New answers tagged ida
0
votes
ida jumping to address I can't see in driver
Sorry for the dumb question. A little bit of research could've solved this. Turns out undefining the E8 byte will solve your problem.
0
votes
Can I get back an exe file from an .Asm formatted file disassembled with IDA?
As far as assembling .asm file is concerned (assuming you are on windows platform) there are various assembler such a NASM,MASM,FLAT assembler etc. and various others in compilers suite such as GNU ...
- 115
1
vote
Accepted
What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?
If you have the same binary then this should be straightforward. The approaches you came up with are all typical and useful for trying to correlate code from similar binaries and are then handled by ...
- 1,176
0
votes
What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?
It looks like maybe this would work?
How to find offset to a function address from the base address in decompiled image (IDA or Ghidra)
IIUC you find the base address in each tool, and then assume ...
- 125
1
vote
How can I use cutter like ida, trying to search by address
Seek or goto an address in cutter could be done by pressing G.
It'll take the focus to the top where you see an address bar like such
Just paste the address and press Enter
- 2,345
1
vote
How to call and what means: _DWORD *__thiscall
Basically I've checked with Ghidra to compare and I've found that the signature is different:
void __thiscall FUN_00142860(int param_1_00,undefined4 *param_1,int param_2)
So, basically I just ...
- 31
0
votes
How to define an xmmword variable in IDA?
It was Options -> Setup data types... and then choosing octa word:
- 206
0
votes
IDA: Generic approach to determine if an instruction reads from, or writes to, memory?
Updated @tmr232's answer for IDA 7.4+ using a better syntax for printing strings(f-strings):
import idaapi
import idautils
import idc
OPND_WRITE_FLAGS = {
0: idaapi.CF_CHG1,
1: idaapi.CF_CHG2,...
- 206
1
vote
IDA Pro S12X flash page references
I'm also trying to do some reverse engineering with an MC9S12X.
What i know is that it uses PPAGE register at 0x0030 of local address space to the which 16k page is shown at 0x8000.
IDA has concept of ...
- 21
0
votes
How to use IDC to clear output window in IDA Pro?
form = idaapi.find_widget("Output window")
idaapi.activate_widget(form, True)
idaapi.process_ui_action("msglist:Clear")
print('---------------IDA Python Running at {}---------------...
- 1
2
votes
x86 - How do I detect virtualized code by looking at the assembly?
That's tricky because obfuscated code often looks similar regardless of whether or not it specifically uses virtualization obfuscation. Most VMs ultimately have a similar high-level structure, as laid ...
- 7,814
0
votes
Guidelines for dealing with obfuscated code
You can press Ctrl+E to select the TLS entry point.
see here:
https://hex-rays.com/blog/tls-callbacks/
- 101
0
votes
Accepted
idapython: how to reset pointer type for variables
That function, lvar_t::set_lvar_type, is accompanied by the following comment:
/// Note: this function does not modify the idb, only the lvar instance
/// in the memory. For permanent changes see ...
- 7,814
Top 50 recent answers are included