12
I don't know if many people know this, but IDA uses some kind of a trick to decide if a segment is an imports segment, and handles it completely different.
IDA uses a few segment properties to treat a segment as an imports segment. for example, naming a segment .idata, or setting the segment's class to XTRN will immediately make it an imports segment. such ...
8
if adding an extra import section to the PE file is an acceptable option
use tools like iidking and add an import section with all the imports that are resolved dynamically
use add cross referances dialog or idc add_dref() to add cross references to them
code for demo
#include <stdio.h>
#include <windows.h>
#pragma comment(lib , "...
5
If you can not add something to the imports viewer you can write your own.
Here is the simple example (it is slightly modified example referenced at this hexblog entry and located here with added double-click functionality, added columns, removed exports and fixed bug for a case of unknown origin of the imported function). See the function BuildImports for ...
3
The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.
Besides the theoretical research, it is often an difficult issue to address even by skilled and trained reverse engineers. In certain cases it can be nearly ...
3
I think you're talking about changing the appearance of Qt widgets and not only IDA widgets. If so, take a look at zyantific/IDASkins python plugin.
There're also plugins in C++ if you prefer it.
3
The common base64 key contains ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/. However, remember that IDA Pro will convert ASCII text for you, so you should have no reason to go looking through the raw bytes of the file in hex. In fact, even a hex editor such as HxD or 010 Editor will convert the string data from hex bytes to chars and ...
2
IDA does not support debugging .NET binaries or more specifically the CIL bytecode. To debug managed code you can use WinDbg with the SOS debugging extension (SOS.dll).
You can also use dnSpy which in addition is able to use the decompiled code for debugging make the experience similar to debugging with source code.
2
Create two Python-functions (menu File-Script command...). First for printing EAX and second - for printing memory @FF27790
def view_ecx():
print GetRegValue("ecx")
def view_memory():
print Byte(0xFF27790)
Set breakpoints:
@.text:0FD6268D - set condition view_ecx() and choose Python-type
@.text:0FD62693 - set condition view_memory() and ...
1
Your Python code executes inside IDA’s process so you are getting results of the call on IDA, not the debuggee. If you want to execute code inside the process being debugged, you can use Appcall: http://www.hexblog.com/?p=113
1
You could run Yara with a set of crypto signatures. Is something like this what you are looking for?
1
One of the ways that I have taught (see Day 1 Part 11) to find a base64 alphabet is to look for a sequence of 64 bytes with an Shannon entropy of 6 (on a scale of 1-8). Beware that in addition to Base64 alphabets, that will also find other high-entropy data, such as compressed or encrypted code or strings, as well as encryption constants.
For your standard ...
1
Okay, to formalize this (and since I have some time now to type up an actual answer).
The add_hidden_range() IDC function and the SDK function of the same name (bytes.hpp) can be used for the purpose. (However, I am almost sure there was another function I used at the time.)
update_hidden_range() may also be of interest (see link above).
When I used this ...
Only top voted, non community-wiki answers of a minimum length are eligible
