Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
0
votes
0 answers

How can i figure out instruction pointer address in the certain part of my java code?

I'm just trying to get a memory trace generated by Java code(JVM) using pin tool(pinatrace). But every result of the microbenchmarks I try to figure out the traces shows almost same graphs, and even utilizing processbuilder inside Java code gives no…
Shin
  • 1
  • 1
0
votes
0 answers

Reverse Engineering ELF Patches

I have an OTA patch which according to the source code of it's vendor (OpenSource) seems to be generated by Red Hat coreutils and it's an ELF binary. Using IDA Pro, I can see a lot of nullsub and segments in the binary, but my goal is to reverse…
Hamed
  • 199
  • 1
  • 11
0
votes
1 answer

ImportError: No module named in IDA script

I executed a IDA test.py script on Ubuntu with this command './idal -S"test.py" -t', there would be a error - no module named xxx, i imported xxx module in this script, but when i separately executed test.py, it is OK. I do not know why this…
Keen
  • 1
  • 1
  • 3
0
votes
1 answer

How to accomplish IDA GenFuncGdl?

How to accomplish GenFuncGdl? I mean, what idc functions are used to accomplish GenFuncGdl? I look up idc.py, about this function: def GenFuncGdl(outfile, title, ea1, ea2, flags): """ Generate a flow chart GDL file @param outfile: output file name.…
Keen
  • 1
  • 1
  • 3
0
votes
1 answer

what is the equivalent of ni si in IDA python?

I want to make a simple IDA-python script which sets a break point to some specific memory address then continue and filter break point hits with some rules.. In case of gdb. I can make a gdb script such as bp 0x12345678 c if ~~~ else…
daehee
  • 5,047
  • 7
  • 44
  • 70
0
votes
1 answer

How to check a immediate value if it is a valid EA in ida?

For example: 68 38 30 42 00 push offset aUser32_dll_0 ; "USER32.DLL" If I get an operand value using GetOperandValue(), how can I check this immediate value is a valid linear address?
Keen
  • 1
  • 1
  • 3
0
votes
1 answer

Extracting a function using ida pro

I've been reverse engineering a dll i believe to contain malicious code using IDA pro, and I've identified a very important subroutine. In order to facilitate unit testing, i'd like to reimplement the subroutine in my own application, but re-writing…
0
votes
1 answer

[IDA Pro][python Script] :: How to Export binary pattern of an address up to it is end?

I wanna to export a function's binary pattern from its beginning address to its end address with python script in IDA pro. For example: sub_454345. I want to first identify in which address this function starts and then in which it ends, after that…
Ehsan
  • 43
  • 1
  • 5
0
votes
1 answer

IDA Assembly change jump destination

I'm new to reverse engineering and i'm trying to change a __text:001C2BE4 jz loc_1C3180 which jumps to __text:001C3180 loc_1C3180: into a jump to another subroutine. (__text:00128DC0 sub_128DC0:) However, I don't yet…
Laurent
  • 1,292
  • 4
  • 23
  • 47
0
votes
1 answer

Can I add assembly language commands and data into an existing binary?

This question is mostly about my experience with Hopper - The OS X and Linux Disassembler although conceptually I think it would also apply to other Disassemblers like IDA. The tools allow one to see the assembly code representation of the (hex)…
cwd
  • 53,018
  • 53
  • 161
  • 198
0
votes
1 answer

Protected-Mode Segmentation in IDA

I'm trying to disassemble the BIOS code for the original Xbox, but I'm having trouble setting up Xrefs involving protected-mode segmentation. For example, the instruction: seg001:FFCE jmp large far ptr 8:0FFFFFE00h The segment…
Drew McGowen
  • 11,471
  • 1
  • 31
  • 57
0
votes
2 answers

X64 Disassemblers IDA and WINDBG. IDA doesnt show x64 opcodes

So i just started learning WINDBG, upgrading from ollydbg to 64bit. and while studying something weird happed: on WINDBG i see all the RXX Registers and opcodes while on IDA i still see the EXX opcodes while debugging the same EXE (notepad.exe for…
Frustrated
  • 13
  • 4
0
votes
1 answer

Unable to analyze the nature of the function in a given memory location

I'm trying to analyze malware in an executable. I'm trying to analyze the nature of the function at the subroutine sub_401040. When I ran it in IDA Pro, I got assembly code that looks something like the one that is posted below. However, I'm a bit…
ramu ranga
  • 57
  • 4
0
votes
2 answers

What do these instructions mean?

In the last two months, I learned basic reverse engineering, assembly, and C. I got a binary from my friend; they asked me to reverse that binary to original source. I used IDA Pro to reverse the binary file, but I have some problem with these…
0
votes
1 answer

Is there a way to export asm file which is unhide all items from IDA Pro

I want to get an asm file which was dissassembled using IDA Pro and use scripts to make lots of asm files at once. I tried two ways to get asm file first one was with idapython: idc.GenerateFile(idc.OFILE_ASM, idc.GetInputFile()+".asm", 0,…
Exiling
  • 63
  • 1
  • 8