Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
5
votes
2 answers

How can I make EXE file of the modified copy?

I made my changes using IDA but I don't know how to make the new file exe again
Abdullah
5
votes
2 answers

IDA Pro and editing executables

This is kind of an unorthodox question. I'm kinda new to using IDA Pro. Is there a way to edit the assembly code and then have IDA save the result as an executable? Is there some kind of plugin maybe that does that? because it seems that IDA…
shoosh
  • 76,898
  • 55
  • 205
  • 325
5
votes
2 answers

In IDA Pro, is there a way to flag a function?

I found a particularly important function using IDA Pro. However, the source is very large and I'm sure I'll lose track of it soon. Is there a way to "flag" the function as important, color code it, or something similar?
samoz
  • 56,849
  • 55
  • 141
  • 195
5
votes
1 answer

HexRays - what is "__OFSUB__()" purpose?

In the following decompiled function using Ida pro's Hex rays: int sub_409650() { int v0; // ecx@1 int result; // eax@1 bool v2; // zf@1 bool v3; // sf@1 unsigned __int8 v4; // of@1 unsigned __int16 v5; // cx@2 unsigned int v6; //…
paulm
  • 5,629
  • 7
  • 47
  • 70
5
votes
1 answer

IDA doesn't work inside screen

I am trying to run idal64 (IDA pro) inside a screen session, but I receive this error: TVision error: Can not load libcurses.so Without libcurses can work only with xterm/linux Aborted (core dumped) I installed 'libncurses5-dev',…
badnack
  • 737
  • 1
  • 11
  • 20
5
votes
1 answer

Get memory addresses using IDAPython

In my code, I am using idc.GetOpnd(ea,0) and idc.GetOpnd(ea,1) to get the 2 operands of an instruction. However, if its a call (or jmp) instruction, I am getting symbols like _perror and loc_8083BA9. Using IDAPython, is it possible to remove all…
Maggie
  • 5,923
  • 8
  • 41
  • 56
5
votes
1 answer

Analyzing binary taken from memory dump in IDA Pro

I'm having problems with analyzing a simple binary in IDA Pro. When running a program, i dumped part of its memory (for example, unpacked code section in the memory) into a file, using WinDbg. I would like to analyze it using IDA, but when trying to…
woottoow
  • 53
  • 1
  • 4
5
votes
2 answers

IDA "Invalid Operand" error when patching

I am attempting to patch a binary in IDA using the "Assemble" option, and every time I enter an instruction with some arithmetic to calculate the offset, I receive an Invalid Operand error. For example: mov [bp-4], bx returns Invalid…
user3712482
  • 103
  • 1
  • 8
5
votes
0 answers

IDA- Positive SP has been value found

I'm trying to decompile an old binary of mine since I've lost it's source (formatted my computer). I'm facing the following issue when trying to decompile a function. Why does it happen and how do I get past it step by step?
user3265040
  • 305
  • 1
  • 4
  • 11
5
votes
1 answer

Understanding x86 MOV Syntax

I think this an easy (perhaps stupidly-easy) question to answer, but after almost two hours of Google-ing, I've struck out. I'm pretty sure that my problem is because I just don't understand what the syntax is doing. I'm looking at some disassembled…
CatShoes
  • 3,613
  • 5
  • 29
  • 43
5
votes
2 answers

How does one change an instruction with a hex editor?

I am messing around with some reverse engineering, but I don't know how to change a jnz to jz with a hex editor. I understand it will vary between systems but I'm not sure where to look to find this information. I'm working on Mac OS X 64 bit and I…
carboncomputed
  • 1,630
  • 3
  • 20
  • 42
5
votes
2 answers

Reverse engineering C++

Today I decided to decompile a simple "Hello world" program written in visual C++, using IDA Pro. With my previous knowledge I was sure I would not find the immediate call to printf at the executable entry point, and I was right. I found a lot of…
Michael
  • 796
  • 11
  • 27
4
votes
1 answer

Difference between main and __libc_start_main

I am beginning to get into the reverse engineering and am using IDA Pro and am working on deassembling a binary. I am trying to find the memory address for the main function of the C program I am working with. However, I see that there is a function…
artemis
  • 6,857
  • 11
  • 46
  • 99
4
votes
2 answers

IDA. how can i install decompiler?

I downloaded from official site(hex-rays) IDA, installed, everything works. I found needed for me function, pressed F5(hotkey for decompile so i would see C pseudocode), and got pop-up message: ida sorry you don't have any decompilers on…
Engelard
  • 137
  • 1
  • 1
  • 7
4
votes
1 answer

When I dump a pe from memory,how can I repair IAT?

I'm analyzing a malware, the malware decrypt a pe file to memory, like this I use ollydumpex for x64dbg to dump the memory, then use IDA to analyze, but it like this this is a dll, it will be injected to other process. so current process will not…
xina1i
  • 748
  • 4
  • 9
  • 21
1 2
3
42 43