New answers tagged ida
0
inc does not set carry flag (I mis commented earlier as overflow flag)
add eax, 1 will set the carry flag too
0
IDAPython-function get_frame_size(ea) gives size of stack in bytes.
So you can get max stack through all available functions:
"0x%04X" % max(get_frame_size(f) for f in Functions(0, BADADDR))
0
Just print address as hex-value:
print("%08x" % func_address)
So in Output window:
Python>print(0x1001CC80)
268553344 # <---- this is not clickable
Python>print("%08x" % 0x1001CC80)
1001cc80 # <---- this is clackable
0
If you rename things outside of pseudocode view, it’s not updated automatically and you need to press F5to refresh decompilation with current data.
1
BinnDiff and Diaphora do eactly what you ask.
0
As suggested in one of the answers, it's because of the base address, I used rbasefind to find the base_address of the firmware, and edited it to find the address of the bootloader as there was only two strings plus 11 false string positives.
1
Open Hex View.
Right-click on the data.
Choose "Edit..." (Alternatively, press F2).
Now you can change the string in rdata.
Don't forget to add null terminator.
You can just leave the rest of the unused bytes of the original string.
Patch the program, go to "Edit", choose "Patch program" and than "Apply patches to input file".
0
A __fastcall function gets its first two arguments in ECX and EDX.
int __fastcall sub_1(int a1, int a2)
{
int v2;
v2 = a2; //v2 = EDX
...
This line may change the address pointed to by a2, if it happens to be a pointer, but not the value of a2 itself. However, after this line EDX may have changed:
sub_2(a2);
In this line:
(*(void (__fastcall **)(...
1
You can use the ask_* functions from the ida_kernwin module.
For example:
ask_long: Display a dialog box and wait for the user to input an number
ask_str: Display a dialog box and wait for the user to input a text string
ask_file: Display a dialog box and wait for the user to input a file name
ask_form: Display a dialog box and wait for the user
There are ...
3
MIPS instructions are 4 bytes (32 bit) in size. Hence it's not possible to load a 32 bit constant using a single instruction.
The li $gp, 0x18B00 instruction is indeed a pseudo instruction. It's composed of two instructions.
lui gp, 0x2
addiu gp,gp,-29952
Screenshot from Online Disassembler
The lui (Load Upper Immediate) instruction loads a 16-bit ...
0
In cutter you have an option under right mouse button click to set a label for a particular value.
Or you can use Shift+N to activate that.
From r2 you can get the same behavior by issuing a f name = addr command.
| f name 12 @ 33 set flag 'name' with length 12 at offset 33
| f name = 33 alias for 'f name @ 33' or 'f name 1 33'
...
0
I can confirm that the rebasing is much faster with IDA 7.4, and it seems to be addressed in version 7.3:
Another debugger related news is fast rebasing. Due to widespread use of ASLR, processes get loaded into a new address every time and IDA needs to adjust the database: move all segments to the addresses that the operating system assigned to them. This ...
1
offset = idaapi.get_fileregion_offset(ea)
ea = idaapi.get_fileregion_ea(offset)
ref:How to extract the input file offset of a byte in idapython?
0
The button is greyed out, or "disabled". This is most likely done by one of two ways:
Creating the button as initially disabled, by passing the WS_DISABLED flag as dwStyle parameter to CreateWindow/CreateWindowEx API.
You can set a breakpoint on this function and reset the dwStyle param. Zero will do.
Disabling the button by calling the EnableWindow API ...
0
.text:00000000004004B9 opt = byte ptr -2
.text:00000000004004B9 decode = byte ptr -1
^ Isn't that part what you're looking for?
var int64_t var_2h @ rbp-0x2
var uint32_t var_1h @ rbp-0x1
Additionally, IDA correctly detected that those local variables only occupy one byte each, whereas radare2 thought there are 64 and 32-bit integers (...
-2
Have a look at this article :
https://medium.com/@ved_wayal/hail-frida-the-universal-ssl-pinning-bypass-for-android-e9e1d733d29
0
Appcall will work since it simply executes the function’s code.
However, the function itself may fail if the global state is not what it expects. So I suggest you to let the application run for a while so that the global data is initialized properly, pause it and then use Appcall.
1
You can try copy-pasting the following code into the built-in Python interpreter:
import idautils
for s in idautils.Strings():
ida_bytes.create_strlit(s.ea, 0, ida_nalt.STRTYPE_TERMCHR)
This will create string literals for all the entries in the Strings window.
0
compiler may insert dumb null_sub randomly between directions, in order to confuse IDA decompiler. So that IDA may generate meaningless variable names, increase reverse engineer's effort to understand the workflow, to connect to dots...
0
A few things you could do is go through the strings and see what kind of program it could possibly be loading inside of the software you are reversing. This could give some leads as to if your hypothesis is true.
Another thing you can do is see if it's a module being loaded. Breakpoint on entry when you run the software in a live debugger and see what DLL's ...
Top 50 recent answers are included
