New answers tagged ida
1
Two options:
at the .set mips16 line, press Alt-G, choose mips16 and set the value to 0.
Press Ctrl-G to display the list of segment register changepoints, pick the mips16 list and delete the wrong entries with value of 1.
Note: it's best that there are no existing instructions at the addresses where you change the mips16 pseudoregister value, so it is ...
0
I have now managed to find the password.
Thanks to the C code provided by Tony in his answer and information provided by Michael in the comments, I was able to make a password prompt that was similar to the original and through that I was able to find the password with some trial and error.
I also tested the password on the actual hardware and was able to ...
0
I needed to put the cursor within the disassembly view (not HEX view), right-click on the disassembly view and then check the option again, it should be available.
This answer help me.
Another thing,
You can't trace if the instruction has breakpoint. You need to remove the breakpoint and then assign the trace.
If you set a function to be traced, and it doesn'...
2
Try “Load debug symbols” from the context menu in the “Modules” list.
1
maybe try : C:\Program Files (x86)\Windows Kits\10\Debuggers\x86
2
There are two ways:
Keyboard Shortcut: Alt-D, followed by F
Action : OpFloat
By the way you can also add keyboard shortcut of your own choice by:
Menu: Options->Shortcuts
and then add a shortcut for OpFloat
1
routine sub_8081ECE4 seems to subtract 7 bytes from this address 0x8082e7c4 (R1=R7+0x54=0x8082e770+0x54) to data on the stack (I presume that is the entered password). Can you provide bytes @0x8082e7c4?
EDIT:
The block with a yellow background is some sort of decryption routine, substracting entered char with a byte table @0x8082e770. You need to look closer ...
4
ALT-D, then Float. (Or Double, or Packed Real.)
1
Use the following from idapython:
import ida_dbg
ida_dbg.edit_manual_regions()
1
If someone feels the need to do this programmatically in a non-debug setting, this is the code I would use.
Note #1: There are some shortcut functions of my own GetFuncStart and such that are not included, I'm sure you can work them out. The reference to the Commenter class will just have to be removed.
Note #2: The seemingly extreme measures taken in ...
0
The I/O register names and bit layouts for processors that support them are stored in processor-specific .cfg files. For M16C, the files are m16c60.cfg and m16c80.cfg:
dm0con 0x2c DMA0 control register
dm0con.dmbit_dm0con 0 Transfer unit bit select bit
dm0con.dmasl_dm0con 1 Repeat transfer mode select bit
dm0con....
1
I am not sure what you are asking (never used sticky notes and don't have it installed )
but if you want to run sticky notes from command line you can do something like this
the command below will run calculator instead of the wildcard calc use stick
C:\>powershell -c "(get-startapps -name *calc*).Appid
Microsoft.WindowsCalculator_8wekyb3d8bbwe!App
...
2
I just found what appears to be the official version of the adjustment function for the transmigration of worthless min-spd based offsets into heaven sent frame based offsets.
cfunc.get_stkoff_delta()
Possible implementation:
def GetMinSpdAdjustment(funcea):
func = ida_funcs.get_func(funcea)
return 0 - (func.frsize + func.frregs + idc.get_spd(idc....
1
Got it sorted had to install correct python version under windows
1
Based on the information we discuss in the comments, I have an idea about supporting such cases. You can use idc.get_frame_regs_size(ea) to adjust the offset. Thus can do something like:
adjust_offset = idc.get_frame_regs_size(ea)
[n.get_stkoff()+-adjust_offset for n in vu.cfunc.lvars if n.is_stk_var()]
according to your implementation.
You might as well ...
1
See your emulator, your ADB communication probably failed, open your terminal and check that your emulator is displayed with an ADB device, generate a new RSA certificate and try again, I recently had the same problem with debugger from IDA and its competitor JEB, and that was the solution that worked for me.
See also how to properly configure the ADB for ...
1
By finding the constructor for the structure type that you're looking at, making note of the VTable address, and adding the indicated offsets to obtain the concrete function pointers for the calls in question.
1
Load your binary into IDA, after completing the initial analysis click on, imports, then press CTRL + F and type sleep, automatically IDA will reference the import (if used), from that you will need to list all cross references with "X", so it will locate the routines used for its sleep function, however taking into account, I do not believe that ...
1
It's a bit hard to help and correct what you did wrong as you are not showing any indications why you think specific function are what you think they are but let's try (I'll do this purely via static analysis).
The main function was correctly identified. It is the one at offset 0x1180
115: int main (int argc, char **argv, char **envp);
│ ...
1
During debugging IDA does a limited amount of autoanalysis to speed up the debugging experience and not interfere with the process. What you can do is to copy the module to be analyzed to the database, then stop the debugger and let IDA finish the autoanalysis on the saved data. This can be done via the "Analyze module" command in the Modules list.
...
0
When you use bindiff e.g.,
bindiff original.BinExport patched.BinExport
it will create a BinDiff file, e.g., original_vs_patched.BinDiff. In the current version (6) that file is an sqlite3 database. You can find some of the information you're looking for in the tables in that database-- specifically, the functions table contains the number of basic blocks ...
1
You can parse a header using File > Load file > C header file or create a type library beforehand.
1
If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to setup your header file. Hope this helps.
Top 50 recent answers are included
