Hot answers tagged

6 votes

How to add STL to Local Types in Ida Pro?

To parse templates you need to use the IDAClang plugin that comes with Ida Pro (I think it's not available with IDA Free). To add a single class/structure definition you can use IDAPython: import ...
overflo's user avatar
  • 268
5 votes
Accepted

IDA: Demangled name simplification in idapython

idaapi.get_ea_name(ea, idaapi.GN_SHORT|idaapi.GN_DEMANGLED) seems to return the filtered demangled name.
Igor Skochinsky's user avatar
  • 36.5k
5 votes
Accepted

How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?

Right-click on the operand, click "Manual...", enter the string "5 * 20". Note that this only works in the disassembly listing, and that there is no comparable functionality in the ...
Rolf Rolles's user avatar
  • 9,198
4 votes

How to highlight all external registers in a function

The answer to this question is to simply use Hex-Rays instead of IDA. It automatically does everything you've suggested, and the end result is the function's prototype, which will indicate register ...
Rolf Rolles's user avatar
  • 9,198
4 votes

How to bypass anti debugger? IDA Pro

I'll try to "teach you to fish" and provide a good general process to bypass these checks while debugging (without patching the binary) Set a breakpoint on the call of interest (e.g. ...
Kayla0x41's user avatar
4 votes

Problems with the display of constants in IDA Pro pseudocode

You can change the display of the constant by right-clicking. "Invert sign" is the one you want here, but there are seven options on that menu. That option will show you "-3" for ...
Rolf Rolles's user avatar
  • 9,198
4 votes
Accepted

Retrieve & dump type information from IDA Pro

It's obviously doable (you already noted the Create C header file functionality), but if you want to customize the output, you'll have to code it yourself. Here's what you'll need: ida_typeinf....
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

other than x32dbg, is there a more friendly way to check functions, their args and their return values on runtime?

Api Monitor is a great tool to hook api's, watch parameters and return values and optionally modify them before/after call. API Monitor is a free software that lets you monitor and control API calls ...
Remko's user avatar
  • 3,218
3 votes

Why are there more types in my ntoskrnl binary than my fltMgr binary?

I needed to load the types from ntoskrnl.exe into fltMgr.sys using File -> Load File -> Load PDB File.
EatingTechnobladesRemainsAt3am's user avatar
3 votes

IDA decompiler: show a "for" loop instead of a "while", is it possible?

If you write a Hex-Rays plugin to change the while loop to a for loop yourself, then yes, you can do it. If you're looking for something more like the ability to right-click on the loop and click ...
Rolf Rolles's user avatar
  • 9,198
2 votes

Get current file name with IDApython

There are three functions exposed by ida_nalt and two of those aliased from idc module. idc.get_root_filename = ida_nalt.get_root_filename Returns the file name only (no leading path elements; old ...
2 votes

What is the meaning of this message in IDA?

What is the meaning of this message in IDA? When you load a file into Ida (.exe, ⁣.dll, ⁣.bin,,.hex, etc.), it creates at least one segment for the memory address (you can add or remove segments on ...
E.A's user avatar
  • 171
2 votes

Unable to perform remote debugging with IDA Pro in WSL

I do not know it is the issue or not, but when I change to Remote Debugging with Linux Debugger rather than GDB, I could do it well. I do not know sure but I also install Pwndbg along GDB, maybe it ...
Anh Nguyễn Tuấn's user avatar
2 votes
Accepted

Ida+Windbg alternative of Olly's "Back to user code" feature

I've got found incredibly good plugin for IDA. The tools: PixtopianBook.exe (lena151's 4th tutorial). IDA 7.6 x86. Funcap python script for ida. The task: Do any action and find out which function ...
  tejinaji's user avatar
2 votes

Understanding the logic behind decompiled code

Are you sure TO_UPPER's purpose is uppercasing? The strings are all in uppercase anyway and it seems like it returns an index from an iterator rather than a modified character. If you take a look at ...
mimak's user avatar
  • 579
2 votes

Identify mod operation in ARM firmware with IDA

An option in these cases is to compile a relevant code snippet with appropriate architecture options and see what assembly is generated. For example, take this code. long mod17( long x ) { return ...
Ian Cook's user avatar
  • 2,523
2 votes
Accepted

How to version control an IDA project?

