Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
3
votes
1 answer

IDA + IDA Python on wine/Linux

I want to use the windows version of IDA on linux using wine. However, Ubuntu run IDA pro results can not load idapython, the lower left corner has been shown IDC.IDA pro shows as follows: LoadLibrary(Z:\opt\ida68\plugins\python.plw) error: Module…
RAULFAN
  • 31
  • 1
  • 4
3
votes
0 answers

How to debug a child process from fork() using android_server from IDA?

I'm debugging a .so in an Android app using android_server from IDA. The parent process creates a child process with fork(), and those 2 processes communicate with each other by pipe(), shown in the following figure: The fork and pip function The…
Hu.Yimi
  • 31
  • 4
3
votes
1 answer

IDA Pro jumping to offset from base

I use CheatEngine as a debugger (and get a lot of crap for it). When I find addresses, I always write them down based on the offset from where the start of the instructions are (e.g. program.exe+402C0). It would be nice to be able to use the goto…
w0f
  • 908
  • 9
  • 23
3
votes
1 answer

In 'IDA PRO', let 'IDAPython' import default module at startup

We know 'IDAPython' loads several modules by default at startup, such as idaapi, idautils.... I wrote a module to let python print all numbers as hex format in the command window, which I wish can be imported each time when python loads those…
Roney
  • 143
  • 7
3
votes
0 answers

How to get more information about Microsoft C++ exception

I am running a very old app written in VB6 and working with crystal reports. The apps worked great but since last windows 10 update, the crystal reports returns me an error. I debugged the app with IDA and i see this exception: 751804C2: Microsoft…
Bob5421
  • 7,757
  • 14
  • 81
  • 175
3
votes
1 answer

Reverse engineering a VB6/Winsock/ADO application

I used several Disassemblers/Debuggers/Decompilers to reverse a VB6 application which connects to a remote database using msado26.tlb and mswinsck.ocx I understood that the connection should be done using a COM calls through msvbm60.dll. It has been…
MedUnes
  • 39
  • 2
3
votes
1 answer

Arguments passed to a function in IDA Pro

When I analyzed a binary with IDA, I saw the following function: Function::Function(void *, unsigned int, void *, unsigned int) So, as you can see, IDA displays that we have 4 arguments. But below that, in the summary view, IDA shows that we have 5…
user3097712
  • 1,565
  • 6
  • 27
  • 49
3
votes
5 answers

Confusing function

So, while using IDA to disassemble a dll, I came across this class function: mov eax, [ecx+4] mov eax, [eax] retn I know ecx means this and eax is the return value, but I fail to understand what it returns. Any help?
小太郎
  • 5,510
  • 6
  • 37
  • 48
3
votes
1 answer

M68k - IDA Pro 24-bit addressing?

I'm trying to disassemble a BIOS image for the 68000, and I'm having trouble getting IDA Pro 6.5 to correctly cross-reference addresses. For those who aren't aware, the Motorola 68000 has a couple of interesting features/quirks related to…
DarkMorford
  • 505
  • 1
  • 4
  • 12
3
votes
2 answers

IDA "call offset"

I've dumped a dll from memory using LordPE, so far so good, but there are some functions IDA shows just like this: call off_11CAE08 At memory address 11CAE08(.data section) we have 01058530(.text section) so I'd like IDA was able to show call…
dragon
  • 31
  • 3
3
votes
1 answer

ida pro decompiling incorrect result

recently i tried to decompile in ida pro 6.1 the ida out puts incorrect result , for all i decompile the functions i only receive this code : int result; // eax@1 return result; for all functions i decompile instead of the correct decompile out put…
Ehsan
  • 43
  • 1
  • 5
3
votes
1 answer

IDA(4.9) Is it possible to change definitions of imported functions?

Is it possible to change argument types/names of arguments of imported functions like StretchBlt in IDA 4.9? It's painful and error-prone to manually change from ... .text:0040A49E push eax ; HDC .text:0040A49F …
Name
  • 31
  • 1
3
votes
2 answers

How to simplify Assembly Translation Shift Right by 32 Xor Absolute Number And Value

I don't know the original code but I don't believe it's this complicated with right shift's and abs. Here is how the decompiled IDA PRO code renamed looks like char Ship; //Could be 0-7 (8 is reversed for special purpose) char NewShip = 1; //Could…
user3435580
  • 566
  • 1
  • 4
  • 15
3
votes
1 answer

IDA PRO Translating C++ code into C Code __OFSUB__ macro

I'm asking for a equivalent to this C++ macro in C (doesn't have to be a macro could be a function) Here is how the code is used in a C++ pseudo code which actually probably compiles with the macro, but the macro doesn't work in C. Can't use…
user3435580
  • 566
  • 1
  • 4
  • 15
3
votes
1 answer

fastcall on arm (Android NDK)

IDA (the interactive disassembler by hex-rays.com) reports native C++ functions (Android NDK, arm) as __fastcall, for example: // int __fastcall QVariant::toULongLong(_DWORD, _DWORD); weak By the way, this function is declared in the docs…
18446744073709551615
  • 16,368
  • 4
  • 94
  • 127