Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
0
votes
0 answers

Problems writing a plugin to ida pro in c++ Because of different versions

I'm trying to write a plugin for ida and I'm pretty stuck. Im using the newest ida pro version (6.1). It turns out that I used some things that not in use on this version. How do I solve the problem in my code with the commands with HT_graph? To…
reut
  • 241
  • 1
  • 3
  • 11
0
votes
0 answers

debugging C++ based app in windows 8

I have a windows 8 metro style app which is made from C++. (I am assuming this because there is no trail of HTML/JavaScript nor .net Assembly codes beside some interface definition. if there is a certain way to tell the developed environment of the…
daehee
  • 5,047
  • 7
  • 44
  • 70
0
votes
2 answers

Pushing offset of procedure in asm?

I am trying to acquire a cryption method from an executable file. I have unpacked and started to analyze with IDA Pro. I have encountered with a code that I couldn't able to understand in any way. Following is asm code block. ___:00A11B6F 008 …
turksauron
  • 36
  • 2
  • 10
0
votes
2 answers

keep getting access violation after setting a breakpoint with winappdbg

i am using winappdbg framework to build a debugger in python. i can set some breakpoints using the event.debug.break_at(event.get_pid(),address) in order to set the breakpoint but after setting certin breakpoints (and not while setting them but once…
0
votes
3 answers

Trying to figure out the following disassembly listing

I am looking at the following disassembly for a Win32 executable in IDA pro and get the snwprintf part but I don't understand the purpose of the mov ecx, [eax+4] instruction here (are they discarding part of the string here?). loc_4018E7: mov …
Bootstrapper
  • 1,089
  • 3
  • 14
  • 33
0
votes
2 answers

IDA Pro get Grey comments

I have an iOS App disassembly which has the following block: There are 'greyed out' comments in the picture of great interest which we want to capture from IDAPython. Such as which selectors are used on imported Framework objects such as UIWindow,…
gigasai
  • 564
  • 4
  • 23
0
votes
1 answer

Embed a tracing function in assembly code using IDA pro

I have to spy on a C++ DLL. I would like to insert trace calls inside the assembly code, e.g modifying the code to put a small code that would trace some variable into a text file. I do not have access to the runtime of the machine where the dll is…
user1211944
0
votes
1 answer

Generate control flow chart from ARM assembly

Currently I have some ARMv7 assembly code extracted from iOS 5 App with the help of IDA Pro, I would like to generate a control flow graph based on those assembly code. Is anyone can recommend the tool can help me to do that? I have little knowledge…
pa4373
  • 33
  • 3
0
votes
1 answer

Assembler ARM Force a boolean method to return always TRUE

That's the end of my code that I thing contain the return function. MOVW R1, #0x7368 ADD R0, PC ; MOVT.W R1, #0xF ADD R1, PC ; LDR R0, [R0] ; LDR R1, [R1] ; LDR R0,…
Usi Usi
  • 2,967
  • 5
  • 38
  • 69
0
votes
1 answer

IDA Pro string function

I have this binary file that I wish to edit, however after loading it, all strings are in some sort of gibberish symbols. Is there anyway to format it?
U.f.O
  • 299
  • 4
  • 7
  • 16
0
votes
1 answer

IDA python script, wrong number of argument for over loaded function ERROR

I have a simple python script that i wrote for IDA, but i'am can't figure out what am i doing wrong. file = open("c:\\example.txt", "r") for line in file: if line == "": pass else: addr = line.split(None,1) if…
Hanan
  • 1,169
  • 3
  • 23
  • 40
0
votes
2 answers

Finding functions address on the fly

My goal is to hook C functions with no symbol in stripped binaries on ARM platform. As the addresses of these functions may changed (ie. with an update of the binary), I want my interposing dynamic library itself to find the addresses. Moreover,…
jb_
  • 23
  • 3
0
votes
2 answers

Debugging IDAPython Scripts outside of IDAPro

I'm kinda new to scripting for IDA - nevertheless, I've written a complex script I need to debug, as it is not working properly. It is composed of a few different files containing a few different classes. Writing line-by-line in the commandline is…
YaronK
  • 782
  • 1
  • 7
  • 14
0
votes
2 answers

Find what file a short lived HANDLE is associated with

I am playing around with the demo of IDA and I am trying to do some reverse engineering of a program to figure out the structure of one of its files that it uses. My final goal is to be able to read that file directly from my own program. Using…
Scott Chamberlain
  • 124,994
  • 33
  • 282
  • 431
0
votes
1 answer

First called DLL

So, I have one may be simple question. First of all I want to notice that I'm beginner in debugging process with IDA, then please don't laugh at me... I want to debug windows service, exactly svchost.exe. I use IDA with Windbg. So, I attached to…
Dmitriy_Cert
  • 157
  • 1
  • 12