Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
3
votes
1 answer

IDA How to set variables type with name which have angle brackets in local types name?

IDA local types has a local type like: struct DEMOTYPE { _DWORD dw1; _DWORD dw2; } how to use "DEMOTYPE"(C++ type) just like normal c type? press Y can not Can't achieve the goal since the "<>" in it. i know if the target is function,we can…
omgkaka
  • 29
  • 6
3
votes
1 answer

Set environment variable befare launching debug process by IDA

I want to add environment variables before launching my python script by IDA to debug a library. I set up Process Options in Debugger menu and set Application to x86 python. But it seems there is no environment variable options. Is there any way to…
fx-kirin
  • 1,906
  • 1
  • 20
  • 33
3
votes
1 answer

How to simplify a function referencing itself as argument ? (and what does this mean)

I encounter often a function calling itself (in the pseudo code, produced by IDA) such as: result = (**(__int64 (__fastcall ***)(volatile signed __int32 *))lambda)(lambda); Since the disassembly is call qword ptr [rax], can't this be simplified…
Soleil
  • 6,404
  • 5
  • 41
  • 61
3
votes
0 answers

How can i setting Ghidra like ida pro?

I'm using Ghidra. I have something question. when i open binary IDA pro, The code was very good to analyze. This is IDA pro Decompile code printf("Tell me something about yourself: "); fgets(&s, 32, edata); std::string::operator=(&input, &s); …
3
votes
1 answer

Calling function from dll with pointer not working

I made a test program and made a function that just prints some text, and I am trying to call it from a DLL by reversing it using IDA/Ghidra and getting a pointer to it. What it looks like in Ghidra I thought IDA was giving the wrong address so I…
imnotdax
  • 67
  • 5
3
votes
0 answers

Is there a way to display hexadecimal representation instead of decimal in IDA pseudocode view?

Is there a way to display hexadecimal representation instead of decimal in IDA pseudocode view? It's more practical for me to use hexadecimal since my structs are all mapped in hex. Thanks!
J. Doe
  • 31
  • 1
3
votes
2 answers

IDA: Why does this function/sub has 4 arguments, and why is one a struct?

I'm really (reaaaally) new to IDA (and debugging in general), so I wanted to ask a little for some directions. I have this sub / function: sub_5AE50B proc near ; CODE XREF: sub_4F0E29+252p .text:005AE50B …
3
votes
1 answer

IDA change to graph view

Hey Im a very beginner in reverse engineering and i was watching some tutorials on Youtube. I've downloaded ida and noticed that i dont have the same view as the guys on youtube. With the view they have they have a good overview how the functions…
user10011764
3
votes
0 answers

IDA - Get Jni disassembled functions name

Is there a way to import jni functions name to IDA IDA just referencing functions offest with a proper name I've already tried some python scripts, non of them worked with IDA 7.0 i think they are incompatible with this version of…
3
votes
1 answer

Decompile ELF on Windows

I want to decompile file ELF 64-bit LSB executable with IDA on Windows, Its possible? If no, How can I do it on linux? Thanks
Evyatar
  • 1,107
  • 2
  • 13
  • 36
3
votes
2 answers

Disassmbling with IDA python for extract instruction

I am using IDA Python for extract the instructions of a binary. But unfortunately it does not print some instructions completely. For example, BCC, BCS, BEQ are printed as B. Is there any way to correct this problem? Here is my code!!! for…
3
votes
1 answer

Windbg conditional breakpoints ignore condition itself

I'm debugging an app without sources, i use IDA PRO + Windbg as the debugger. I'm trting to catch calls to CloseHandle with the specific handle value, for example handle=0x14 I put a conditional breakpoint like so: bp kernel32!CloseHandle "j…
3
votes
0 answers

How to prevent IDA Pro from loading DWARF debug info in batch mode?

I'm trying to evaluate a Mach-O object file by running idal -b from within another program and working with the .idb produced. But I'm having troubles with this. By running idaq a few times and toggling some options, I've found that the…
Miles C
  • 51
  • 5
3
votes
4 answers

What's going on here: v5 = *(_Byte *)(this + 4)?

I am looking at a code dump from IDA pro. There is a function which as this layout: garbled_name(int this... unsigned int v5 ; v5 = *(_Byte *)(this + 4); ... What I am really curious about is what exactly the '+ 4' is doing? Is this an…
flavour404
  • 6,184
  • 30
  • 105
  • 136
3
votes
3 answers

How in IDA can save memory dump with command or script?

IDA, Hex-View I select with mouse zone of bytes from StartAddress to EndAddress Right Click -> Save to File Got memory dump. How do the same with command?Like: SaveDump(StartAddress , EndAddress) SaveDump(0x00001000 , 0x00002000)
Dino Balloons
  • 79
  • 1
  • 1
  • 6