Hot answers tagged

4

Disclaimer: I'm going to expose my workflow when I see similar things. I'm not telling you that this is the best one or the faster, and I'm sure you have a lot of other way to deal with this. But this should give you an insight on how you can do this. As your question is really wide and does not contain any details (malware name, hash, or what 'failed to ...


1

When in ida you use patch byte, patch word, or assemble, the patch is NOT applied to the base executable. You just have to go to Edit-> Patch program -> Apply patches to input file. Then your input file is modified now.


1

I don't know how my tools are doing it under the hood, but if I had to do it myself, I would search for some function's prologues related to my architecture of choice. This is a good 'signature' to identify a function, as this is something standard (even if you may find some cases where a function doesn't have any prologue/epilogue). As you may know, the ...


1

A handle is an abstract object. I am assuming that you are using IDA for static analysis, and that you are not using any embedded debugger through IDA. Correct me if it's not the case. From a static analysis point of view, you can't trace back the object where is comes from only with its value (100 in your exemple). The handle value is going to be different ...


1

Since this is obviously a pain to do statically or by hand in a dynamic fashion, I would suggest trying another approach. I personally would try to do it by writing a small emulator. Since it is mostly 'stack arithmetic' and junk code, this would be perfect. Take a look at the emulation framework named 'Unicorn'. With this option, you don't have to re-...


1

The easiest way is to get a build of libstdc++ with DWARF debug symbols e.g. by downloading it from the Debian repositories https://packages.debian.org/buster/libstdc++6-7-dbg. In general you can also compile it yourself, but for common libraries Debian tends to have a version built with debug symbols already. You can then auto analyse it (or run only the ...


1

bFLT format is mostly used by the uCLibc based tool chains and even there the build happens to ELF which is then converted to bFLT, so it’s unlikely you’ll find a GDB which supports bFLT directly. However, you may be able to debug it by attaching to the QEMU’s GDB port (target remote command).


1

Since Android 10.0, it has move some of its important library into different path ( including libc.so ) so IDA can't automatically found where it is like it used to. You need to execute export IDA_LIBC_PATH=/apex/com.android.runtime/lib/bionic/libc.so to tell IDA where libc.so can be found.


1

Updating answer for IDA Pro version 7.5, using Python 3: ida_kernwin.jumpto(ea)


Only top voted, non community-wiki answers of a minimum length are eligible