Questions tagged [ida]
The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.
624
questions
0
votes
0
answers
15
views
IDA: How to change return-type’s declaration and variable numbers in function with idapython?
just like:
__int64* Test::foo1(Test *this, void* var1, float var2, std::vector<float>* var3)
__int64* Test::foo2(Test *this, void* var1, int var2, std::vector<double>* var3)
...
__int64* ...
0
votes
0
answers
5
views
Invalid instruction on IDA when stops on a breakpoint
I'm using IDA pro to debug an android app, the code that I'm adding breakpoint to is on some .so file. I attach the debugger successfully and the app keeps running with no issue. But when I add a ...
1
vote
1
answer
65
views
How do I parse this IDA-generated asm file to get a list of mnemonics for each function?
I have asm file, that was produced with IDA Pro. All of its functions looks almost like this.
; =============== S U B R O U T I N E =======================================
release ...
0
votes
0
answers
13
views
how to Resolve IDAPython Variable Warning Error
I keep Having a Warning Error When Loading an IdaPython *.idc Script file and i Don't know what is what
After Loading the Script Warning pops up With the Following :
F:\REDACTED\DynamoRIO-Windows-9.90....
0
votes
0
answers
36
views
IDA pro - what does the invert sign mean in -> mov eax, [ecx-14h]?
This is my first question on StackOverflow, and I hope I find an answer. I'm a newbie in reverse-engineering, I still have a lot to learn.
I started to reverse-engineer a C++ DirectX game a couple of ...
0
votes
0
answers
45
views
IDA: How to tell IDA to output bytes as code
I have a text trace of the code of the real work of the library, but IDA at the address where the code should be shows that there is data, calling the "convert to instruction" function gives ...
0
votes
0
answers
41
views
Apply failed: Couldn't copy file "C:\Program Files\IDA Pro 8.0\python\3\PyQt5\python_3.9\sip.pyd
When I run idapyswitch.exe, I encounter this information
Checking installs from "Python Software Foundation"
Checking "Python 3.10 (64-bit)" (3.10)
Found: "C:\Program Files\...
0
votes
0
answers
21
views
When writing an IDA plug-in, textChanged in PyQt5 will cause ida to freeze
Is there any solution so that the contents of the two input boxes can be bound and connected in real time?
import sys
import idaapi
from PyQt5.QtWidgets import QApplication,QLineEdit, QTextEdit, ...
0
votes
0
answers
53
views
Remote GDB Debugger IDA PRO
I am trying to reverse engineer a binary file and try to trace the loggers but when tracing the logger addresses are always zero why?? I am using qemu and ida pro
Disassmebly Memory Organisation
enter ...
0
votes
0
answers
20
views
Why does the same asm code produce the different machine code [duplicate]
I'm reverse engineering a bootloader using IDA. When I use "patching" plugin to reassemble the file, the machine code it produced is different comparing to the code of the same instruction ...
0
votes
0
answers
28
views
OpenSSL RSA_padding_check_PKCS1_type_2:pkcs decoding error
I'm working my way through reversing a toy challenge, and I find myself stuck. The app is pretty simple, it spits out a blob of text (e.g. "3b880a90e476d66569d9d5dfb5cd755af3f...") by ...
0
votes
0
answers
73
views
Ida patch program Failed
I tried to create a segment using ida, and when I tried to save it as a new file, it never worked
I created a segment and set all its contents to 0.
Then I do the following:Edit -> Patch Program -&...
0
votes
0
answers
82
views
Is there a way to view Register memory value in IDA (like x64dbg)?
Is there a way to view the register memory value in IDA, like x64dbg?
I can hoover over the register in the register panel and see it's memory value but I want to know if I can sho wit like in x64dbg?
...
0
votes
0
answers
93
views
Get memory (ROM, PROM) values from IDA disassembler
Want to get 32 bits from 0x8000 adress as 8 bytes
MEM_EXT:00008000 db 54h
MEM_EXT:00008001 db 53h, 57h, 20h
MEM_EXT:00008004 dd 322E3256h, 31332030h, ...
0
votes
2
answers
125
views
fgets exploit - reverse engineering with IDA
I'm currently doing an exercise, where I have to find a way to "pass" the level (It's a reverse engineering exercise, I decompiled it with IDA).
The level function consists of 3 while loops, ...
0
votes
0
answers
45
views
how to import file name / line numbers when using IDApython?
