New answers tagged ida
2
You can go to function A and press y on the call to B, and edit to int B(int a, int b)
1
I suspect you’ve got a false positive during analysis and a constant (0 or 1) got wrongly converted to an offset (probably because in your database 0 is a valid address). The decompiler uses info from disassembly so in cases like this it may be necessary to clean up the disassembly:
Press Tab on the line with &dword_0 and if there is an offset dword_0 ...
0
Yes, that's certainly doable.
You would have to analyze what code exactly is executed when a certain GUI action is performed. That would likely require knowledge of the used GUI API. Faking a button press in Qt is completely different from faking a button press in standard WinAPI dialogs.
That would be the higher layer to solve it, understand what that GUI ...
0
in the Conditional Statement
if ((cVar1 = func_0x8b4c55a0(), cVar1 == -0xe) || 1)
CVar1 is initialised and then evaluated
func_0x8b4c55a0() returns random garbage (basically it will return what was in eax register prior to calling the function
now this can be -0xe or anything else from 0x0 to 0xffffffff
so the if will result in either True or ...
1
From https://github.com/Siguza/ios-resources/blob/master/bits/arm64.md
x8 pointer to where to write the return value if >128 bits, otherwise scratch register
So it seems x8 is used to pass an address at which the return value will land if it's too big, rather than the return value directly, hence indirect I suppose.
I couldn't find official ...
1
I am unsure what you mean by "solving" this, but the meaning of the code is rather obvious and even more so in the screenshot you provided. Simplified version:
call $+5
add [esp], 5
ret
xor eax, eax
ret
And with annotations:
_main:
call $+5 ; call address of next instruction, placing return address on stack (esp)
add [esp], 5 ; add 5 bytes to the ...
0
You can use commands in the Edit-Segments.. menu to create new segments and/or move the existing ones.
2
I am assuming that the malware is already on your disk (not all malware hits the disk!). So keep that in mind when following this answer. If this is not the case, please provide more information.
On Windows many files that are in use and therefore cannot be deleted can be dealt in one of two ways:
rename the file (the ren command on the command prompt ...
3
There doesn't seem to be a straightforward way to achieve this. But you can take a look at this page of the IDA SDK documentation.
According to the description of the previous page, we can write a little helper function:
def size_of_operand(op):
tbyte = 8
dt_ldbl = 8
n_bytes = [ 1, 2, 4, 4, 8,
tbyte, -1, 8, 16, -1,
-1, 6,...
2
not sure what methodology you are looking for if the said gui is under some debugger
you can simply detour a patch
or if you are under the wndproc Thread of the gui You can use apis
(for example for checking the menu wordwrap in notepad use CheckMenuItem(); )
or use the oldest trick SendMessage From an external App a demo and src of the third method ...
1
The supported processors are listed in the publicly available source code on GitHub.
Ghidra and IDA Pro both support quite a wide variety of architectures and processors. It's hard for me to tell which one supports more, and I am not sure how meaningful that kind of comparison is.
For more information, see this presentation and associated materials:
...
1
Quoting the Ghidra Wiki,
What processors are currently supported?
X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro,
68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64,
CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32, and variants of these
processors.
The latest IDA pro supports more than 60 families of processors....
0
You still need to know the offset of the field, but you can get away with not having to redefine it. Open a hex dump subview and sync it with your disassembly view(right click -> sync with). Put your cursor on the relevant bytes of the struct, hit F2 to enter edit mode, change the data, and hit F2 again to commit your changes to memory. You could probably ...
0
CBZ is a compare and branch is zero.
It does not affect flags, which means that the compare part has no effect other than branching or not.
You can simply patch the CBZ into a B instruction.
0
If this is the entire function, it seems you would want to nullify it. Make it just not call exit().
You could do that by simply replacing the call _exit instruction with multiple nop opcodes. In IDA, you'll need to use the patch program feature Under the edit-> patch bytes sub-menu (Notice that in older versions of IDA you had to manually turn it on ...
0
A dumped file is, as the name suggests, a memory dumped process.
Memory dumped means written to disk exactly as it is mapped in memory.
If there are any relocations, dynamic mapping, rebasing etc. that are done by the loader or by the program - they will be reflected in the file.
Because of this, the loader will not be able to load a dumped process out-of-...
0
call instruction with local variable suggests it may be function pointer.
But function pointer can be used in many cases. The simplest example is a raw
C style function pointer.
MSVC command used: cl.exe /MDd file.c
Environment: Intel X86
Sample C code:
#include <stdio.h>
void func(int a) {
printf("%d\n", a);
}
int main(void) {
void (*...
0
If you can see the send event in ProcMon, just double click it and check the Stack tab to see what API the program used to perform it. Note that the stack trace usually includes the kernel part; you’ll need to skip it and look at the user-mode calls (skip the system libraries too except the one called directly by the process).
0
I don't think this is available from the UI, but there are APIs you can use to enumerate trace log records, e.g. see tracing_api plugin sample in the SDK.
0
There could be a huge number of reasons for this ranging from something as innocuous as a method pointer being a local variable to obfuscation (highly unlikely with the assembly you showed). As for how to follow it, you can either BP the call and follow it or track the frame pointer to see what it's set to.
0
These are functions exported by ordinal rather than by name.
This being a C++ library the actual (mangled) function names are long (up to 200 characters with an average of over 50.) Dynamic linking using names in this case would involve lots of long string comparisons that would slow down the loading of applications using this library.
6153
?...
0
It turned out IDA sends first sends vCont;c and then vCont;s:1 for some weird reason in that particular instance. I fixed my mitm :
const net=require("net")
const process = require('process');
net.createServer(server => {
const client = new net.Socket()
let lastcommand, response, lastterm
client.connect(50505, "localhost")
/**
* @param {...
Top 50 recent answers are included
