2
votes
Accepted
how to get indirect callsite function return type and arguments
Don't use regular expressions. Generally speaking, never use regular expressions to solve problems in IDA. All of the text you'd be operating upon is available as data via the API, which provides a ...
- 7,799
2
votes
x86 - How do I detect virtualized code by looking at the assembly?
That's tricky because obfuscated code often looks similar regardless of whether or not it specifically uses virtualization obfuscation. Most VMs ultimately have a similar high-level structure, as laid ...
- 7,799
2
votes
IDA 7.5 Show the Progress from Auto Analysis?
the Progress of Autoanalysis of IDA
main logic
there is two level=hierarchy:
refer here, general total 12 step=pass for autoanalysis:
FL:<address> execution flow is being traced
PR:<address&...
- 121
1
vote
How to call and what means: _DWORD *__thiscall
Basically I've checked with Ghidra to compare and I've found that the signature is different:
void __thiscall FUN_00142860(int param_1_00,undefined4 *param_1,int param_2)
So, basically I just ...
- 31
1
vote
Accepted
How to set a variable as "pointer to struct" in IDA in order to automatically replace offsets by field names?
The Hex-Rays decompiler will automatically respond to changes in local or global variable types, and automatically display the memory dereferences as proper structure references. The same is not true ...
- 7,799
1
vote
Debugging Windows applications on Linux: Hardware watchpoints and backtracing in IDA not working and winedbg hardware watchpoints borderline unusable?
From my experience a good consistent debugging experience is not possible yet when running applications via Wine on Linux. You will often have to rely on using debug channel logging via environment ...
- 1,091
1
vote
How to rename the text of grouped nodes after creating them in IDA?
I was checked on IDA v7.6.210427 and v7.7.211224 (MacOS).
I have not been able to reproduce your problem, everything works fine.
I recommend you check the installed plugins. It is possible that the ...
- 76
1
vote
Accepted
How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?
To unload a type library you can use del_til function from typeinf.hpp.
Usage with IDAPython:
import ida_typeinf
ida_typeinf.add_til("ntapi64_win7", ida_typeinf.ADDTIL_DEFAULT) # load a til ...
- 76
1
vote
IDA Pro S12X flash page references
I'm also trying to do some reverse engineering with an MC9S12X.
What i know is that it uses PPAGE register at 0x0030 of local address space to the which 16k page is shown at 0x8000.
IDA has concept of ...
- 21
Only top scored, non community-wiki answers of a minimum length are eligible