Hot answers tagged

52

Some other disassemblers / decompilers W32Dasm W32DASM was an excellent 16/32 bit disassembler for Windows, it seems it is no longer developed. the latest version available is from 2003 Capstone Capstone is a lightweight multi-platform, multi-architecture disassembly framework. BORG Disassembler BORG is an excellent Win32 Disassembler with GUI....


46

iOS applications are protected by a Apple's DRM system. That system encrypts certain segment(s) of the application. The keys to that encryption are, as far as I know, unique per device or per device platform. I haven't spent much to with FairPlay so I don't know what the encryption keys are but I suspect it's either the GID key or the UID key. I would ...


32

This depends on the compiler originally used as each creates slightly different layouts. You can find tutorials for most compilers on the net, I'm going to focus MSVC as that's the one I have experience with, and since it provides a hidden compiler switch printing how classes will be layouted in memory which I'm going to use for illustration. As you might ...


30

I have thought carefully before adding this as "Another Answer" rather than editing my existing answer that I posted above this morning. I feel that this answer deserves another post of its own as it's not just a simple continuation of the material posted in my answer above. I have spent over 2 hours on this post to avoid just cutting and pasting content ...


28

Well, I managed to figure it out. If you click on the small gray bar just below the titlebar, you can drag it back to the main window. If you hover over the gray bar, it will tell you as much, but the fact that it's just below the titlebar (which is what you'd normally click to drag the window around), it's easy to miss. Edit: If you want to reset all tabs ...


24

Reverse - Reverse engineering tool for x86/ARM/MIPS. Generates indented pseudo-C with colored syntax code. SmartDec (aka Snowman) is a native code to C/C++ decompiler. Supports PE and ELF (both 32 and 64bit) also has plugin modules for IDA (6.1, 6.4, 6.5). Currently supports Intel x86 and x86-x64 architectures. C++ reconstruction supports the 32-bit ABI ...


23

Have a look at the var_4 definition at the start of the function: var_4 = dword ptr -4 So it's actually negative as expected. For a more complete picture, use Ctrl+K or double-click/Enter on the stack var to see the stack frame layout: -00000018 ; Two special fields " r" and " s" represent return address and saved registers. -00000018 ; Frame size: 18; ...


23

you can add a function type by editing it (Key Y) and adding the name. I wrote a page to remind me about calling conventions at ASM level. Introduction the original call is myfunc(0,1,2,3,4). standard order is first argument is pushed last. standard stack adjusting is 'callee cleanup' - after returning, the stack should be without its calling arguments. ...


22

Because this is really hard to do. To elaborate: You'll also need to extract things that are not code. Think of import tables, export tables, strings and other data. When you write code, this is only one part of the program. The other part is the Compiler Optimizations and data section. This makes it almost impossible to create re-compilable assembly. If ...


21

I'm answering from a C++ viewpoint, other languages have different reasons. There are legitimate uses for these functions, even if they are nothing more than void func(/* any args */) {} One example that comes to mind is a virtual function that does nothing in a base class but is overridden in a derived class. A similar example would be a template ...


21

Very easy, if I got you right: Make an Ida project from the DLL, i.e. drag and drop the dll into the blank Ida page. In Menu Debugger, Process Options, put the path to your exe into the textbox "Application", Into "input file" put the path to your DLL. Confirm with OK. Start with menu Debugger, Start Process or F9. Your breakpoint should be hit.


21

As promised, I am back to post a more specific answer to the question that was asked by the OP. Decided to write this as a separate answer as I believe that this content stands out on its own and would not properly fit in with either of the two answers that I posted above. Addressing his first issue : In this case though, the whole settings is a ...


20

Well you have to first Undefine the code using U key and they select the code and right click you will have some options like C (code) and so on. IDA almost give you ability of doing anything wih obfuscated code to help you to understand code correctly. Addendum After converting to C (code), do Alt+P to create/edit function. In addition, rebuild layout ...


20

This is from the IDA Pro book, but even IDA, as good as it is, is still in the end making guesses. The answers here are from "The IDA Pro Book" by Chris Eagle. "Why there are not any disassemblers that can generate re-assemblable asm code targeting on benign program (one without obfuscation) ?" The compilation process is lossy. At the machine ...


17

It is important to understand that PEiD could potentially be identifying the wrong version of Delphi. While Delphi 6/7 are very similar (and frankly, all the way up to Delphi 2007 are very similar), you may be looking at a binary created with Delphi 2009 or newer. This is relevant because Delphi 2009 introduced native unicode string support and mapped the ...


