Hot answers tagged

6

test is basically an and instruction except it doesn't update the left operand. In the other hand, cmp is the equivalent of sub instruction except it doesn't update the left operand. To sum up: if (v & n) Is compiled as test instruction. if (v == n) Is compiled as cmp instruction (or test reg, reg is n is 0x0) v = a & n Is compiled as and ...


6

You can make it a function by placing a cursor to address 00415A2C in disassembly view and pressing P. If this doesn't work you can select the whole function and, again, press P. The documentation on this action is located here. If all this doesn't work, undefine align 10h by pressing U, make resulting bytes code by pressing C and try again. There are a lot ...


4

You could create a loader which simply creates your target app in suspended state and loads dll into virtual address space of that process. That way the dll you injected would run before entrypoint of the target app. Example code: STARTUPINFO si; PROCESS_INFORMATION pi; ZeroMemory(&si, sizeof(STARTUPINFO)); ZeroMemory(&pi, sizeof(PROCESS_INFORMATION)...


4

When you encounter this kind of error, just make sure that the stack pointer is aligned. Go to Options tab. Click General... Click the Stack Pointer. It will show the stack pointers at the left side. Click the sub esp, 0x15c, press Alt+k, then click OK. So it must be able to solve your problem. Press F5.


4

Open the binary in IDA View (assembly view). Place the cursor in the line that you want to patch. Click Edit in menu bar > Patch Program > Change bytes. Switch to "Hex View". Match the assembly mnemonic with the HEX value. This vary with every instruction. For example, cmp [rbp-4], 4 (in X86_64) is shows as 83 7D FC 04. Press F2 to edit in hex view. Edit ...


4

The default dialog you’re seeing uses so-called “linear addresses” which are global for the whole program and can not intersect. It is mostly useful for processors with unified (Von Neumann) address space. Since 8051 is a Harvard architecture with separate code and data memories, each one starting at zero, IDA emulates it by creating non-intersecting ...


4

The third one is an array to environment variables that this program has access to. If you read the documentation of execve it reads as follows: The argument vector and environment can be accessed by the called program's main function, when it is defined as: int main(int argc, char *argv[], char *envp[]) Note, however, that the use of a third ...


4

When I assembled the code, the offending instruction was: 0x6c 40 ff d1 call rcx You will need to use Change Stack Pointer command in IDA to fix this in disassembly. As per IDA documentation: This command allows you to specify how the stack pointer (SP) is modified by the current instruction. You cannot use this command if ...


3

I think you're talking about changing the appearance of Qt widgets and not only IDA widgets. If so, take a look at zyantific/IDASkins python plugin. There're also plugins in C++ if you prefer it.


3

Short answer is that both idaapi and idc modules should be avoided if possible. The idaapi module is there for backwards compatibility and should be avoided if possible. It will be dropped in a future version of IDA (probably with little to no warning ahead of time). You should strongly prefer the ida_ prefixed modules. In older versions of IDA, a single ...


3

This is quite easy with IDA Pro: With the cursor at the first instruction you want to modify go to Edit | Patch Program | Assemble Change the instruction(s) as required until you are done, then press OK Finally choose Edit | Patch Program | Apply patches to input file (and optionally make a backup). Here is an example: https://www.remkoweijnen.nl/blog/...


3

There doesn't seem to be a straightforward way to achieve this. But you can take a look at this page of the IDA SDK documentation. According to the description of the previous page, we can write a little helper function: def size_of_operand(op): tbyte = 8 dt_ldbl = 8 n_bytes = [ 1, 2, 4, 4, 8, tbyte, -1, 8, 16, -1, -1, 6,...


3

To clarify this thread: C-Sky CPU's are a 16/32 bit variable length instruction set ISA in SoC & PoC packages, that appear to be MIPS-like, that can be switched to execute code in big or little endian. The CK610M is a v1 ISA, which has the MMU, so it is able to run Linux, which contains support as of v4.19. There are currently (since October 2018) a $...


3

An easy way to do this is to modify the IAT (Import Address Table/Import Directory) which can be done with a tool such as LordPE. From the main screen choose PE Editor and select the executable (or DLL) that you wish to modify: Then click Directories: Click the Ellipsis button next to Import Table: Right Click and choose add import: Now add your dll and ...


3

You're in luck; I wrote an article about that last year. I didn't know at the time that the obfuscator in question was Obfuscator-LLVM, but indeed, it was (albeit a version that was integrated into the MSVC toolchain). I even published full source code.


