650 questions
Score of 0
0 answers
121 views
IDA cannot apply patch to input file
I am using IDA Pro 7.7.
In the menu bar, Edit → Patch Program, the Apply patches to input file... option is missing.
Normally, there should be:
Change byte...
Change word...
Assemble...
Patched ...
Score of 0
0 answers
82 views
ida pro produced asm.file
I'm using IDA PRO for disassembling certain retro games and I have encountered a problem I can't fix anyhow.
I can export the .asm file with the disassembled code but it seems like I can't export the ...
Score of 0
0 answers
58 views
How to make IDA show negative offset in an address?
When disassembling a program, IDA has detected the instruction lea eax, [myvar_a+ebx+3] with this data:
myvar_a db 0, 11, 22, 33, 44
myvar_b db 55, 66, 77
Actually, the instruction should be lea eax, ...
Score of 0
0 answers
23 views
How to make IDA 8.4 display NULL pointers in structs as valid (non-error)?
In IDA 8.4, when I define a struct in C syntax: struct mystruct { void *myptr; }, then I create a struct var with mystruct, and the value is 0, then IDA displays the pointer with red background, ...
Score of 0
1 answer
521 views
IDA Pro 9.1 displaying wrong values of local variables in locals window
Could you please advise on how to resolve the issue with variable display in the Locals window during debugging?
When execution is halted at a breakpoint at the beginning of a function, the variables ...
Score of 1
1 answer
122 views
why is there a "RETF 4" at the end of the disassembled function?
im disassembling the old 1989 Borland tool TDSTRIP.EXE that can extract Turbo Debugger information from executables and stumpled over this path-normalizing function
this is the signature im using ...
Score of 0
0 answers
88 views
IDA Pro: Assembly Patching - Stack Manipulation for Non-Local Access
In IDA Pro, I'm trying to patch assembly to manipulate the stack/display array and allow a function to access non-local variables from an outer scope.
My core question: How to calculate the correct ...
Score of 2
1 answer
449 views
Find function name in Frida
I open binary file with Ida and see function name called send_packet.
I tried to hook this function with frida
Module.findExportByName(null, "send_packet")
Or
Module.findExportByName("...
Score of 4
0 answers
388 views
How to force ida use only one pseudocode tab
When I'm debugging an executable in ida, every time when I press F7 to go inside the function, ida opens new pseudo code tab.
After 20-30 minutes, there are around 30 pseudo code tabs open, and this ...
Score of 1
1 answer
108 views
Using WinRT Interface in Python
ref: ISystemMediaTransportControlsInterop
I compiled a dll about ISystemMediaTransportControlsInterop::GetForWindow.
I use IDA to decompile it.
Then I wrote the C-like code as Python.
I believe that I ...
Score of 0
0 answers
123 views
Disassembling multiple files in IDA Pro using Python
I am quite new in IDA Pro. I am trying to disassemble multiple .exe files and save the assembly codes as .asm files. I tried to write a Python script for that. But I don't know how to load an .exe ...
Score of 0
1 answer
712 views
How to Debug a Process Launched by Another Application with IDA
I'm learning reverse engineering with IDA Pro and debugging a launcher application (start.exe) that launches another executable (main.exe).
start.exe takes two inputs (call them X and Y), processes ...
Score of 0
0 answers
224 views
How to prevent IDA 8.4 from switching arm disassembly from thumb to arm modes on every instruction step
I am trying to debug a cortex-m0+ code using IDA, but on each step of code the debugger switches the disassembly from thumb mode to arm mode on its own.
I can't find any relevent option in IDA that ...
Score of 1
0 answers
278 views
Ghidra and IDA addresses not aligned
I'm loading the same binary to both ghidra and IDA. When looking at main(), here's what both of them show:
ghidra
undefined main()
undefined AL:1 ...
Score of 0
1 answer
110 views
What does "0010 ^0.16 ___u8_ iv;" in Hex-Rays IDA Pro mean?
I want to get the parameter's value when function called, when I open the program with IDA and hover on the function name I got the message like this: 1: 0008 rsi libsm::sm4::cipher_mode::...