When I use the UI of IDA to load a binary file with debug info, a window which prints "DWARF info found" will come out and I can choose "Import file names/line numbers" to present ...
2
votes
0
answers
78
views
How to use tracing properly in IDA
I'd like to put a breakpoint to some instruction after it's reached, then collect all the tracing info about functions until the same instruction is reached again and stoppet at the same breakpoint.
...
0
votes
0
answers
37
views
How to search up or down in x64dbg like in IDA Pro?
Lets say i want to search for sequence of byte "48 8D 0D" in x64dbg, the location is up above the current cursor.
In IDA Pro there is the option to do this IDA Pro options
Where is options ...
0
votes
1
answer
45
views
IDA - execute commands in WinDbg console from python script
I have a python script to run in IDA that generates commands for WinDbg. I also open the memory dump (via the windmp64.dll loader), where the WinDbg console is already available:
I want to execute ...
1
vote
1
answer
89
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
0
votes
0
answers
180
views
How to suspend an android app and then start debugging SO native library with IDA?
I'm trying to debug some Android application in IDA
Here are my steps:
Copy "android_server64" to /data/local/tmp on my phone
adb shell "su -c chmod 755 /data/local/tmp/...
0
votes
0
answers
68
views
IDA Pro - How to edit structure's array size
I have an executable file wrote in C++ and i'm trying to make some change on it
After use IDA Pro analyze this file, i wanna update initial variable in header file.
In detail, source code of header ...
0
votes
1
answer
38
views
Calculating jmp's from one segment to another in windows PE files
Assume I have a binary on my disk that I load into memory using VirtualAlloc and ReadFile.
If I want to follow a jmp instruction from one section to another, what do I need to add/subtract to get the ...
0
votes
0
answers
556
views
IDA- how to find value/offset of variable? [duplicate]
I try to understand code reversed using IDA. Some parts below:
.text:00401510 Destination= byte ptr -0Fh
.text:00401510 argc= dword ptr 8
.text:00401510 argv= dword ptr 0Ch
.text:00401510 envp= ...
0
votes
0
answers
191
views
IDA Pro , catch a Microsoft C++ Exception
I'm debugging an unmanaged(c++) dll with IDA Pro,
After 20 or 30 seconds this dll throws a "Microsoft C++ Exception" and debugging process will stop.
But the IDA pro not showing which line ...
0
votes
0
answers
92
views
IDA Remote Linux Debugger
Hello/ During Linux debugging, almost after each line, IDA outputs lines of the type to the console:
"Looking for GNU DWARF file at "/usr/lib/debug/.build-id/a4/...
2
votes
0
answers
68
views
Is possible to patch a linux executable to include a new so library?
I have this linux executable which loads some so libraries and I want to know if is possible to patch it with ida for example and makes it include a new library?
It is a game server and it loads a so ...
1
vote
1
answer
157
views
Hex values doubled in IDA/Ghidra decompiled code
I have the following piece of dart code, which check if the input is "ABCDE" and prints correct if the input matches, and it works fine.
import 'dart:io';
final List<int> flag = [65, ...
0
votes
1
answer
236
views
Changing address/value of dll file with IDA Pro
I am writing with a very primitive question in my opinion, since I could not find really similar problems.
I am using IDA Pro.
I have a dll file (associated with the server part of the game, I don’t ...
0
votes
0
answers
80
views
How to get this pointer to vtable
I'm stuck on a problem that I think is quite simple, but I'm having trouble explaining this, I hope I'll be able to do it this time. I'm making a modding kit that will be able to dynamically reload ...
0
votes
0
answers
108
views
Memory reading not working when hooking WIN32 API functions
I'm trying to inject the DLL into my other program and hook the win32 API function SetConsoleTitle so I can read what parameters are being passed. Everything seems to work except that the strings ...
0
votes
0
answers
91
views
is this float values stored in .rodata or .data sections and how to find them in the disassembled code?
I dumped an il2cpp.so with il2cppDumper and in the dump.cs I found that the variables I wanted to change its values, in turn which are somewhat constant floats. this is the snippet:
// Namespace:
...
1
vote
1
answer
320
views
Need help understanding ida pseudocode
I am new to reversing. I have stumbled upon a line of code which I am unable to understand.
return (*(_int64(**)(void))(**(_QWORD **)(v1 + 0x3C8) + 0x68LL ))();
The code is for arm64 lib. So , what I ...
