the decompiler ...


6

COERCE_TYPE(x) is the same thing as *(TYPE *)&x. Hex-Rays uses COERCE_... macros when &x is illegal. For example: COERCE_DOUBLE(__PAIR__(i1,i2)) Is the same as *(double *)&__PAIR__(i1, i2), but since & can not be applied to calls, we end up seeing COERCE. Its name correctly conveys its meaning.


6

IDA's til files are basically IDA's way of storing type information for particular functions. AFAIK, a .til file doesn't tell IDA how to actually recognize that function in order to apply function prototype information. For that piece you're going to need produce the requisite .sig file using IDA's Flirt utilities. By default, IDA won't replace existing ...


6

test is basically an and instruction except it doesn't update the left operand. In the other hand, cmp is the equivalent of sub instruction except it doesn't update the left operand. To sum up: if (v & n) Is compiled as test instruction. if (v == n) Is compiled as cmp instruction (or test reg, reg is n is 0x0) v = a & n Is compiled as and ...


5

Locate cursor at v1 and press = . If I remember it correctly since IDA 6.6 it will allow you to define that some variable is actually same as other.


5

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been merged into IDAPython. You can find the documentation under "ida_hexrays" in the IDAPython docs. Examples can be found in IDAPython repository. Check the scripts ...


5

Go to the menu Edit -> Plugins -> Hex-Rays Decompiler. A window will appear with information about the Hex-Rays plugin. Click Options and you should see a dialog like this: Click on Analysis options and uncheck Print only constant string literals: I learned about this option from the great Life In Hex blog, but I cannot find the post right now...


4

Your hook is wrong because retn 4 is for __stdcalls, not __usercalls, and because you must move arguments to registers, not push them. Do it like this: mov esi, a1 mov ecx, a2 call hook_address ret retn 4 would clean 4 bytes from the stack, but you didn't push anything, so it's not correct, which is why you use ret instead.


4

As you guessed correctly, you have to find out the correct starting address of the bootloader image. Based on the bootloader in the latest firmware image (TL-WR702N_V1_141203) I recommend you to try 0x80400000 as the start address. Although I don't know a simple and exact method to calculate the start address I try to explain a little bit more how can you ...


4

I think it should look like this I am 99.9% feel it's a element shifter something tells me that 0x3FFFFFFF is max bounds of a array so it's some compiler thing that it appends to make sure it gets the end of the array. I was wrong 0x3FFFFFFF is used to create signed numbers to emulate subtracting by adding. See comment by DCoder if ( ZonePlayerCount > ...


4

__PAIR__() seems to be a macro that computes an unsigned long value from its two arguments, which it interprets as containing the high and low bits of that value. The topic linked by Guntram - Understanding __PAIR__ macro from IDA PRO Pseudo Decompiler to look better contains a definition for the macro and examples of its use, but no explanation of it. // ...


4

First, OP mentioned several times he'd like to execute the function. Which should be pretty easy using a debugger (IDA has decent debugging capabilities, or you could give ollydbg a try) I'll answer the questions in the order in which they appear: what is __usercall and diamond-wrapped registers in a function's definition? __usercall is a "virtual ...


4

If the decompiler detects wrong number of arguments for a variadic function call, you can adjust it using the context menu comands or Numpad +/- hotkeys.


3

You can undefine the field (select Undefine from the context menu or press U) and then press D to define a new field in the gap.


3

As I'm working with the malware samples provided by kaggle too, I faced the same problem. I found a solution by the processing in two steps, which extracts all the mnemonics used in the complete set. Note: As I'm not finished with my work yet, I'm not able to post the full script. The real implementation is realized with threading and the process takes ...


3

When loading plugins, IDA goes through them alphabetically, and tries to load all the plugins. When loading a plugin, the loader check the plugin flags (idaapi.PLUGIN_PROC, idaapi.PLUGIN_FIX, and so on) to determine if the plugin should be loaded at the current time. If it is to be loaded, the init method is called. A plugin can return PLUGIN_KEEP to remain ...


3

No, it doesn't. See hex-rays.com/products/decompiler for more details. Regarding other news and features see decompiler news page.


3

I don't think there's a way to add a new function variable, since the decompiler creates those based on registers and stack locations. However, in situations where it's really annoying, creating a union type in the Structure viewer can be helpful. Then, in your decompiler, set the type of the variable to the union type (Y is the keyboard shortcut). In ...


3

In IDA, you can define enums through the Enums view (shift+F10). Enums have the "bitfield" bit set (a checkbox by the same name can be found in the Enum edit and create dialogs). This bit cannot be set for enums with overlapping member bits. Once an enum is a bitfield enum, setting any operand in the disassembly view to that enum will display all enum ...


2

Read this here: https://www.hex-rays.com/products/ida/tech/flirt/index.shtml I think they overhauled the FLIRT system in a recent version of IDA. Overall it works pretty well, but there is a lot of room for improvement. It's kind of like "finding a needle in a haystack". It's annoying when the FLIRT names so many false positives. It assumes a match on just ...


2

The created types get added to the Local Types list (View->Open subviews->Local types, or Shift-F1). To jump directly to the specific type, choose "Jump to local type..." from the context menu on a variable of that type. You can import any structure from Local Types to the Structures list by double-clicking it or selecting "Syncronize to idb" from the ...


2

Well exactly not a "pure" IDA solution. I use HexRaysCodeXplorer to do the same. Map to another variable will be present in the right click context menu while in pseudocode mode. This plugin is filled with features which will make your life easier and small nuances you wish were present in IDA.


2

Yes there is. HexRays takes function boundaries from IDA disassembly, so as far as you can change the function boundaries in disassembly view, you can manage function boundaries as follows (the solution is for you specific case, solving this problem in common may be more complicated): Find the function in the disassembly window Go to the end of the code ...


2

From http://www.nulltrace.org/2013/04/mips-bootstrapping.html: MIPS Bootstrapping Bootstrapping is the process of taking a CPU just out of reset, fetching and executing instructions serially, to a more complex running environment. The program that does that is called a "Boot loader" or "Boot strap code" or simply "Boot code". First ...


2

The only reliable way I know about requires writing HexRays plugin. Here and here you have an examples of such plugins that manipulates output of the decompiler - not exactly in a way you need, but probably it will give you some direction. Examples of such a plugins in IdaPython (probably not working and outdated) may be found in its old Google Code ...


2

In order to easily import the information into IDA it's possible to: Download Visual C++ and MFC (ideally the same version) Make a very small C++ file which contains the definition of the type, for example: #include <afxwin.h> (you can verify that afxwin.h header indeed contains the definition of the class) Assume the file is saved as a.cpp Compile ...


Only top voted, non community-wiki answers of a minimum length are eligible