New answers tagged ida
-1
for editing in every owning pseudo code do think psychology corelations of it and then you get the human meaning for those who didnt change indetity based on it
only for who didnt read
but if code is not accessible (no pseudo code) you can make a dictionary of character to binary and to its functions on the cpu that have high performance on java or python(...
6
From everything I've read pseudo code can't be edited in realtime but can be edited as assembly
This is not entirely correct. Quite the opposite even: Decompilers cannot be perfect (the compilation step looses too much information). Hence they need some help by a human (the reverse engineer). Giving this help is, at least in my opinion, the most important ...
0
where is the problem the hex bytes Were Converted properly
45 00 =E , 6d 00 == m,......73 00 == s
and that is what is shown in your screen shot
if you need the hex for the complete string select all the bytes of the string
try synchronizing between IDA Hex-View and Ida View windows or try clicking the small down arrow to see if all the bytes are shown in the ...
1
First of all, I want to clarify some of the concepts about "API calls." I will explain these concepts, mainly thinking of WinAPI and PE files. I'm not claiming these definitions are correct for all systems.
Operating system programming interfaces
I assume you are referring to OS API libraries as API. OS API is consists of different interfaces that ...
1
I you really want to try making the unpacked executable, OllyDumpEx works in IDA too.
However, there is an alternative approach: a loader. This is a program which starts the target in paused state, puts breakpoint on OEP or some initially called APIs then lets it run. Once the breakpoint is reached, you can patch anything you need. This way you don’t need to ...
-2
on windows.
dynamic link use funcion like loadlibrary or getprocaddress to get process function address and call them.
static link use a table call import address table define in the excutable maintain by the system when program was loaded(the table have the process function address)
0
v5 = (_BYTE *)(*(int (__fastcall **)(cocos2d::CCFileUtils *, const char *, const char *, unsigned int *))(*(_DWORD *)this + 16))(
this,
a2,
"rb",
&v26);
This is a signature xxtea encryption with the sign rb. Now you need to find the xxtea encryption key in this method. You ...
0
Next time please include the original apk in your question. Luckily I'm working on the same game so I can help somewhat.
Get the old apk (yzjlzl_2.80_1_20180918_170403_83de83.apk) from bilibili (google it) and use IDA to decompile it. This is an obvious solution to JNI_Onload obfuscation if you want to do static debugging.
One of the other way to do this is ...
0
A decompiler plugin can be made to apply xor operations automatically. Please check this blog post for more info and sample code.
0
the output you posted doesn't seem to be disassembly but PseudoCode
I am not sure if you want your pseudo Code Commented or Disassembly Commented
below is an approach to Comment the Disassembly using the built-in idc on Ida Free 7
iirc you can run idc from python (ida free doesn't support either pseudo code or python so I cant be sure )
the disassembly look ...
Top 50 recent answers are included
