Questions tagged [ida]

Interactive Disassembler Professional (formerly IDA Pro), a proprietary multi-platform disassembler by Hex-Rays.

Filter by
Sorted by
Tagged with
0 votes
0 answers
16 views

Crash afrer dll modification

i am trying to remove messageboxa function, but after modifing and injecting game got crash. How to fix it? Thanks
user avatar
2 votes
1 answer
35 views

How to debug cfg80211.ko

I have an Linux embedded device that I want to debug the cfg80211.ko I have full root SSH on that device. How can I debug cfg80211.ko?
user avatar
1 vote
1 answer
30 views

Capstone not disassembling vpunpcklqdq, vprold, and vshufi32x4

I am trying to disassemble a binary using Capstone. I noticed that there are some instructions that cannot be disassembled, e.g. the vshufi32x4 instruction: from capstone import * from capstone.x86 ...
user avatar
  • 1,444
1 vote
0 answers
22 views

IDA throws "Module <lib> has no names" error after attaching a remote process

I am using IDA for debugging a remote process. After set IDA_LIBC_PATH to a correct libc.so in my android device to resolve IDA multi thread problems, I cannot get a list of export functions of ...
user avatar
0 votes
0 answers
28 views

Convert IDA imagebase to detours

I have succefully hooked a game with imagebase 400000 (Ex: // LRESULT __stdcall sub_6D5040(int a1, UINT Msg, WPARAM wParam, int a4) Game.SecondaryFunctHookAddress = "0x2D5040" and the ...
user avatar
1 vote
0 answers
38 views

How to solve bad pseudocode format of Hex-Rays Decompiler?

Look at the following pseudocode: void *__cdecl func(const char *a1, int a2, void *a3) { _DWORD *v3; // esi int v5; // ebp int v6; // eax void *v7; // esi _DWORD *v8; // eax int v9; // edx ...
user avatar
  • 129
1 vote
0 answers
30 views

IDA how to remove all uses of a type?

I'm editing an exe which has a function that is used in multiple places with completely different meanings for the return type (a getter that wasn't inlined). I had assigned it a return type to make ...
user avatar
  • 73
1 vote
0 answers
32 views

Disable IDA Downloading Symbols Automatically

How can I disable IDA Downloading symbols? It pops up everytime I attach to a remote process. It is really annoying.
user avatar
0 votes
0 answers
39 views

Rebasing program

When I start debug in IDA, it's appears small window "Please wait... Rebasing program", and it's take about 3 minutes. Is it possible eliminate this process named Rebasing program? It take ...
user avatar
  • 113
0 votes
0 answers
57 views

How to byte patch a longer hex/byte from the original?

I am fairly new to IDA PRO I hope this is not some kind of stupid question but please bare with me. How do you change patch a hex/byte that is longer than the original? Example: When I try to byte ...
user avatar
0 votes
1 answer
45 views

What is libm_sse2_sin_precise() and how to find it's parameters in IDA?

I'm new to reverse engineering with IDA. I've found libm_sse2_sin_precise while inspecting c-pseudocode for some Win32 executable. I tried clicking that function but the executable requires the DLLs. ...
user avatar
  • 1
0 votes
1 answer
96 views

How can I override a x86 instruction in c++?

I am trying to replace a jmp instruction with a ret in c++. How can I do that?
user avatar
  • 11
0 votes
0 answers
33 views

Handling stack strings in IDA, but with a twist (wchar_t-based, not char-based)

Consider the following disassembly: mov dword ptr [rbp+430h+var_458], 690068h ; L'i' + L'h' mov dword ptr [rbp+430h+var_458+4], 2E0064h ; L'.' + L'd' mov dword ptr [rbp+430h+var_458+8], ...
user avatar
  • 10.5k
0 votes
1 answer
24 views

ida jumping to address I can't see in driver

When I open this driver in IDA i can't seem to see the instructions that this jmp at 0x1400DC46D jumps to. I've tried to undefine bytes and re-analyze the function but it then ends up will garbage. ...
user avatar
4 votes
1 answer
81 views

Can I get back an exe file from an .Asm formatted file disassembled with IDA?

I actually have a .asm formatted file. This file was certainly obtained by disassembling an original exe file with IDA and then save as an .asm file. Now I have this .asm and I would like to get back ...
user avatar
0 votes
2 answers
82 views

What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?

