Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
3
votes
1 answer

IDA kernel debugging Error

Environment: Windows 7 64-bit version Virtual machine (Vmware 8) + Virtualkd: Windows XP 32-bit version Trying to debug the kernl with ida 6.1, I get this error: Windbg: using debugging tools from 'C:\Program Files (x86)\Debugging Tools for…
user3122
  • 31
  • 2
3
votes
3 answers

How can I get IDA Pro to "see" xrefs to a string?

Currently, I'm disassembling a Mach-O executable in IDA Pro. I've gone through and found the string I'm interested in, but when I try to find xrefs to it, none can be found. I'm sure that the strings are referenced in the original code, but IDA Pro…
Mike
  • 23,892
  • 18
  • 70
  • 90
3
votes
2 answers

What does IDA use for graphing?

We need to create a CFG for some custom intermediate language code. We are currently using Qt + graphviz - and the CFGs look like ass. Specifically, we cant seem to figure out how we can get the "flow" (from top to bottom) into the graph, and…
bernd feinman
  • 324
  • 2
  • 11
3
votes
1 answer

How to remove symbols from .so file during build

I am using VS-android framework to compile Android shared object directly from Microsoft Visual Studio 2012 + Android NDK. I disassembled my own .so file using IDA and was horrified to see that all my code is completely visible (names of the…
DanielHsH
  • 4,287
  • 3
  • 30
  • 36
3
votes
1 answer

IDA Pro script for strings

I want to know if there is a possible way to list strings into a file from an executable with an idc script? I could not find any good functions for this, yet. Or is there any other way to do this with IDA Pro?
Zoltán Várnagy
  • 137
  • 2
  • 11
3
votes
1 answer

Tell IDA Pro that a memory area contains a pointer table

I have a binary image for an embedded CPU where a memory area contains a number of pointers to entry points into the binary. This is an interrupt vector table in the binary used by the CPU. How can I hint to IDA what this memory is, so it can use…
nitro2k01
  • 7,627
  • 4
  • 25
  • 30
3
votes
1 answer

export symbols from IDA pro for use in GDB

I have a dylib file a2.dylib I disassembled in IDA pro which is stripped of symbols. I have used a1.dylib which has symbols albeit older version of a2.dylib with Bindiff to diff out function names to match a2.dylib. I need these derived function…
gigasai
  • 564
  • 4
  • 23
3
votes
1 answer

.NET Disassembling, edit and patch

I need to edit a .NET executable. I'm new to HEX editing. I have imported it to IDA 6.1 Pro and edited it in IDA-View Window. Original: ldstr "Uri : " I changed to (Right click>Manual...(Manual Operand)): ldstr "Uri : localhost" I have…
John
  • 41
  • 3
3
votes
2 answers

Identify and intercept function call

I'm developing a launcher for a game. Want to intercept game's call for a function that prints text. I don't know whether the code that contains this function is dynamically linked or statically. So I dont even know the function name. I did…
Didar_Uranov
  • 1,230
  • 11
  • 26
3
votes
1 answer

IDAPro Loading C++ header files into IDAPro For structures

Anyone know how to do this? Using File>Load C header file fails over too much wrong code.
atigertest
  • 81
  • 2
  • 5
3
votes
1 answer

threading with idapython

I am writing a plugin for IDA by idapython. When I try to use threading, the IDA program fails. For example, when I try to run the code: import thread def run(): print "start thread" print "start" thread.start_new_thread(run, ()) print…
3
votes
2 answers

What's debug section in IDA Pro?

I try to analyze a dll file with my poor assembly skills, so forgive me if I couldn't achieve something very trivial. My problem is that, while debugging the application, I find the code I'm looking for only in debug session, after I stop the…
Davita
  • 8,928
  • 14
  • 67
  • 119
2
votes
2 answers

Will arguments to a function be passed on the stack or in a register?

I'm currently analyzing a program I wrote in assembly and was thinking about moving some code around in the assembly. I have a procedure which takes one argument, but I'm not sure if it is passed on the stack or a register. When I open my program in…
samoz
  • 56,849
  • 55
  • 141
  • 195
2
votes
2 answers

Changes to the program. IDA disassembler

There is such part of a code. /* bla bla bla */ .text:0040C777 align 4 .text:0040C778 .text:0040C778 loc_40C778: ; CODE XREF: sub_40C424+289j .text:0040C778 mov dword ptr [esp+4],…
Feor
  • 259
  • 3
  • 15
2
votes
2 answers

Reverse Engineer Simple Application with IDA Pro 5

This application is the first application challenge on the site hackthissite.org. The idea is to find the serial. When you enter the serial number and press ok, it pops up a message box with a password for the challenge if correct, or a message…