Avery3R
  • Member for 8 years, 10 months
  • Last seen this week
How to know in which language/technology program (.exe) is written?
11 votes

Marco Pontello's TrID software can usually identify what was used to compile a file.

View answer
How can I make IDA see a string reference?
9 votes

At 0xC02860F0 hit Alt+A and select unicode to define it as a unicode string. IDA should recognize the reference after you do so.

View answer
How debug process that not started with ida?
3 votes

In a similar way, windows services must also be started by a special process. Microsoft has documentation on how to debug these kinds of processes. The applicable section is "Configure a service to ...

View answer
What does this call to CallWindowProc do?
Accepted answer
3 votes

Normally, the first parameter to CallWindowProc would be a function pointer. CallWindowProc treats the pointer to the string as a function pointer, and calls it. As long as the heap that the string ...

View answer
Program with no dependencies
3 votes

This isn't a very portable trick, but kernel32.dll is always loaded at the same address when the executable is launched, that means LoadLibraryA and GetProcAddress are always at the same address. You ...

View answer
How to Insert Call to Already Imported Function in amd64 Windows DLL using IDA Pro?
Accepted answer
2 votes

Keypatch is a plugin for IDA that uses keystone to assemble instructions for patching. It works much better than IDA's old built-in assembler, and it should be able to handle 64-bit operands.

View answer
IDA IDC Get memory reference in instruction
2 votes

Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition. If you just want to log it to the console, the snippet I would use is: Message("__GetProcAddress = %08X\n", Dword(...

View answer
Re-analyzing pseudocode IDA Pro
1 votes

While in the pseudocode view pressing F5 will re-decompile the current function.

View answer
Patch Arm binary with Ida
1 votes

Keypatch is a plugin for IDA that uses keystone to assemble instructions for patching. It supports ARM. Once you've patched the IDB you can go to Edit -> Patch Program -> Apply Patches to Input File

View answer
IDAPython Export All Addresses Called by Specific Call
1 votes

I don't know idapython very well, but an idc solution would be: auto f = fopen("file.txt", "a+"); fprintf(f, "%016X\n", get_qword(rbp+<actual offset that is var_s38>)); fclose(f); I know that ...

View answer
Find the call function of a string
1 votes

Try searching for INT 10h, that's the x86 BIOS interrupt that allows you to output text to the screen, as well as change the video mode and cursor position among other things.

View answer
Split IDA segment into sub segments
Accepted answer
1 votes

Open the segments window in IDA. Go to edit that one big segment you have. Change the name to .text and edit the permissions as applicable. Uncheck "Move adjacent segments" and "Disable addresses", ...

View answer
What are these LOAD segments in an assembly ELF64?
1 votes

The segments are called LOAD because that is the default name given to segments loaded from an ELF in IDA when they have no name. The first segment is the equivalent of .text, it contains executable ...

View answer
Hex-Rays function signature does not match demangled name
Accepted answer
1 votes

It looks like hex-rays mistakenly thought there were three parameters instead of two. If you look at the start of the function's disassembly R1 and R2 are not saved, only R0 is. You should be able to ...

View answer
Is there a way to edit structure field value in memory during debug
Accepted answer
0 votes

You still need to know the offset of the field, but you can get away with not having to redefine it. Open a hex dump subview and sync it with your disassembly view(right click -> sync with). Put your ...

View answer
Injecting C++ code, while also maximizing compatibility with other injections
0 votes

If you just want to run code before or after TryOpenPipboy is called, you can overwrite the prologue of the function with a jmp to your function. Before you overwrite it, copy the instructions in the ...

View answer
Change IDA pro dissassembly to linear sweep
Accepted answer
0 votes

IDA doesn't have a built-in linear sweep mode. You do have a couple of options though. In kernel options 2, you can uncheck coagulate code/data segments before doing the initial analysis, this will ...

View answer
Composition of a Binary File trouble
0 votes

A simple way would be to open up the executable in IDA and look at the navigation bar. If most of it is blue or brownish red, rather than gray or brownish yellow then the executable contains mostly ...

View answer