13
I don't know if many people know this, but IDA uses some kind of a trick to decide if a segment is an imports segment, and handles it completely different.
IDA uses a few segment properties to treat a segment as an imports segment. for example, naming a segment .idata, or setting the segment's class to XTRN will immediately make it an imports segment. such ...
8
if adding an extra import section to the PE file is an acceptable option
use tools like iidking and add an import section with all the imports that are resolved dynamically
use add cross referances dialog or idc add_dref() to add cross references to them
code for demo
#include <stdio.h>
#include <windows.h>
#pragma comment(lib , "...
6
I can only properly answer your first question:
I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find)
If your "firmware" is a filesystem that you can unpack, you can automatically load the libraries by:
Opening the regular Import File... dialog
Clicking Options inside ...
5
If you can not add something to the imports viewer you can write your own.
Here is the simple example (it is slightly modified example referenced at this hexblog entry and located here with added double-click functionality, added columns, removed exports and fixed bug for a case of unknown origin of the imported function). See the function BuildImports for ...
3
Create two Python-functions (menu File-Script command...). First for printing EAX and second - for printing memory @FF27790
def view_ecx():
print GetRegValue("ecx")
def view_memory():
print Byte(0xFF27790)
Set breakpoints:
@.text:0FD6268D - set condition view_ecx() and choose Python-type
@.text:0FD62693 - set condition view_memory() and ...
3
I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
3
The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.
Besides the theoretical research, it is often an difficult issue to address even by skilled and trained reverse engineers. In certain cases it can be nearly ...
3
I think you're talking about changing the appearance of Qt widgets and not only IDA widgets. If so, take a look at zyantific/IDASkins python plugin.
There're also plugins in C++ if you prefer it.
3
The common base64 key contains ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/. However, remember that IDA Pro will convert ASCII text for you, so you should have no reason to go looking through the raw bytes of the file in hex. In fact, even a hex editor such as HxD or 010 Editor will convert the string data from hex bytes to chars and ...
2
IDA does not support debugging .NET binaries or more specifically the CIL bytecode. To debug managed code you can use WinDbg with the SOS debugging extension (SOS.dll).
You can also use dnSpy which in addition is able to use the decompiled code for debugging make the experience similar to debugging with source code.
2
If you rename things outside of pseudocode view, it’s not updated automatically and you need to press F5to refresh decompilation with current data.
2
For decades, IDA's plugin interface remained the same. Your plugin had to export a plugin_t structure named PLUGIN, which contained function pointers to its init, run, and optional term functions. You can see that in your snippets above.
IDA 7.5 introduced a new plugin interface for C++ plugins, based on inheritance from the plugmod_t interface, seemingly ...
2
Not possible, either through a configuration option or through a plugin. For example, here is the part of the code that prints the [rbp-1Fh] from your example:
qsnprintf(v16, v36 - v16, "[%s%c%ah]", gpPlatformStackPointerName, v20, v29);
I.e. the format string that produces it is hard-coded in the binary and cannot be modified.
2
After some research time, I found a way to do it in CPP but not in python.
https://github.com/SentineLabs/Memloader/blob/main/MemoryLoader/MemoryLoader/MemoryLoader.cpp
The most relevant part of the code dealing with loading PEs from buffer to memory:
void destroy_linput(linput_t* li)
{
close_linput(li);
}
linput_t* create_linput(std::vector< bit7z::...
2
I am not sure about a plugin. But, this answer gives an IDC script for similar purpose.
I also wrote a script to get called function graph a long time ago. You can leverage this and tweak this according to your needs (idapython).
def generate_graph():
callees = {}
# loop through all functions
for ea in idautils.Functions():
...
2
IDA works with FLIRT (Fast Library Identification and Recognition Technology) signatures. These “signatures” are basically sequences of assembly instructions that are found in functions. IDA has built-in signatures for common libraries. You can find signatures for other libraries, or create your own for functions you identify.
IDA also reads given names ...
1
A handle is an abstract object.
I am assuming that you are using IDA for static analysis, and that you are not using any embedded debugger through IDA. Correct me if it's not the case.
From a static analysis point of view, you can't trace back the object where is comes from only with its value (100 in your exemple). The handle value is going to be different ...
1
idaapi.op_seg(idc.get_screen_ea(), -1)
idaapi.op_stkvar(idc.get_screen_ea(), -1)
1
To have an overview of called API in a function you can use Graph feature without pluging :
select function
click on menu View > Graphs > Users xrefs chart...
in Starting Direction check only Cross references from
in Ignore group, check all except Externals
1
IDA 7.0 is a 64-bit program and cannot load 32-bit PLW files. The plug-in needs to be ported and recompiled for the new API:
https://www.hex-rays.com/products/ida/news/7_0/docs/api70_porting_guide/
1
You could run Yara with a set of crypto signatures. Is something like this what you are looking for?
1
The PE header area is not loaded into the database by default but you can do it by enabling “manual load” in the initial load dialog. However, the copy of the header is saved in the database and can be accessed using the idautils.peutils_t class.
1
There’s no built-in functionality for that, it’s too target-specific to be useful as standard API. What you can do is to retrieve the list of exports and/or imports for the file which was used to create the database. If you need the low-level IAT details you’ll have to parse it manually from memory or database (not sure if database keeps enough information ...
1
You can generate graphs in the DOT format by calling gen_flow_graph() with the CHART_GEN_DOT flag.
The DOT file can then be imported into networkx using the from_pydot() function.
1
You can use get_input_file_path() IDC function and then extract the file name from it.
It's also available in IDAPython as ida_nalt.get_input_file_path (source).
1
You can't use Python 3 and Python 2 in IDA simultaneously, but you can switch between them by following instructions in README_python3.txt.
1
In ARM the syscalls are either Supervisor call or Software interrupt.
You can just search->text in IDA for:
SVC 0x
SWI 0x
1
I also had this question. The only solution I've found involves using the Capstone Python bindings in conjunction with IDA. The method call is regs_access https://www.capstone-engine.org/op_access.html
1
Your Python code executes inside IDA’s process so you are getting results of the call on IDA, not the debuggee. If you want to execute code inside the process being debugged, you can use Appcall: http://www.hexblog.com/?p=113
1
One of the ways that I have taught (see Day 1 Part 11) to find a base64 alphabet is to look for a sequence of 64 bytes with an Shannon entropy of 6 (on a scale of 1-8). Beware that in addition to Base64 alphabets, that will also find other high-entropy data, such as compressed or encrypted code or strings, as well as encryption constants.
For your standard ...
Only top voted, non community-wiki answers of a minimum length are eligible
