Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
0
votes
1 answer

How can I get the right selector in ARM assembly

When I open the iOS framework AddressBook with IDA, I get the following code: **__ABPeoplePickerNavigationController_initAsAddressBook_withAddressBook__ var_C= -0xC PUSH {R7,LR} MOV R7, SP SUB SP, SP, #4 MOVW …
0
votes
3 answers

IDA not identifying statically compiled functions

I'm currently reverse engineering a file that appears to be statically compiled, however IDA Pro isn't picking up on any of the signatures! I feel like I am spending a lot of time stepping through functions that should be recognized by IDA, but…
Fran Fitzpatrick
  • 17,902
  • 15
  • 33
  • 34
0
votes
2 answers

IDA Pro CommandLine Patch program

I have just started using IDA Pro ( trial version). I am trying to De-compile a binary ARM file using IDA Pro ;Is it possible to add an entirely new function to the binary and also is it possible to change the name of an existing function? I was…
srcKode
  • 53
  • 1
  • 1
  • 8
0
votes
1 answer

Does there exist a program that can show me the differences between two executables?

Does there exist a program that can show me the differences between two executables? I need a program that takes two executables as input and can generate a diff file with all the differences.
Usi Usi
  • 2,967
  • 5
  • 38
  • 69
-1
votes
1 answer

Patching iphone calculator.app with IDA for testing

I'm trying without success to patch iPhone calculator to replace the + function with the - function. I do some stuff but when I try to launch it from my iPhone it crashes. What I do is: Opening the .app file and looking for the file that contain…
Usi Usi
  • 2,967
  • 5
  • 38
  • 69
-1
votes
1 answer

What sort of address is 0x0000000140001000?

I'm using IDA Pro and right at the top of file is a field labelled Imagebase. Would this address be a absolute virtual address or relative virtual address or something else ? 0x0000000140001000
JbG
  • 57
  • 7
-1
votes
1 answer

how to simplify this pseudocode

I have this pseudocode in IDA but I don't understand the result when I compiled it __int64 v17 = 507890351016; __int64 v20 = 0; auto test = *(WORD*)(*(uintptr_t*)v17 + v20); the output of test is 48, can someone explain what's going here and what…
-1
votes
1 answer

How to fix error "could not initialize WinDbg engine" in ida pro 7.5?

I get this error when i am trying to run the debugger: I already wrote the path to the debugger in ida.cfg. The problem was in Russian characters in the file path.
Green Map
  • 1
  • 4
-1
votes
1 answer

How to replace a store of EAX with a store of an immediate constant?

From my previous question, I asked how to change the nation code to what I needed it to be. I explored in the disassembly more and I found out exactly where I needed this change to be. In other files, the code seems to be: mov ds:dword_73A9C8, 1…
-1
votes
2 answers

How about Fuzzing a binary by reversing it to source code?

I am researching how to use AFL to fuzz a binary. I know that it is possible to use qemu mode to achieve it. However, using qemu mode really impact the fuzzing performance. Thus, I am wondering that what if I reverse the target binary to C code by…
desionxxx
  • 21
  • 3
-1
votes
1 answer

Can this decompiled C function (in IDA) be ported to non-pointer languages (python/java/etc.)?

unsigned int __cdecl EncryptCode::DecryptCodeByXOR(EncryptCode *this, unsigned __int8 *dest, unsigned int *a3) { unsigned int result; // eax unsigned int v4; // eax unsigned __int8 v5; // bl unsigned int v6; // edx int v7; // ecx …
-1
votes
1 answer

How to alter time and date stamp of PE32

Where would I need to look to change the time and date stamp of a PE32 file? I apologize if this is too open ended, perhaps someone here can point me in the right direction or to the correct resource. I've been looking around to no avail. I have…
Midge_Mong
  • 33
  • 2
  • 8
-1
votes
1 answer

How to Decompile an unknown packed .exe

I'm new to decompiling, so I'm sorry if I sound like an idiot. Using Process Explorer I found out that the .exe I want to decompile is packed, and via PEiD it says "Nothing found *" . Due to it being packed, I am clueless on how to proceed. Any…
Denis
  • 31
  • 1
  • 7
-1
votes
1 answer

Win32 application MOV to memory address does not work correctly

I am playing with some test application to try to patch its code. here is original code from IDA pro movzx eax, byte ptr word_F3BB4A and eax, 2 jz short loc_62300F here is my patch push ax xor ax, ax mov byte ptr word_F3BB4A,…
-1
votes
2 answers

How do I establish a connection to dashDB from IDA?

I'm trying to generate a physical data model on Bluemix using InfoSphere Data Architect running on my local machine. I have a dashDB service up and running and know all the connection settings. I can't seem to set up a connection from IDA to my…