How can I map between code in IDA Pro and the same code in Ghidra? I.e., I am looking at a particular piece of assembly in one, and want to find the same assembly in the other. Based on asking others ...
user avatar
  • 125
0 votes
1 answer
81 views

How can I use cutter like ida, trying to search by address

I'm new to reverse engineering and I'm trying to get into using a disassembler - I've been using reclass for a while now. I was looking at IDA Pro and that was 7k euros so that was not an option. I've ...
user avatar
2 votes
1 answer
89 views

Load to Ida binary with all of SO

I have a Linux ARM binary with a lot of shared libraries. Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
user avatar
-1 votes
1 answer
133 views

How to call and what means: _DWORD *__thiscall

I have one question maybe you can help, I always find this functions in IDA: void __thiscall sub_79340(_BYTE *this, int a2, int a3, int a4) And I use them like this: // talkChannel typedef DWORD(...
user avatar
  • 131
1 vote
0 answers
29 views

How to convert addresses shown by IDA when statically analyzing a DLL to real addresses in runtime

In a DLL I am trying to reverse there often is a reference to something I believe to be a fixed pointer (like a global var) which looks like dword_10038534. The references I am talking about look like ...
user avatar
0 votes
0 answers
29 views

Restore debug symbol for a embedded .bin image with an .axf file

I'm currently trying to reverse an firmware image I dumped from a Realtek Ameba device. The image is a stripped RTOS in .bin format which unfortunately does not have any metadata for ida pro to ...
user avatar
0 votes
0 answers
35 views

How can IDA Pro disassemble paged memory from HCS12 processort?

I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory? If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it ...
user avatar
1 vote
1 answer
64 views

How to define an xmmword variable in IDA?

How to define an xmmword variable in IDA? IDA identified one variable as xmmword but I can't find a menu to define other variables around it as xmmwords: I also tried to set the type after pressing ...
user avatar
  • 206
1 vote
0 answers
32 views

In IDA is there a way to load the PE headers after the initial loading?

This question is loosely related to this one. So I know of manual loading and how to achieve loading the PE headers using it. But suppose I have already worked on an IDB for a while and realize that ...
user avatar
  • 10.5k
1 vote
0 answers
31 views

Warning: struct->til conversion failed

In IDA I noticed a particular struct (FAST_MUTEX) was actually part of a bigger struct whose size I could determine from the code. So I created a struct from the selection (Create struct from ...
user avatar
  • 10.5k
2 votes
1 answer
123 views

x86 - How do I detect virtualized code by looking at the assembly?

How can I detected virtualized code by say, vmprotect, obsidium or themida just by looking at the assembly code? I know that just looking at the PE section name would help, but I wanted to detect ...
user avatar
  • 49
1 vote
1 answer
92 views

idapython: how to reset pointer type for variables

I am using IDA Pro 7.6 on win32 x86 binaries. I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
user avatar
0 votes
2 answers
75 views

How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?

In IDA, I have the following disassembly code (from an old 16-bit DOS application) : les bx, _Foo mov word ptr es:[bx+84h], 0FFFFh mov word ptr es:[bx+8Ch], 0FFFFh mov word ptr es:[bx+...
user avatar
  • 331
1 vote
1 answer
70 views

how to get indirect callsite function return type and arguments

I am using idapython to get function return type and arguments @ an indirect call instruction. I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
user avatar
  • 1,437
0 votes
1 answer
31 views

Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?

As in the title. Maybe someone has any experience with this. It's a significant impediment when trying to debug Windows applications on Linux. I find hardware watchpoints, in particular, to be ...
user avatar
  • 115
0 votes
2 answers
43 views

IDA show xrefs in .pdata and nothing else

I'm debugging the Windows ARM64 version's EFI (bootaa64.efi). Using QEMU and GDB I was able to find that bootaa64.efi was stuck in one of the two functions BlKernelSp0SystemErrorHandler and ...
user avatar
0 votes
0 answers
68 views

reversed DOS game uncompression code: is that maybe a known compression method (RLE,...) or self-invented?

crossposted from stackoverflow - but i think stackexchange is better suited for such questions History: im currently working on reversing the game loader of the 1990 DOS game Alpha Waves Youtube i've ...
user avatar
  • 251
1 vote
0 answers
34 views

Why Qiling doesn't recognize the right EntryPoint?

I'm trying to emulate an EFI driver. Luckily, I found a nice emulator called Qiling and try to debug it with GDB but it doesn't recognize the right Entry-Point. Here is the Entry-Point in IDA and in ...
user avatar
  • 83
1 vote
1 answer
31 views

How to rename the text of grouped nodes after creating them in IDA?