There's IDArling plugin made just for this purpose, it allows for real-time syncing and remote snapshot storage. IDB files of large binaries can reach gigabytes in size hence git storage could get a ...
mimak's user avatar
  • 579
2 votes
Accepted

IDA Pro failed decompilation with "JUMPOUT"

This failure happens as a result of A) the intentional obfuscation, and B) what the compiler community calls a "phase-ordering" problem. When Hex-Rays decompiles a function, it begins by ...
Rolf Rolles's user avatar
  • 9,198
2 votes
Accepted

How to quickly mark functions library in IDA Pro?

Here's how you can automate the labelling process: import idc, idautils FUNC_LIB = 4 # Here go your selected functions # This labels everything unless you specify the start/end args funcs = idautils....
mimak's user avatar
  • 579
2 votes
Accepted

Tool to analyze .obj files (not COFF) created with /LTCG

I don't know of any tools that can analyze or disassemble CIL bytecode, but what you can do is to link those files and produce normal machine code. E.g. something like: LINK 1.obj /force /debug /dll /...
Igor Skochinsky's user avatar
  • 36.5k
2 votes

Inspect executable binary similarity

The file you got is not a binary executable in a common format. IDA Pro can understand ELF and a lot more of executable formats. If its best detection is binary it means the file is not in any of ...
Margaret Bloom's user avatar
2 votes

Inspect executable binary similarity

I think you're on the right track about the XOR obfuscation: XORing each 4 byte block of the "infringing app" file with hex 55FFAAFF, and then XORing the second and fourth byte of each block ...
Ilmari Karonen's user avatar
2 votes
Accepted

When parsing a C header file in IDA, is there a preprocessor symbol I can use to detect it?

From IDC: Predefined symbols (emphasis mine): The following symbols are predefined in the IDC preprocessor: _NT_ IDA is running under MS Windows _LINUX_ IDA is running under ...
Igor Skochinsky's user avatar
  • 36.5k
2 votes
Accepted

Where is IDA getting this symbol?

(reposting as an answer) IDA uses FLIRT signatures to try and identify known library functions. Functions found in this way would normally be marked as library functions and will be displayed in IDA ...
Yotamz's user avatar
  • 1,093
1 vote

How to version control an IDA project?

There is another project available (I have no affiliation), which may also fit the bill: BinSync The GitHub organization can be found here.
0xC0000022L's user avatar
  • 10.9k
1 vote

Is there a way to find all constant pointers in IDA Pro?

Using Sark's lines for brevity, this should return all the cross-referenced data addresses (with duplicates): import idautils, sark for line in sark.lines(): for ref in idautils.DataRefsFrom(line....
mimak's user avatar
  • 579
1 vote

Disassemble MS-DOS 2.0 boot sector

I hope I understood this code correctly. :) These instructions move data into memory locations. So basically if code exists there, it will be overriden and instructions will change their meaning. ...
Nassau's user avatar
  • 111
1 vote

Disassemble MS-DOS 2.0 boot sector

Interrupt vector table on 8086 is a vector that consists of 256 total interrupts placed at first 1 kb of memory from 0000h to 03ffh, where each vector consists of segment and offset as a jump table to ...
Igor Matyuh's user avatar
1 vote

How to reverse a USB firmware patching tool for another device?

I've made a quick research - if you're getting [!] No devices found prompt this is likely due to the updater getting no adapter results with the below WQL query: I guess checking if you have ...
mimak's user avatar
  • 579
1 vote

How can I disassemble/decompile an immediate value to multiplication/summation of two values with IDA Pro?

At the assembly level, IDA reconstructs the instructions as seen in memory. Constant multiplication adds an overhead of at least one additional instruction (like MUL or MLA for ARM CPUs); when a ...
mimak's user avatar
  • 579

Only top scored, non community-wiki answers of a minimum length are eligible