Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
9
votes
2 answers

Disassembling self-modifying code

I've been just wondering - how does one disassemble self-modifying binary? I guess you can't use olly or IDA because they are static disassemblers, correct? What happens with disassembler if you jump into middle of an instruction? And how does one…
Samuel
  • 2,430
  • 5
  • 31
  • 41
8
votes
2 answers

What are the key differences between IDA and x64dbg?

IDA pro ,x64Dbg, olldbg & windbg are used to Reverse Engineering purposes(as a Dissembler) and debugging. What are the main differences among them? when to use each?
Buddhika Chaturanga
  • 957
  • 2
  • 14
  • 29
8
votes
5 answers

x86 jnz after xor?

After using IDA Pro to disassemble a x86 dll, I found this code (Comments added by me in pusedo-c code. I hope they're correct): test ebx, ebx ; if (ebx == false) jz short loc_6385A34B ; Jump to 0x6385a34b mov eax, [ebx+84h] ;…
小太郎
  • 5,510
  • 6
  • 37
  • 48
7
votes
1 answer

Specifications of V8 snapshot binaries / debugging

I stumbled with NW and it's ability to load "compiled javascript binary files". After further reading (first I thought that would be just some minified javascript) I discovered that the docs were talking about actual binary files. It turns out V8…
alexandernst
  • 14,352
  • 22
  • 97
  • 197
7
votes
1 answer

DEbug x64 application using IDA PRO 6.1

I have IDA PRO 6.1 - (i am unable to install the latest version) I am trying to debug x64 application with bochs debugger or windgb. I did the following: installed Bochs-2.4.6 Installed both x86&x64 version of the windows debugger. Made sure the…
dandan
  • 509
  • 3
  • 8
  • 21
7
votes
2 answers

What is the effect of using JMP on a function address?

I was looking at a program in IDA as i was trying to figure out how a certain function worked, when I came across something like this: ; C_TestClass::Foo(void) __text:00000000 __ZN14C_TestClass7FooEv proc near __text:00000000 jmp …
ILOVEPIE
  • 177
  • 1
  • 10
6
votes
3 answers

Is it possible in IDA Pro to make a struct field offset to vtable which is defined in .data segment?

Here is what I want to achieve. I identified a class which I defined as a struct to store class data. One of the methods of the class uses class-field as if it's pointer to vtable. int __thiscall SignOn(struc_4 *this) { v1 = this; if (…
expert
  • 29,290
  • 30
  • 110
  • 214
6
votes
1 answer

PE - Distinguish data from function export

I'm trying to find a way to figure out in IDA which exports are data exports and which are real functions export. For example, let's have a look at Microsoft's msftedit.dll's export entries: While CreateTextServices is a real exported…
Aviv
  • 516
  • 1
  • 3
  • 21
6
votes
1 answer

IDA Pro disassembly shows ? instead of hex or plain ascii in .data?

I am using IDA Pro to disassemble a Windows DLL file. At one point I have a line of code saying mov esi, dword_xxxxxxxx I need to know what the dword is, but double-clicking it brings me to the .data page and everything is in question marks. How…
bunbun
  • 2,595
  • 3
  • 34
  • 52
6
votes
1 answer

(Ida Pro) Find out which functions use the import symbol

I am new to Ida and I need to use it to identify which functions within the executable call one of these. I am trying to find a way a packet is encrypted as a security exercise. Lets say I want to look at the imports window and see these, does that…
Kachinsky
  • 573
  • 1
  • 7
  • 20
6
votes
1 answer

How can I get SEL (@selector()) from object file (Mach-o)? how SEL stored in Mach-o?

From objc sources we can see that SEL is defined as typedef struct objc_selector *SEL; I have disassembly my dylib with idaq, and I did finde call of _MSHookMessageEx function, that is linked from libsubstrate.dylib _MSHookMessageEx has following…
BergP
  • 3,453
  • 4
  • 33
  • 58
6
votes
1 answer

Change the assembly language of IDA 5.0

Is it possible to set the assembly language to AT&T syntax for IDA 5.0? Thanks
mathk
  • 7,973
  • 6
  • 45
  • 74
6
votes
2 answers

Rebasing and debugging

So usually when I debug with IDA I don't come across any issues; however, with this one particular process (which is 9.9 MB in size before modules) IDA insists it rebase every single time it starts the process, which freezes IDA and forces me to…
Qix - MONICA WAS MISTREATED
  • 14,451
  • 16
  • 82
  • 145
5
votes
1 answer

Offset for objective C selectors in ARM assembly (IOS)

I'm trying to understand how IOS objective-C message calls are implemented in ARM assembly language. Looking at IDA disassembly output I can see the class and selector references pushed into registers before __obj_msgsend is called. This makes…
Locksleyu
  • 5,192
  • 8
  • 52
  • 77
5
votes
0 answers

Weird function preamble in disassembly: push ecx but not used

I'm analyzing some code in IDA and I can't figure out the purpose of a couple of instructions. The code begins with a standard function preamble that pushes the current value of EBP on stack and then shifts the current stack pointer into EBP to…
1
2
3
42 43