After I group nodes in IDA in the Graph View and name them, I can't change the name. I tried Edit group text button: And Rename button: I also tried anterior, posterior, normal comment and ...
user avatar
  • 206
0 votes
0 answers
48 views

how open .dmp file x64 in ida pro

how open dump file (proccess x64) in ida pro? ida.cfg DBGTOOLS = "C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\"; DBGTOOLS = "C:\Windows\System32\"
user avatar
  • 21
0 votes
1 answer
74 views

Decompilers points to non-existing virtual function

As part of solving the Hidden password challenge, I found an condition calls a virtual function the v14 points to v8 variable : and the functions in the program does not make sense for me, there is ...
user avatar
0 votes
1 answer
61 views

Z3 is unable to predict the operand

When I try to solve this crackme chall (https://crackmes.one/crackme/61ffb07c33c5d46c8bcbfc1d) , there is a condition that I can't bypass and my z3 script can't predict the input string that will ...
user avatar
0 votes
1 answer
52 views

How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?

TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc). In order to explicitly load a type library I can use ...
user avatar
  • 10.5k
0 votes
0 answers
34 views

Is it possible to copy a video game and edit the copied version?

Sorry if this is a "dumb" question, but I couldn't find anywhere else to ask this. I want to "copy" my game of Super Smash Bros. Ultimate and edit/change in-game features. I also ...
user avatar
0 votes
1 answer
46 views

How to detect incorrectly named DLL?

I am trying a simple lab on malware analysis and we were given both an .exe and .dll file. However, I am told that the DLL will need to be renamed to something for it to work. How do I go about ...
user avatar
  • 1
1 vote
2 answers
87 views

IDA Free: How to patch a memory address

I have a disassembly line showing: lea rcx, Format In which Format is a memory address named by IDA. The address is at 0x1400132E0 and points to a C-String "hello, my dear\n". What I want ...
user avatar
0 votes
0 answers
26 views

Better debug output with IDA

I don't have much knowledge and experience with assembly so I value more or less readable IDA's pseudocode output. I want to examine stack and locals of the specific functions I set breakpoint in, ...
user avatar
  • 33
0 votes
1 answer
109 views

idapython: how to get decompiler output corresponding to the indirect call

For, e.g. disassembler or IDA view: Decompiler or Hex View: I can get the decompilation of whole function using something like: decompiled = ida_hexrays.decompile(ea) But, in this way I get the ...
user avatar
  • 1,437
0 votes
1 answer
59 views

Best way to monitor the access to a DLL of a software?

I'm currently analyzing a complex software which compiles a kind of code. By monitoring and correlating it with ProcMon I could figure out it loads a DLL as a module. Now I'm trying to find out how ...
user avatar
1 vote
1 answer
95 views

In IDA, what does the number of underscores prefixing a function name mean?

In IDA, in the Functions subview, many functions have one or more underscores in their name. I'm guessing the number of underscores implies something. Does anyone know what the number of underscores ...
user avatar
  • 21
1 vote
1 answer
68 views

IDA pro and compiler-optimized 1-based array accesses in structure

I know title isn't very clear so here is an example of a code I'm trying to disassemble: struct Inner { int field1; int field2; }; struct Outer { int some_data[16]; struct Inner the_array[16]; ...
user avatar
0 votes
1 answer
266 views

What is xmmword in IDA Pro?

Probably a silly question. What's the xmmword means in IDA Pro?
user avatar
1 vote
1 answer
76 views

Ida cannot open. a files of esp32 (Xtensa)

I tried to open this file with IDA Pro https://github.com/espressif/esp32-wifi-lib/blob/master/esp32/libpp.a Ida detect that is ELF for Xtensa (relocatable) But when I tired to open it I got Undefined ...
user avatar
0 votes
1 answer
125 views

IDA - What LOC means in assembly?

I have this piece of assembly: .text:0041B322 xor eax, eax .text:0041B324 mov al, byte ptr [ebp+v13] .text:0041B327 cmp eax, 1 .text:0041B32A jz loc_41B37D .text:0041B330 xor eax, ...
user avatar
1 vote
1 answer
172 views

Find DllMain using IDA Freeware

I want to use the IDA Freeware Version 7.7 for finding the DllMain of a DLL file. The file is from the book Practical Malware Analysis. It is for Lab 05. Name of file is "Lab05-01.dll" and ...
user avatar

1
2 3 4 5
39