Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
-1
votes
1 answer

Structure about the Mach_O File

Hi guys who knows the align field is what?I use ida pro to destruct this file but interrupted at the __text section its maybe the developer had do someting into this macho file. like edit the offset field to avoid the developer decomplier this…
TKingLee
  • 13
  • 4
-1
votes
1 answer

Reverse enginering native DLL with IDA to extract constants

I need to find some constant values from a native DLL. I could find their names, but I cannot understand how to get values. These are all constants names that i'm looking for: brCustom, br110, br300, ... br9600, ... And here is where I found them…
Tobia
  • 9,165
  • 28
  • 114
  • 219
-1
votes
1 answer

How to convert machine code to readable assembly (IDA free)

I need to convert a lot of Machine code hex to Assembly. I'm using the free version of IDA. I'm confident it can do this, but whenever I input the machine code in formats raw, bin, hex, exe, dmp it opens like this: seg000:00010 32 34 35 32 20 33 31…
Ponyisasquare
  • 189
  • 1
  • 2
  • 12
-1
votes
1 answer

IDA search and replace all occurrences

i am sure this is simple, but... I want to replace all occurrences of command push 801h to push 802h how can i do that with Ida6 ?!
Ray
  • 429
  • 6
  • 16
-1
votes
1 answer

How to remove code analysis from ida pro as olly debugger?

(1) I reverse engineer a program in Ida pro and I see lots of "db" instructions (2) In olly debugger ,"db" instruction can be remove by option "remove code analysis from this module". (3) how i can remove code analysis from Ida pro? (4) i have also…
ASD
  • 87
  • 1
  • 1
  • 8
-1
votes
1 answer

Unclear behavior DOS application's function

I'm trying to reverse some DOS application. It's uses *.VAR file like database (perhaps encoding this file). That's application looks like system for testing students. The application shows random questions from the DB-file and get your answer. In…
murzagurskiy
  • 1,273
  • 1
  • 20
  • 44
-1
votes
1 answer

Change assembly opcode

I have the following code: I am using IDA PRO. I am trying to patch this code and change the line mov eax, [rax+10h] to mov eax, 3. mov eax, 3 is B8 03 00. I do this in the hex editor and when I change the code from 8B 40 10 8D 48 01 41 89 4B 10…
dandan
  • 509
  • 3
  • 8
  • 21
-1
votes
1 answer

Converting C# to Python

I am trying to convert a idc script(ida pro)from c# to python.Python dont give me any errors, but i recon it must be the for loops. idc scripts #include "common.idh" static FindEmbeddedElfs() { auto ea, header, header2, elf_header, cont1, cont2,…
michael
  • 31
  • 7
-1
votes
2 answers

How to obfuscate iOS binary.

Hi, I'm just wondering how you could obfuscate functions in iOS binary? If you tried to reverse iOS binaries using tools like ida you will see part of the binaries have obfuscated functions like all or partly named sub_xxxxxxxx but the other have…
zizeq9
  • 1
  • 1
  • 1
-1
votes
1 answer

Change beheviour of target function but not completely

EDIT: I know it's possible with OllyDBG, I made it working but still I need runtime version(CPP) so I could perform jump there. In this function(pseudo-code) inside the switch I would like to modify the operations in the case 115 e.g. change CALL…
deepspace
  • 771
  • 3
  • 11
  • 25
-2
votes
1 answer

64 bit equivalent of "GetModuleHandleA" need

I need to extent the compatibility of my application to 64 bit exe. __int64 GetGameFunctionAddress(std::string GameFileExe, std::string Address) { // Get integer value address of the original function hook #if defined(_WIN64) ///…
user3449922
-2
votes
1 answer

How to Fix the Instruction in Code which cause application crash

The main application file is crashing becausing The server is affected by a format string bug when handles the players nicknames due the access to an invalid memory zone. The instruction executed is "cmp [EAX], 00000000" where EAX contains 4 of the…
Саша
  • 837
  • 4
  • 12
-2
votes
1 answer

How to use JMP in IDA?

.text:004430FE jz short loc_44311B .text:00443100 push 30h ; uType .text:00443102 push offset Athingy; "Hello" .text:00443107 push offset AnotherThingy;…
Rohan Pas
  • 177
  • 1
  • 14
-2
votes
1 answer

Reversing X86 in IDA, Xor Keys on Ptr to object

I am currently working with the 8051 in school and at home i am working with the x86. Right now i am reversing a game and trying to access a adress. The problem is the adress is xord. Normaly i can find the keys easily. But now i am a little bit…
Artur K.
  • 599
  • 1
  • 6
  • 11
-2
votes
2 answers

Is it possible to change a Byte Array (4) in a Compiled Application

Me and my friend have been creating a Advanced C++ TCPClient, He created the client, and i created the server. The client has a static IP inside the code and We lost the code for the client. I am currently wondering is it possible to decompile in…
Callum
  • 725
  • 6
  • 17
1 2 3
42
43