16

You have a mix up here. There is no such thing as dynamic disassembly and static disassembly but rather dynamic Dynamic program analysis is the analysis of computer software that is performed by executing programs on a real or virtual processor. and static analysis of a binary. Static program analysis is the analysis of computer software that is ...


16

The easiest way to get this done is simply by opening the Options -> General -> Disassembly window, and setting the "Number of opcode bytes (Graph)" field to the number of opcode bytes you wish IDA to show you in the both the graph and linear disassembly listing views. This is how the configuration change should look: And the result of doing that will be ...


16

Enter the "strings window" by either press shift+F12 or go to View > Open Subviews > Strings in the toolbar. Then, in the strings window, press Right Click and choose "Setup...". Check "Unicode" and press "OK".


15

IDA Pro offers two tracing options: Instruction tracing Debugger->Tracing->Instruction Tracing It is very slow tracing process, since IDA monitors registers and has to record the address, the instruction, and changes values of registers, that were changed by the instruction. Function tracing Debugger->Tracing->Function Tracing. It is a subcategory of ...


15

I found the solution. Double click the variable name (configSpaceBuffer in this case) which brings up the stack window for the method where you can undefine the invalid variables and then define it as an array. Here is the output after this change: _this->ConfigSpace1 = configSpaceBuffer[1]; _this->ConfigSpace0 = configSpaceBuffer[0]; ...


15

I lack 9 reputation points, so sadly I can't comment the great answer by w_s. ;) Just for completeness, the concept described is known in graph theory as "Tarjan's Algorithm" for finding strongly connected components. Wikipedia has a nice animation that helps following the steps. For study, here is another (more formal) Python implementation, it's the ...


15

I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea). Let's imagine we start with a function prototype: int __cdecl main(int argc, const char **argv, const char **envp) That's from an ELF file, x86 abi; stuff is passed on the stack. Then, I can do the following: Python>...


15

In x86-64, any operation that affects only the lower 32 bits of a register automatically zeros out the upper 32 bits. The relevant part in the Intel Architecture manual is in Volume 1, 3.4.1.1, which states: When in 64-bit mode, operand size determines the number of valid bits in the destination general-purpose register: 64-bit operands ...


14

Relyze is a commercial interactive disassembler for x86, x64 and ARM software with loaders for PE or ELF file formats. It supports interactive flat and graph views of the disassembly, generating call and reference graphs, binary diffing two executables, exploring the executable file's structure and a Ruby plugin API. It can also handle things like symbols (...


14

Create a struct Apply the struct in one the four ways: use the T hotkey. Right-click the operand and choose the struct from "Structure offset" submenu. menu Edit|Operand types|Offset|Offset (struct) use the corresponding button on the Operand Type toolbar Here's a short tutorial: https://www.hex-rays.com/products/ida/support/tutorials/structs.shtml


14

I believe this strange stuff comes up due to Name Mangling it is also known as name decoration. Name Mangling is mechanism used by compilers to pass semantically relevant information from compilers to linkers. This is how Wikipedia describes Name Mangling for Visual C++ series of compilers: Visual C++ name mangling is a mangling (decoration) scheme used ...


14

All Hex-Rays macros are defined in <IDA directory>\plugins\defs.h. It's also available at https://github.com/nihilus/hexrays_tools/blob/master/code/defs.h For BYTE3(x): ... #define BYTEn(x, n) (*((_BYTE*)&(x)+n)) ... #define BYTE3(x) BYTEn(x, 3) ... So BYTE3(x) yields (*((_BYTE*)&(x)+3)), which effectively means the fourth byte of the ...


14

It has the fingerprint of an assert: it's called directly after a test; it uses a number -- probably a source line number --, a string which points to a file name -- the source file -- and a string that describes an error condition; it does not return. (Can be inferred because the inspected value would lead to an erronous situation if the called function ...


14

I highly recommend radare2 which seems to suit you the best: radare2 is an open source framework for reverse engineering and binary analysis which implements a rich command line interface for disassembling, analyzing data, patching binaries, comparing data, searching, replacing, visualizing and more. It has great scripting capabilities, it runs on ...


13

I don't know if many people know this, but IDA uses some kind of a trick to decide if a segment is an imports segment, and handles it completely different. IDA uses a few segment properties to treat a segment as an imports segment. for example, naming a segment .idata, or setting the segment's class to XTRN will immediately make it an imports segment. such ...


Only top voted, non community-wiki answers of a minimum length are eligible