0
votes
1
answer
74
views
IDA how to change decompiled function name color
In Pseudocode window, I want to change function name's color.
0
votes
0
answers
107
views
ida decompiler shows wrong offset
so i'm studying with IDA (32-bit). And I have a question about decompiler.
so this is the block of assembly, and it takes the hex-offset 120 and 122.
thats it
it's ok.
but when i'am pressing F5 and ...
0
votes
1
answer
142
views
create symbol or rename a function inside WinDBG
is there a way to rename a function in windbg? similar of using symbol.
For example, we have a function that is identified in windbg as "example+0x14". after reverse engineering, I know ...
0
votes
0
answers
364
views
IDAPython with PyCharm throws: "ModuleNotFoundError: No module named '_ida_hexrays'"
I want to use PyCharm with IDAPython. I setup the Python Interpreter by adding the following path to the "Interpreter Paths":
C:\Program Files\IDA Pro 7.7\python\3
After that, it ...
0
votes
0
answers
441
views
Is there an class informer plugin(ida pro) that works for so libraries?
I started decompling a games .so library file recently and found that its written in c++(ida says its GNU C++). Soon i found some vtable functions like
(retvaltype...)(argstype...)(*(_DWORD*)(this + ...
1
vote
1
answer
64
views
Can I use Go dlv exec ./go-server to decompile all go code?
Supposed a go-server file was compiled by Windows system with linux OS, and Can I use Go dlv exec ./go-server to decompile all go code?
When I try to break some points, I got below message, but it ...
-2
votes
1
answer
316
views
64 bit equivalent of "GetModuleHandleA" need
I need to extent the compatibility of my application to 64 bit exe.
__int64 GetGameFunctionAddress(std::string GameFileExe, std::string Address)
{
// Get integer value address of the original ...
0
votes
0
answers
51
views
How do I make IDA python script step into the library?
How should I do, if I want to make IDA python script step into the library?
When I'm using debugger in IDA, every time the debugger meets the library, a notification appears whether to decide to step ...
0
votes
0
answers
23
views
Relative jump not pointing to in-range address [duplicate]
Note: Binary is obfuscated. I know that i can take the qword address and use that with the 0x1b0 but I'm confused as to why my approach below isn't working.
So I have this disassembly here. I'm trying ...
0
votes
0
answers
79
views
IDA Pro debug android apk fail
I'm trying to debug a .so file, and I used the android_server64 to attach to the apk. However, things doesnt go smooth. ida gave me this error "libprelinker64.so: could not find in process ...
1
vote
0
answers
59
views
How to call 3rd party plugin in idapython script
I need to use a python script to analyze some binary files in batches. In the script, I want to call some functions provided by third-party plugins, which can be called through the action that pops up ...
1
vote
1
answer
78
views
What is the outcome of mov on non bracket memory locations? [duplicate]
I am having problems distinguishing whether the address is loaded or the content from the address. Please help me clarify.
1. mov [rsp+78h+arg_0], rsi
2. mov rsi, cs:qword_1F39B60
3. mov [...
0
votes
0
answers
168
views
IDA: How to change the instructions displayed on the interface from arm to x86
enter image description here
The instruction in this picture is the arm instruction architecture, in fact I want to get the instruction of the X86 instruction architecture ,like movq movl cmpq addq...,...
0
votes
0
answers
75
views
Does anyone know how to get hints in IDA?
Does anyone know how to get hints in IDA? Is there any api?
I googled and checked ida's official documentation and didn't find any useful information.
I want to write an ida plugin to get hints ...
0
votes
0
answers
109
views
how to access PEB using ida python
How does one set breakpoints on PEB memory using idapython while debugging a process ?
ps:
I know there are many ways to hide the debugger in IDA pro, I am not trying only to hide it, I want to know ...
-1
votes
1
answer
41
views
What sort of address is 0x0000000140001000?
I'm using IDA Pro and right at the top of file is a field labelled Imagebase. Would this address be a absolute virtual address or relative virtual address or something else ?
0x0000000140001000
1
vote
0
answers
95
views
How can i change the entire speed (timing) of a android game made with cocos2dx?
i'm making reverse engineering on a android game made with cocos2dx library, editing the .so file (libcocos2dcpp.so) with ida pro and a hex editor. i've getting success changing small things, like ...