New answers tagged

0 votes

ida jumping to address I can't see in driver

Sorry for the dumb question. A little bit of research could've solved this. Turns out undefining the E8 byte will solve your problem.
user avatar
0 votes

Can I get back an exe file from an .Asm formatted file disassembled with IDA?

As far as assembling .asm file is concerned (assuming you are on windows platform) there are various assembler such a NASM,MASM,FLAT assembler etc. and various others in compilers suite such as GNU ...
user avatar
1 vote
Accepted

What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?

If you have the same binary then this should be straightforward. The approaches you came up with are all typical and useful for trying to correlate code from similar binaries and are then handled by ...
user avatar
0 votes

What techniques are there for mapping code in IDA Pro to the same code in Ghidra, or vice versa?

It looks like maybe this would work? How to find offset to a function address from the base address in decompiled image (IDA or Ghidra) IIUC you find the base address in each tool, and then assume ...
user avatar
  • 125
1 vote

How can I use cutter like ida, trying to search by address

Seek or goto an address in cutter could be done by pressing G. It'll take the focus to the top where you see an address bar like such Just paste the address and press Enter
user avatar
  • 2,345
1 vote

How to call and what means: _DWORD *__thiscall

Basically I've checked with Ghidra to compare and I've found that the signature is different: void __thiscall FUN_00142860(int param_1_00,undefined4 *param_1,int param_2) So, basically I just ...
user avatar
  • 31
0 votes

How to define an xmmword variable in IDA?

It was Options -> Setup data types... and then choosing octa word:
user avatar
  • 206
0 votes

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

Updated @tmr232's answer for IDA 7.4+ using a better syntax for printing strings(f-strings): import idaapi import idautils import idc OPND_WRITE_FLAGS = { 0: idaapi.CF_CHG1, 1: idaapi.CF_CHG2,...
user avatar
  • 206
1 vote

IDA Pro S12X flash page references

I'm also trying to do some reverse engineering with an MC9S12X. What i know is that it uses PPAGE register at 0x0030 of local address space to the which 16k page is shown at 0x8000. IDA has concept of ...
user avatar
0 votes

How to use IDC to clear output window in IDA Pro?

form = idaapi.find_widget("Output window") idaapi.activate_widget(form, True) idaapi.process_ui_action("msglist:Clear") print('---------------IDA Python Running at {}---------------...
user avatar
  • 1
2 votes

x86 - How do I detect virtualized code by looking at the assembly?

That's tricky because obfuscated code often looks similar regardless of whether or not it specifically uses virtualization obfuscation. Most VMs ultimately have a similar high-level structure, as laid ...
user avatar
  • 7,814
0 votes

Guidelines for dealing with obfuscated code

You can press Ctrl+E to select the TLS entry point. see here: https://hex-rays.com/blog/tls-callbacks/
user avatar
0 votes
Accepted

idapython: how to reset pointer type for variables

That function, lvar_t::set_lvar_type, is accompanied by the following comment: /// Note: this function does not modify the idb, only the lvar instance /// in the memory. For permanent changes see ...
user avatar
  • 7,814

Top 50 recent answers are included