Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
0
votes
1 answer

How to know what memory zones are writable

I want to know how to know what memory zones are flagged as writable while I am debugging a process. So, I put a breackpoint in the code and I want to know in that moment what memory zone is writable. How can I do it? I'm using IDA Pro. Thank you
Alberto
  • 701
  • 4
  • 9
  • 25
0
votes
3 answers

Unable to create flirt signature for ida pro

I am trying to create the flit signature file for zlib library. My flair version 6.1 .I am using the following command: $ ./pelf libz.a zlib.pat Output: skipped:0 total:0 $ ./sigmake zlib.pat zzlib.sig Output: No headers found. The problem is…
user101847
  • 81
  • 1
  • 5
0
votes
1 answer

Can IDA run in ReactOS?

I have a project where I will be distributing a reverse engineering environment using vagrant and I am concerned about using a Windows image as the vm base for licensing reasons. I would like to use ReactOS to run IDA (freeware version) and am…
user284244
0
votes
1 answer

(g++) Striping the function names

I have problem with g++ it doesn't strip names of my functions, i can open my program in (for example) ida and see names of all functions, global variables etc. I'd like to strp all of them (so it's like sub_xxxxxxx) This is my compiling file. g++…
0
votes
1 answer

IDA Pro remote automation

I am trying to run IDA Pro (full version) remotely through a linux terminal as to automate the analysis and output process. I know there are plugins such as IDAPython and there is the use of the flags for terminals using the idal command. My…
sudobangbang
  • 1,406
  • 10
  • 32
  • 55
0
votes
1 answer

Setting this pointer to a structure

I'm reversing a program, and slowly I'm starting to build a custom structure which no doubtfully represent a class (e.g. first DWORD points a a vtable, etc.). This is a Windows binary with some COM implementation. Some methods use the stdcall…
Uri London
  • 10,631
  • 5
  • 51
  • 81
0
votes
1 answer

Modifying instructions using ida APIs

I want to change the Op value of an instruction using idautils and or idaapi. For example, I have downloaded in memory a binary file, and I want to change the JMP address of a JMP statement (I know where the jump is and I can get the statement). I…
badnack
  • 737
  • 1
  • 11
  • 20
0
votes
3 answers

disassembled exe file contains much more code than source

I'm trying to disassemble this file but i Keep getting tons of codes added to it. Visual C++ #include int main() { int x = 1; int y = 2; printf("\rStart me UP"); x = x+y; y = y+x; printf("\rX is %d, Y is %d",x,y); return 0; } stuff like…
0
votes
1 answer

Determining Binary Offset to a Pointer in Assembler/IDA

See http://pastebin.com/QLywfZYK for the relevant disassembled code in IDA. My question is which is the correct binary offset to get the pointer dword_1082FF28 when starting from the function signature (55 8B EC 83 EC 1C ...). I'm reasonably certain…
0
votes
1 answer

IDA Pro: How to change the virtual segment register T in a script

If I press option/alt-G, IDA shows a dialog which allows me to change the value of the T segment register to 1 to indicate that the following bytes should be interpreted a Thumb code. I would like to be able to change the value of T in a…
ericg
  • 8,413
  • 9
  • 43
  • 77
0
votes
1 answer

how to write this in C

how to write this ASM code in C? loc_536FB0: mov cl, [eax] cmp cl, ' ' jb short loc_536FBC cmp cl, ',' jnz short loc_536FBF loc_536FBC: mov byte ptr [eax], ' ' loc_536FBF mov cl, [eax+1] inc eax test cl, cl jnz short loc_536FB0 I have figured out…
user1365830
  • 171
  • 1
  • 11
0
votes
1 answer

Missing IDA PRO Mach-O file for ARMv6 support

I've just downloaded IDA Pro 6.4 demo version and when i try to open an iPhone binary file i can only chose "Macho-O file (EXECUTE).ARMv7 [macho.ldw]". I've seen people having to chose between ARMv6 and ARMv7 on their IDA Pro version. I need that…
Robin
  • 64
  • 1
  • 1
  • 6
0
votes
1 answer

Extract loaded debug symbols into .pdb

I'm currently reversing a new application and encountered a strange behaviour: Browsing the running application with 'Cheat Engine' reveals the function names retrieved by the loaded symbols. An example address: 'xxxx.lua_getinfo+A8EE' The…
Marco de Abreu
  • 663
  • 5
  • 17
0
votes
1 answer

Hooking a _userpurge function c++

I want to hook a function from a x86 executeable. That's the functions prototype decompiled with the hex-rays plugin for IDA: int __userpurge sub_43CE70(int a1, int a2, char a3, int a4, int a5, int a6) so the function is acception eax as…
0
votes
1 answer

Getting address of Lua State pointer to get result in outer program

I would like to know how it's possible to get the address of Lua_State from program which uses Lua. Im not really expieranced with Assembler but I know C++ pretty well. This is how source should look like: #pragma comment(lib, "lua51.lib") #pragma…
deepspace
  • 771
  • 3
  • 11
  • 25