Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
0
votes
1 answer

IDA 6.9 IDC AddStrucMember

In IDA if I change the type of a struct member (using D hotkey) and dump to idc database in that IDC file it correctly produces an AddStrucMember command for that member. The problem is that if I change that member again (still with D) and then…
0
votes
1 answer

Ida Pro 6.9 crash

I am writing a plugin for Ida (in python) that utilizes the Etcd remote key value storage system. My problem is that when I attempt to get a lock on the server lock = etcd.Lock(self.client, 'ida_lock') Should timeout after 30…
0
votes
1 answer

Changing window width and height by disassembler

Well I have IDA and Cheat Engine. What I'm trying to do is change application resolution, actually just a width and height of the window. I know that changing just width and height will not make application work correctly, but it is my first step of…
ZeroVash
  • 546
  • 4
  • 20
0
votes
1 answer

How to disassemble a 32-bit ELF stripped c-program using IDA pro?

I want to know how to disassemble stripped ELF using IDA pro I just stripped and made it as 32-bit ELF program for understanding.. #include int my_password() { int pass,res,i,k; pass=5; for(i=0;i<=10;i++) { …
Raghul M
  • 110
  • 1
  • 2
  • 14
0
votes
1 answer

Generate Libc Signatures using IDA sigmake

I want to generate libc signatures using IDA sigmake for GNU/Linux 2.6.24 - 64bit. Is there a location from where I can directly download libc.a corresponding to the GNU/Linux 2.6.24 64-bit version. Where ever I looked on internet, only glibc source…
Hemanshu
  • 319
  • 3
  • 10
0
votes
1 answer

Retrieve native function address from mixed mode dll with IDA or Olly

this my first question here, so please dont be too hard on me:) What I got: a mixed mode C# dll, that has C# code which in turn calls a native method in the same dll, that im interested in The calling: int num3 =…
0
votes
0 answers

Calling a different function IDA ARM_ASM

Is it possible to, instead of calling one sub_ function, to call another? The ARM_ASM converter I am using converts: BL sub_67F7DC to: FE FF FF EB However, IDA converts that instruction into the following hex: B9 57 E8 EB Is it possible for me…
Aspire
  • 21
  • 1
  • 5
0
votes
1 answer

IDA Pro sometimes load source files, what's the reason?

So I'm trying to debug 'ccom' which was compiled with debug symbols. And so it should perhaps have source file (and lines) information included. I'm debugging it using IDA Pro 'linux_serverx64' (on host) and IDA Pro 6.6 x64 running in Wine…
AnArrayOfFunctions
  • 3,452
  • 2
  • 29
  • 66
0
votes
1 answer

IDA Dalvik Debugger w/ Android Libgame.so file?

I am trying to debug and breakpoint a libgame.so file that I extracted from an APK. It loads fine, and all the functions appear, but it won't let me use the Dalvik Debugger and attach to my phone like I did with the classes.dex file. EDIT: All that…
Aspire
  • 21
  • 1
  • 5
0
votes
0 answers

Unable to understand a particular LDR command

While attempting to disassemble my school library's book keeping app using IDA pro i came across this LDR statement which im not able to edit. I wanted to increase the no. of pages of a particular book to a higher value so i found out the ARM…
Sujith Sizon
  • 123
  • 6
0
votes
1 answer

Can't decode a simple ARM function prototype from a dissasembly?

I can't figure out the prototype for this simple function: In stack: Function call: That's what I got so far, and it causes an error. //No idea void CameraDeviceCreate(int one,int two,int* three); There are three registers used (R0,R1,R2) so…
Kristina
  • 15,859
  • 29
  • 111
  • 181
0
votes
0 answers

Can't find the base address of a function with IDA PRO (compiled with vs2015)

Hi so I was just trying to learn reverse-engineering and when I open my program in IDA pro I find this address sub_11330 (rebased to 0) https://gyazo.com/1c34d2c31f29583f05d0dd4d956d6f74 however when I try to hook this function the address…
user5038565
0
votes
1 answer

What is happening in this disassembled code, and what would it look like in C?

I've disassembled this c code (using ida), and ran across this bit of code. I believe the second line is an array, as well as the 5th line, but I'm not sure why it uses a sign extend or a zero extend. I need to convert the code to C, and I'm not…
Stanfrancisco
  • 352
  • 1
  • 7
  • 24
0
votes
1 answer

Is it possible to view strings in Memory using IDA just like I can in OllyDbg?

I have wrote a simple registration program that requires a Name and License Key in order to get to the success message. The coded solution simply expects both fields to be case sensitive, the Name field must be Admin and the License Key must be…
Craig
  • 1,874
  • 13
  • 41
0
votes
0 answers

Hex-Rays IDA Decompiler

I've been trying to decompile an exe file (or just one function, for all I care), and I've been running into the following error: Decompilation failure: FFFFFF: wrong basic type sizes in compiler settings According to the manual, I should check…
Kileraptor1
  • 11
  • 1
  • 7