Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
4
votes
0 answers

Pseudo Code doesn't work for IDA Pro

I'm currently having a problem with my IDA Pro which makes me unable to obtain Pseudo Code. Whenever i try to press F5 or just go to Subviews -> Pseudo Code it won't do anything. It doesn't give any errors or anything, it's just doing nothing. I'm…
nesben
  • 59
  • 1
  • 1
  • 4
4
votes
2 answers

sp-analysis failed in IDA pro

I am using IDA pro to analysis software binary. Sometime, some function with end up with sp-analysis failed. I am writing program with IDAPython. Is there any API to detect this case, so I can ignore those failure cases for now.
user3588276
  • 137
  • 1
  • 8
4
votes
1 answer

How to debug *.so in apk with IDA Pro?

I have an apk file using jni. I can pass classes.dex to IDA pro and attach it to the process on the device, but I can't enter into native library *.so. How to do it? I even don't see C functions in "functions window" field. I see only java…
user3360601
  • 327
  • 3
  • 17
4
votes
1 answer

Setting an IDA function pointer in a struct via script

The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member fncQuery I would change the string to: BOOL…
4
votes
1 answer

Memory map in IDA Pro similar to OllyDbg

Does IDA Pro have a memory mapping functionality similar to that in OllyDbg? If so, I can't find it. I know there is that skinny bar at the top of the screen showing where you are in the address space and where memory is allocated, but I consider…
Tyler Durden
  • 11,156
  • 9
  • 64
  • 126
4
votes
2 answers

IDA pro script to extract all the instructions into a assemble file

I am looking for some IDA pro scripts to extract all the instructions and write them into a assemble file, which can be re-assembly Could anyone give me some help? Thanks!
lllllllllllll
  • 8,519
  • 9
  • 45
  • 80
4
votes
3 answers

Assembler: Calculating a memory address with register base

I have this simple assembler command: mov eax, fs:[30h]; My problem is that I need to know what specific address is really read by this command. I found a lot of documentation about the assembler addressing modes but nothing about the register:…
Robert
  • 39,162
  • 17
  • 99
  • 152
4
votes
2 answers

Convert large amount of code to data in IDA

Well, Unfortunately I hit 'C' on a data section of a binary i had worked a lot on and saved it as i had a lot of work unsaved. I tried converting this huge section back to data but whenever i select lines and press 'D', only the line where the…
sgupta
  • 1,214
  • 2
  • 15
  • 29
4
votes
1 answer

What is large dword?

What function have short and large in this code portion? large is same as long dword? mov eax, ebx cmp [ebp+var_1], 0 jz short loc_413123 call sub_40341C pop large dword ptr fs:0 add esp, 0Ch
user1629569
  • 661
  • 1
  • 4
  • 17
4
votes
1 answer

Disassemble and use a .obj file

I have a course (reverse engineering) in uni and i have a homework. I got a .obj file (which was compiled with visual studio 2008), and i have to disassemble it, figure out the control structure and call it in a little c program. I used IDA…
amman
  • 142
  • 4
  • 12
4
votes
2 answers

Figuring out the memory layout of objects without debugging a running program?

I'm working on reverse engineering a program. I'm using IDA Pro and the Hex-Rays Decompiler. I'm coming up against chunks of code where I know there is an object and there is a method call on the object but it's shown in a way I'm not able to…
Toby Lawrence
  • 408
  • 2
  • 10
4
votes
0 answers

Disassembly in Emacs

How can I disassemble a .dll / .so (C++/C) or .pyc (Python) file in Emacs, as with tools such IDA Pro? If possible, please share some disassembly snippets/plugins for Emacs. Maybe Emacs can handle disassembly better than IDA Pro.
chao787
  • 1,760
  • 3
  • 18
  • 20
3
votes
4 answers

Modifying a program to fake a button press

I have an MFC application that I was given (without source code) which opens a window with an 'Update' button, which then performs a very long update after being clicked. I'd like to modify the program so that when the window is created (or…
samoz
  • 56,849
  • 55
  • 141
  • 195
3
votes
2 answers

How do I disable graph mode in Assembly view in IDA 6.1?

How do I disable graph mode in Assembly view in IDA 6.1 ? By graph mode I mean this I see Options -> Graph -> Use graph view by default, but un-checking it doesn't help :((
expert
  • 29,290
  • 30
  • 110
  • 214
3
votes
1 answer

snapshot of memory for process on mac?

I want to take a snapshot of memory of process in action on mac. I have no idea how to do it. I have IDA-PRO for mac with me. Can it be used? How? Can anyone suggest me a way to do this? (some documentation or example). May be some techniques from…
RLT
  • 4,219
  • 4
  • 37
  • 91