Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
0
votes
1 answer

IDA vs CE Disassembly View

I am using CE to view the assembly of a program and I easily get the needed address: 00B2356E. This is from the esp, 8. CE View When I go into IDA (within the exact same area) .text:0044354B loc_44354B: ; CODE XREF:…
Rohan Pas
  • 177
  • 1
  • 14
0
votes
2 answers

how exe works and how the call for dll and exe file addressing are made

How does a Windows-based executable file works? How is the starting address found in the executable file? For any file execution where are the addresses stored and how can we read those addresses? How the call and ret for any dll or exe file…
paul
  • 1
  • 1
0
votes
0 answers

Ida Pro Radare2 LD_PRELOAD

I'm doing an exploit type challenge. The challenge's binary to exploit uses a modified version of libc.so. So before running linux server or radare2 / ida, the export environment variable LD_PRELOAD=/path2/libc_modified.so and then I put a…
s1ckb0y
  • 47
  • 4
0
votes
1 answer

Writing plugin : IDA Pro crashes when I launch a thread

IDA pro craches when I try to start thread into the run method, any idea ?? Is there some restriction for running thread in ida ? because I found nothing in documentation, writing plugin ida. import idaapi from threading import Thread import…
LRBH10
  • 279
  • 2
  • 6
0
votes
0 answers

IDA Python - Identify Pushes for a Function Call

Given a sample assembly code snippet as follows: [1] push eax [2] push ebx [3] call function_with_1_arg [4] push ecx [5] call function_with_2_args Is there any IDA Python API, or simple script, to identify that lines 1 and 4 are the "relevant…
Edwin Lee
  • 3,540
  • 6
  • 29
  • 36
0
votes
1 answer

Can I watch what accesses a particular address?

With Cheat Engine it is possible to watch a particular address and keep track of what has accessed a particular memory address. I was wondering if this can be done too with OllyDbg or IDA. I could not find anything that would do that.
Stefan Falk
  • 23,898
  • 50
  • 191
  • 378
0
votes
0 answers

Is it possible to calculate virtual address by the offset in the executable?

I've found an array inside an executable which I want to further investigate at runtime - I want to know what and from where this array is getting accessed at runtime. Using IDA I have this block of bytes: .rdata:00D44170 1C 3C D4 00 80 E6 90 00 …
Stefan Falk
  • 23,898
  • 50
  • 191
  • 378
0
votes
1 answer

Access violation on `jmp` to appended segment

So I've used CFF Explorer to add a code section to an .exe file. I've set the section characteristics to 0x60000020 (executable, readable, contains code) and created some dummy code there using IDA. However, when I injected a jmp to that code from…
Ap31
  • 3,244
  • 1
  • 18
  • 25
0
votes
1 answer

How do I read the contents of stack variables in IDA?

I notice that a char buffer has been allocated on the stack in a function. It goes like this: .text:00401xxx Buffer= byte ptr -24h I know that I can read Dwords at memory addresses by going: Dword(0x
) But, how do I do the same for stack…
hexcode
  • 393
  • 1
  • 4
  • 13
0
votes
0 answers

how to detect array declaration in disassembled binary file

I have a .exe file, which I have disassembled by IDA Pro, I want to detect static array declaration (array stored on the stack). In the case of a dynamic array, there is a function call(such as malloc, calloc, new), which return the allocation…
David
  • 1
  • 1
0
votes
1 answer

Using trace32 to debug raw firmware via IDA and a BDM

I have a freescale mpc565 powerpc, I have a copy of the raw firmware I have read from the device and I have decompiled it within Ida pro. Is it now possible to debug the assembly using trace32 and a bdm without the original elf file and none of the…
rollsch
  • 2,518
  • 4
  • 39
  • 65
0
votes
1 answer

Understanding IE11's Ineterprocess Communication via COM

I'm quite new to COM object reversing (Windows Platform). I'm trying to reverse Internet Explorer on Windows 8.1, where child IE process communicates with Parent IE process via com (Due to Protected Mode). This is an ASM snippet of a virtual…
Dev.K.
  • 2,428
  • 5
  • 35
  • 49
0
votes
0 answers

IDA Portable executable pe

In my loader section missing PE, how to fix it? Only two options dos.ldw and Binary file. Have nice day.
Ramo Toric
  • 710
  • 1
  • 5
  • 12
0
votes
0 answers

Reverse engineering and patching of iOS app (IPA file)

For my master thesis I am working on reverse engineering a IPA file, since I'm new to this topic I'm open on all kind of suggestions. If anyone has any good tutorial or readings or just some personal knowledge to share with me, I would really…
Carlinho89
  • 157
  • 2
  • 14
0
votes
1 answer

What is IDA and how does it help me view .so files?

So I'm reverse engineering an Android app and looking for a string that I know is inside the app, somewhere. I've decompiled the app. I've done a search for the string in all files, looking for the string, but nothing is returned. I was told to use…
User
  • 23,729
  • 38
  • 124
  • 207