Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
0
votes
0 answers

How to locate where an error arises in a "PackageManager.AddPackageAsync" method call?

I'm debugging an example app that deploys an Windows Metro App Package (".Appx" file). It call a WinRT method "PackageManager.AddPackageAsync" which fails with detailed error code text (retrieved from the call return value after the operation was…
AnArrayOfFunctions
  • 3,452
  • 2
  • 29
  • 66
0
votes
1 answer

Using a struct exported from IDA with pointers in C++

So I have exported a struct from IDA Pro and put it in a header file like so: #pragma pack(push, 1) struct CPed { float health; CPed *closestPeds[10]; }; #pragma pack(pop) In the main I used it like this: unsigned int ClosestPed =…
Omniox
  • 1
0
votes
1 answer

Ida Pro and PyQt simple buttons connect

how do i connect the buttons, in a Ida Pro using a script and PyQT. this script brings two buttons up. my script. from idaapi import PluginForm from PyQt4 import QtCore, QtGui from PyQt4.QtGui import QWidget from PyQt4.QtGui import…
michael
  • 31
  • 7
0
votes
1 answer

IDA PRO 6.5 LNK1104 error

I am green to IDA pro and any help would be appreciated! my efforts: My end goal would be to write(compile) my own helloworld plugin which I also found in the IDASDK. I am unable to accomplish that as I always get hit by a LNK1104 cannot open file…
laycat
  • 5,381
  • 7
  • 31
  • 46
0
votes
2 answers

Need Help in C++ Disasm

I do some C++ disassembling with IDA Pro. But I often see lines likes these. call __ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc ;std::operator<<>(std::basic_ostream> &,char …
jarCrack
  • 106
  • 2
  • 9
0
votes
1 answer

Patching an EXE using IDA

Say there is a buggy program that contains a sprintf() and i want to change it to a snprintf so it doesn't have a buffer overflow.. how do I do that in IDA??
0
votes
1 answer

Why objdump can figure out certain entry of PLT is used for “printf”, “puts”, and others?

Test platform is on 32-bit Linux. I use objdump to disassemble a stripped binary. So in the disassemble asm code, I can see instructions like this: 80483e4: e8 07 ff ff ff call 80482f0 So basically e8 07 ff ff ff is just a relative address of one…
lllllllllllll
  • 8,519
  • 9
  • 45
  • 80
0
votes
1 answer

IDA PRO with BOCHS plugin for debugging fails before reaching main

I want to debug a program with the plugin Bochs in IDA Pro. I have IDA Pro 6.4 and Bochs 2.5.1. With all my executables, when I launch Bochs (with the PE mode) I have this execution : bochsys:E0001810 bochsys_R3Entry: bochsys:E0001810 mov eax,…
0
votes
1 answer

Ida Pro Calling the internal debuggers via Python script

Is there some way to call the internal remote gdb debugger via python in the IDA Pro environment? Note that I am referring to situations in which the process doesn't already have a debugger attached, and I would like to call the remote gdb debugger…
michael
  • 31
  • 7
0
votes
1 answer

ida pro virtual function actual declaration

I am trying to hack into an exe to find the implementation of certain functions and perform actions in an injected dll. The exe is a sort of screen saver, and fortunately very simple, so it uses important strings to identify code sections. My…
0
votes
1 answer

Decompiling - _thiscall expression

I'm using Hex-Rays's IDA Pro to decompile a binary. I have this switch: case 0x35: CField::OnDesc_MAYB(v6, a6); break; case 0x36: (*(void (__thiscall **)(_DWORD, _DWORD))(*(_DWORD *)(a1 - 8) + 28))(a1 - 8, a6); break; case 0x3A: …
user3265040
  • 305
  • 1
  • 4
  • 11
0
votes
1 answer

How to translate "rterrmsgs <8, aR6008NotEnough>" into a legal nasm-style asm code?

I use IDA Pro to disassemble SPEC 2006 binaries on Windows 7 32 bit. It generates a variable declared like this: rterrs rterrmsgs <2, aR6002FloatingP> rterrmsgs <8, aR6008NotEnough> terrmsgs <9, aR6009NotEnough> rterrmsgs <0Ah, …
lllllllllllll
  • 8,519
  • 9
  • 45
  • 80
0
votes
1 answer

Python pointer to unicode string

I am new to python, in fact i am just using it for IDA pro script making, so its fairly easy to understand but i am struggling to convert a long type to a unicode string, here is a snippet of my script: def get_ModAddr(list, modname): flink =…
ffenix
  • 543
  • 1
  • 5
  • 22
0
votes
1 answer

How to translate "aKernel32_dll_0: unicode 0, , 0" into a legal declaration?

I use IDA Pro to disassemble SPEC 2006 binaries on Windows 7 32 bit. It generates a variable declared like this: aKernel32_dll_0 unicode 0, ,0 In the .text section, I find usage of this variable like this: push offset…
lllllllllllll
  • 8,519
  • 9
  • 45
  • 80
0
votes
1 answer

How to deal with jump table embedded in the .text section in nasm?

Basically I use IDA Pro to disassemble some binaries from SPEC2006, and do some modification work to make it nasm-reassmeble on Windows 7 32bit. I find one problem in the disassembled asm code generated from IDA Pro like this: ;this is…
lllllllllllll
  • 8,519
  • 9
  • 45
  • 80