Hot answers tagged

2 votes
Accepted

how to get indirect callsite function return type and arguments

Don't use regular expressions. Generally speaking, never use regular expressions to solve problems in IDA. All of the text you'd be operating upon is available as data via the API, which provides a ...
user avatar
  • 7,799
2 votes

x86 - How do I detect virtualized code by looking at the assembly?

That's tricky because obfuscated code often looks similar regardless of whether or not it specifically uses virtualization obfuscation. Most VMs ultimately have a similar high-level structure, as laid ...
user avatar
  • 7,799
2 votes

IDA 7.5 Show the Progress from Auto Analysis?

the Progress of Autoanalysis of IDA main logic there is two level=hierarchy: refer here, general total 12 step=pass for autoanalysis: FL:<address> execution flow is being traced PR:<address&...
user avatar
  • 121
1 vote

How to call and what means: _DWORD *__thiscall

Basically I've checked with Ghidra to compare and I've found that the signature is different: void __thiscall FUN_00142860(int param_1_00,undefined4 *param_1,int param_2) So, basically I just ...
user avatar
  • 31
1 vote
Accepted

How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?

The Hex-Rays decompiler will automatically respond to changes in local or global variable types, and automatically display the memory dereferences as proper structure references. The same is not true ...
user avatar
  • 7,799
1 vote

Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?

From my experience a good consistent debugging experience is not possible yet when running applications via Wine on Linux. You will often have to rely on using debug channel logging via environment ...
user avatar
1 vote

How to rename the text of grouped nodes after creating them in IDA?

I was checked on IDA v7.6.210427 and v7.7.211224 (MacOS). I have not been able to reproduce your problem, everything works fine. I recommend you check the installed plugins. It is possible that the ...
user avatar
  • 76
1 vote
Accepted

How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?

To unload a type library you can use del_til function from typeinf.hpp. Usage with IDAPython: import ida_typeinf ida_typeinf.add_til("ntapi64_win7", ida_typeinf.ADDTIL_DEFAULT) # load a til ...
user avatar
  • 76
1 vote

IDA Pro S12X flash page references

I'm also trying to do some reverse engineering with an MC9S12X. What i know is that it uses PPAGE register at 0x0030 of local address space to the which 16k page is shown at 0x8000. IDA has concept of ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible