Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

Filter by
Sorted by
Tagged with
0 votes
0 answers
15 views

IDA: How to change return-type’s declaration and variable numbers in function with idapython?

just like: __int64* Test::foo1(Test *this, void* var1, float var2, std::vector<float>* var3) __int64* Test::foo2(Test *this, void* var1, int var2, std::vector<double>* var3) ... __int64* ...
  • 26
0 votes
0 answers
5 views

Invalid instruction on IDA when stops on a breakpoint

I'm using IDA pro to debug an android app, the code that I'm adding breakpoint to is on some .so file. I attach the debugger successfully and the app keeps running with no issue. But when I add a ...
  • 7,022
1 vote
1 answer
65 views

How do I parse this IDA-generated asm file to get a list of mnemonics for each function?

I have asm file, that was produced with IDA Pro. All of its functions looks almost like this. ; =============== S U B R O U T I N E ======================================= release ...
0 votes
0 answers
13 views

how to Resolve IDAPython Variable Warning Error

I keep Having a Warning Error When Loading an IdaPython *.idc Script file and i Don't know what is what After Loading the Script Warning pops up With the Following : F:\REDACTED\DynamoRIO-Windows-9.90....
  • 11
0 votes
0 answers
36 views

IDA pro - what does the invert sign mean in -> mov eax, [ecx-14h]?

This is my first question on StackOverflow, and I hope I find an answer. I'm a newbie in reverse-engineering, I still have a lot to learn. I started to reverse-engineer a C++ DirectX game a couple of ...
0 votes
0 answers
45 views

IDA: How to tell IDA to output bytes as code

I have a text trace of the code of the real work of the library, but IDA at the address where the code should be shows that there is data, calling the "convert to instruction" function gives ...
0 votes
0 answers
41 views

Apply failed: Couldn't copy file "C:\Program Files\IDA Pro 8.0\python\3\PyQt5\python_3.9\sip.pyd

When I run idapyswitch.exe, I encounter this information Checking installs from "Python Software Foundation" Checking "Python 3.10 (64-bit)" (3.10) Found: "C:\Program Files\...
0 votes
0 answers
21 views

When writing an IDA plug-in, textChanged in PyQt5 will cause ida to freeze

Is there any solution so that the contents of the two input boxes can be bound and connected in real time? import sys import idaapi from PyQt5.QtWidgets import QApplication,QLineEdit, QTextEdit, ...
0 votes
0 answers
53 views

Remote GDB Debugger IDA PRO

I am trying to reverse engineer a binary file and try to trace the loggers but when tracing the logger addresses are always zero why?? I am using qemu and ida pro Disassmebly Memory Organisation enter ...
  • 1
0 votes
0 answers
20 views

Why does the same asm code produce the different machine code [duplicate]

I'm reverse engineering a bootloader using IDA. When I use "patching" plugin to reassemble the file, the machine code it produced is different comparing to the code of the same instruction ...
0 votes
0 answers
28 views

OpenSSL RSA_padding_check_PKCS1_type_2:pkcs decoding error

I'm working my way through reversing a toy challenge, and I find myself stuck. The app is pretty simple, it spits out a blob of text (e.g. "3b880a90e476d66569d9d5dfb5cd755af3f...") by ...
  • 5,080
0 votes
0 answers
73 views

Ida patch program Failed

I tried to create a segment using ida, and when I tried to save it as a new file, it never worked I created a segment and set all its contents to 0. Then I do the following:Edit -> Patch Program -&...
  • 1
0 votes
0 answers
82 views

Is there a way to view Register memory value in IDA (like x64dbg)?

Is there a way to view the register memory value in IDA, like x64dbg? I can hoover over the register in the register panel and see it's memory value but I want to know if I can sho wit like in x64dbg? ...
0 votes
0 answers
93 views

Get memory (ROM, PROM) values from IDA disassembler

Want to get 32 bits from 0x8000 adress as 8 bytes MEM_EXT:00008000 db 54h MEM_EXT:00008001 db 53h, 57h, 20h MEM_EXT:00008004 dd 322E3256h, 31332030h, ...
  • 1,119
0 votes
2 answers
125 views

fgets exploit - reverse engineering with IDA

I'm currently doing an exercise, where I have to find a way to "pass" the level (It's a reverse engineering exercise, I decompiled it with IDA). The level function consists of 3 while loops, ...
0 votes
0 answers
45 views

how to import file name / line numbers when using IDApython?

When I use the UI of IDA to load a binary file with debug info, a window which prints "DWARF info found" will come out and I can choose "Import file names/line numbers" to present ...
  • 1
2 votes
0 answers
78 views

How to use tracing properly in IDA

I'd like to put a breakpoint to some instruction after it's reached, then collect all the tracing info about functions until the same instruction is reached again and stoppet at the same breakpoint. ...
  • 5,398
0 votes
0 answers
37 views

How to search up or down in x64dbg like in IDA Pro?

Lets say i want to search for sequence of byte "48 8D 0D" in x64dbg, the location is up above the current cursor. In IDA Pro there is the option to do this IDA Pro options Where is options ...
0 votes
1 answer
45 views

IDA - execute commands in WinDbg console from python script

I have a python script to run in IDA that generates commands for WinDbg. I also open the memory dump (via the windmp64.dll loader), where the WinDbg console is already available: I want to execute ...
1 vote
1 answer
89 views

Convert instructions to op code bytes in python script for IDA Pro

I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work. This is my python ...
  • 97
0 votes
0 answers
180 views

How to suspend an android app and then start debugging SO native library with IDA?

I'm trying to debug some Android application in IDA Here are my steps: Copy "android_server64" to /data/local/tmp on my phone adb shell "su -c chmod 755 /data/local/tmp/...
0 votes
0 answers
68 views

IDA Pro - How to edit structure's array size

I have an executable file wrote in C++ and i'm trying to make some change on it After use IDA Pro analyze this file, i wanna update initial variable in header file. In detail, source code of header ...
0 votes
1 answer
38 views

Calculating jmp's from one segment to another in windows PE files

Assume I have a binary on my disk that I load into memory using VirtualAlloc and ReadFile. If I want to follow a jmp instruction from one section to another, what do I need to add/subtract to get the ...
  • 53
0 votes
0 answers
556 views

IDA- how to find value/offset of variable? [duplicate]

I try to understand code reversed using IDA. Some parts below: .text:00401510 Destination= byte ptr -0Fh .text:00401510 argc= dword ptr 8 .text:00401510 argv= dword ptr 0Ch .text:00401510 envp= ...
  • 1
0 votes
0 answers
191 views

IDA Pro , catch a Microsoft C++ Exception

I'm debugging an unmanaged(c++) dll with IDA Pro, After 20 or 30 seconds this dll throws a "Microsoft C++ Exception" and debugging process will stop. But the IDA pro not showing which line ...
0 votes
0 answers
92 views

IDA Remote Linux Debugger

Hello/ During Linux debugging, almost after each line, IDA outputs lines of the type to the console: "Looking for GNU DWARF file at "/usr/lib/debug/.build-id/a4/...
2 votes
0 answers
68 views

Is possible to patch a linux executable to include a new so library?

I have this linux executable which loads some so libraries and I want to know if is possible to patch it with ida for example and makes it include a new library? It is a game server and it loads a so ...
1 vote
1 answer
157 views

Hex values doubled in IDA/Ghidra decompiled code

I have the following piece of dart code, which check if the input is "ABCDE" and prints correct if the input matches, and it works fine. import 'dart:io'; final List<int> flag = [65, ...
0 votes
1 answer
236 views

Changing address/value of dll file with IDA Pro

I am writing with a very primitive question in my opinion, since I could not find really similar problems. I am using IDA Pro. I have a dll file (associated with the server part of the game, I don’t ...
0 votes
0 answers
80 views

How to get this pointer to vtable

I'm stuck on a problem that I think is quite simple, but I'm having trouble explaining this, I hope I'll be able to do it this time. I'm making a modding kit that will be able to dynamically reload ...
  • 95
0 votes
0 answers
108 views

Memory reading not working when hooking WIN32 API functions

I'm trying to inject the DLL into my other program and hook the win32 API function SetConsoleTitle so I can read what parameters are being passed. Everything seems to work except that the strings ...
0 votes
0 answers
91 views

is this float values stored in .rodata or .data sections and how to find them in the disassembled code?