3

These names are mangled. You need to demangle it back. 1 - Read something about name mangling in order to understand why clear IORegistryEntry::getProperty(OSString const*)const is converted to __ZNK15IORegistryEntry11getPropertyEPK8OSString . 2 - Use demangling in IDA python (idc.demangle_name or ida_name.demangle_name). 3 - If something goes wrong, you ...


3

In version 6.x of Ida (tweaks will likely need to be made for more recent versions), you would want walk each Segment, then you can enumerate each Function, and from there, run the hexrays decompiler. This will enumerate all the functions, dump the pseudo code, and then search for the string 'foobar': import sys, idc, idautils, idaapi # Writes out the C ...


3

So, a complete answer would be worth a series of blog posts but I'll try to touch the high points: While you can use different seg:base pairs to refer to the same location, in real code it rarely happens. Code segments use the same base for all their functions and do not intersect with neighbors. However, they sometimes do not start or end at the exactly 16-...


3

xxtea encrypt with KEY: sxpDM2018 result FightLogic.lua how find the KEY IDA look at Function window press CTRL+F and type xxtea_decrypt. double click first item and scroll up to see cocos2d::FileUtilsAndroid::getData double click cocos2d::FileUtilsAndroid::getData and press F5 to decompiler look at image xxtea_decrypt, you can see v34 is KEY scroll up ...


2

I know that this question was asked some time ago, but here comes the solution working on Windows. Note: See the last section of this answer to get the solution for other systems and architectures. x86 32 bit files OllyDbg2 is the tool that can be used for logging every single assembly instruction along with memory reads and writes. A short guide how to ...


2

As a generic, incomplete answer: switch analysis is a common source of failure in using Hex-Rays (and even IDA). You can fix these errors by manually editing the switch information using Edit->Other->Specify switch idiom with your cursor somewhere near the beginning. However, I can't give you complete instructions on how to do this. My best advice is ...


2

When working with the architecture that you don't know, it's better to start with getting familiar with the assembler generated by the compiler for this architecture. If you google for "V850 compiler" you will find C Compiler and IDE for V850 Family at Renesas site. Most likely it's the compiler that was used by the firmware developers. Then you install the ...


2

The recent release of IDA 7.0 Free (March 2019) supports local debugging. The description on the website hasn't been updated yet, but see the following tweet by one of the IDA authors: Yes, we released the new IDA Freeware at the beginning of March, and yes, it includes native debuggers for all platforms. (Ilfak Guilfanov) Source: Twitter Still, no ...


2

Although you can use several tools, I would suggest you to use GDB if possible, since it has a built-in feature of breaking at each function call. Now, what you can do, is to run your program two times - first, without pressing buttons, and second, with doing so. I'm attatching a python script that will print each function call with a number of calls to it, ...


2

IDA does support structure member cross-references: it will show you everywhere in the disassembly listing that an instruction operand has had that particular structure reference applied to it. See this picture: However, this only works if the structure has been applied on the assembly-language level. Generally speaking, changing the type of a variable in ...


2

I had some trouble really understanding your question so I'll try to answer this question as best as I can. When you use pdf you instruct radare2 to print the disassembly of the whole function. Where each function begins and ends is identified when analysis is done (aaa). So if you don't have functions identified pdf won't work. You run your analysis so ...


2

Type Alt+D to open up data type setup and check "4 Float". Now every time you cycle through D on binary you will end up with one more datatype after dword which is float


2

This should do it: you need to iterate over all the ordinals as defined in the local type information library returned by get_idati(). They are annoyingly indexed 1-up. For each ordinal you can get the corresponding tinfo_t with get_numbered_type. import ida_typeinf idati = ida_typeinf.get_idati() for ordinal in xrange(1, ida_typeinf.get_ordinal_qty(idati)...


2

According to man mmap PROT_NONE The memory cannot be accessed at all. PROT_READ The memory can be read. PROT_WRITE The memory can be modified. PROT_EXEC The memory can be executed. PROT_NONE will act like a guard page by hitting a SIGSEGV when accessed. The page with PROT_NONE looks like this in the map during runtime 0x7ffff7ff7000 ...


2

Create two Python-functions (menu File-Script command...). First for printing EAX and second - for printing memory @FF27790 def view_ecx(): print GetRegValue("ecx") def view_memory(): print Byte(0xFF27790) Set breakpoints: @.text:0FD6268D - set condition view_ecx() and choose Python-type @.text:0FD62693 - set condition view_memory() and ...


Only top voted, non community-wiki answers of a minimum length are eligible