I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values, in turn which are somewhat constant floats. this is the snippet: // Namespace: ...
  • 492
1 vote
1 answer
320 views

Need help understanding ida pseudocode

I am new to reversing. I have stumbled upon a line of code which I am unable to understand. return (*(_int64(**)(void))(**(_QWORD **)(v1 + 0x3C8) + 0x68LL ))(); The code is for arm64 lib. So , what I ...
0 votes
1 answer
74 views

IDA how to change decompiled function name color

In Pseudocode window, I want to change function name's color.
  • 627
0 votes
0 answers
107 views

ida decompiler shows wrong offset

so i'm studying with IDA (32-bit). And I have a question about decompiler. so this is the block of assembly, and it takes the hex-offset 120 and 122. thats it it's ok. but when i'am pressing F5 and ...
  • 7
0 votes
1 answer
142 views

create symbol or rename a function inside WinDBG

is there a way to rename a function in windbg? similar of using symbol. For example, we have a function that is identified in windbg as "example+0x14". after reverse engineering, I know ...
0 votes
0 answers
364 views

IDAPython with PyCharm throws: "ModuleNotFoundError: No module named '_ida_hexrays'"

I want to use PyCharm with IDAPython. I setup the Python Interpreter by adding the following path to the "Interpreter Paths": C:\Program Files\IDA Pro 7.7\python\3 After that, it ...
  • 10.8k
0 votes
0 answers
441 views

Is there an class informer plugin(ida pro) that works for so libraries?

I started decompling a games .so library file recently and found that its written in c++(ida says its GNU C++). Soon i found some vtable functions like (retvaltype...)(argstype...)(*(_DWORD*)(this + ...
1 vote
1 answer
64 views

Can I use Go dlv exec ./go-server to decompile all go code?

Supposed a go-server file was compiled by Windows system with linux OS, and Can I use Go dlv exec ./go-server to decompile all go code? When I try to break some points, I got below message, but it ...
  • 45
-2 votes
1 answer
316 views

64 bit equivalent of "GetModuleHandleA" need

I need to extent the compatibility of my application to 64 bit exe. __int64 GetGameFunctionAddress(std::string GameFileExe, std::string Address) { // Get integer value address of the original ...
user avatar
0 votes
0 answers
51 views

How do I make IDA python script step into the library?

How should I do, if I want to make IDA python script step into the library? When I'm using debugger in IDA, every time the debugger meets the library, a notification appears whether to decide to step ...
0 votes
0 answers
23 views

Relative jump not pointing to in-range address [duplicate]

Note: Binary is obfuscated. I know that i can take the qword address and use that with the 0x1b0 but I'm confused as to why my approach below isn't working. So I have this disassembly here. I'm trying ...
  • 53
0 votes
0 answers
79 views

IDA Pro debug android apk fail

I'm trying to debug a .so file, and I used the android_server64 to attach to the apk. However, things doesnt go smooth. ida gave me this error "libprelinker64.so: could not find in process ...
1 vote
0 answers
59 views

How to call 3rd party plugin in idapython script

I need to use a python script to analyze some binary files in batches. In the script, I want to call some functions provided by third-party plugins, which can be called through the action that pops up ...
  • 31
1 vote
1 answer
78 views

What is the outcome of mov on non bracket memory locations? [duplicate]

I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify. 1. mov [rsp+78h+arg_0], rsi 2. mov rsi, cs:qword_1F39B60 3. mov [...
  • 67
0 votes
0 answers
168 views

IDA: How to change the instructions displayed on the interface from arm to x86

enter image description here The instruction in this picture is the arm instruction architecture, in fact I want to get the instruction of the X86 instruction architecture ,like movq movl cmpq addq...,...
  • 11
0 votes
0 answers
75 views

Does anyone know how to get hints in IDA?

Does anyone know how to get hints in IDA? Is there any api? I googled and checked ida's official documentation and didn't find any useful information. I want to write an ida plugin to get hints ...
  • 29
0 votes
0 answers
109 views

how to access PEB using ida python

How does one set breakpoints on PEB memory using idapython while debugging a process ? ps: I know there are many ways to hide the debugger in IDA pro, I am not trying only to hide it, I want to know ...
  • 172
-1 votes
1 answer
41 views

What sort of address is 0x0000000140001000?

I'm using IDA Pro and right at the top of file is a field labelled Imagebase. Would this address be a absolute virtual address or relative virtual address or something else ? 0x0000000140001000
  • 37
1 vote
0 answers
95 views

How can i change the entire speed (timing) of a android game made with cocos2dx?

i'm making reverse engineering on a android game made with cocos2dx library, editing the .so file (libcocos2dcpp.so) with ida pro and a hex editor. i've getting success changing small things, like ...

1
2 3 4 5
13