Questions tagged [ida]

The Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code.

IDA Logo

Interactive Disassembler, more commonly known as simply IDA, is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plugin for programs compiled with a C/C++ compiler is available at extra cost. The latest full version of IDA Pro is commercial software; there is a freeware version available with a subset of the functionality of paid versions.

IDA performs much automatic code analysis, using cross-references between code sections, knowledge of parameters of API calls, and other information. However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until it becomes clear what it does.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2007 Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008 Hex-Rays assumed the development and support of Datarescue's IDA Pro.

See also the [ida] tag on Reverse Engineering Stack Exchange.

634 questions
94
votes
10 answers

How can I find the data structure that represents mine layout of Minesweeper in memory?

I'm trying to learn about reverse engineering, using Minesweeper as a sample application. I've found this MSDN article on a simple WinDbg command that reveals all the mines but it is old, is not explained in any detail and really isn't what I'm…
KingNestor
  • 65,976
  • 51
  • 121
  • 152
21
votes
2 answers

What does an equals sign = on the right side of a LDR instruction in ARM mean?

Been googling this for a while but i can't find any documentation relating to this. I've been trying to learn ARM and have been looking at the compiled ARM assembly code for a simple calculator.c program i wrote in order to see if I could…
Terry Martin
  • 529
  • 8
  • 20
17
votes
3 answers

IDA pro asm instructions change

I just want to know how I can change asm instructions in the IDA-view A: How to edit instructions(for instance: jnz to jmp)? How to insert new instructions(call func1, call func2 inserted to existing code)? I know how to make dif files, I know how…
asm
  • 171
  • 1
  • 1
  • 3
16
votes
1 answer

mov eax, large fs:30h

I was analyzing some x86 binary and found the following instruction which I can not understand. Can someone please explain me following instruction? mov eax, large fs:30h I googled this, and it turns out it is some anti-debugging stuff... but…
daehee
  • 5,047
  • 7
  • 44
  • 70
14
votes
1 answer

Is it possible to edit and recompile an iOS Binary?

I have an application and posted to Cydia recently. It has been cracked by someone else and posted it in torrent sites. I have a binary checksum verification mechanism inside and they were able to create a new checksum file based on the changes they…
IndoThaiGeek
  • 161
  • 1
  • 4
13
votes
2 answers

How to do hybrid user-mode/kernel-mode debugging?

Basically, I have a user mode program that calls kernel32.CreateProcessA() which internally calls kernel32.CreateProcessInternalW(). Within this function, I'm interested in what is happening inside ntdll.NtCreateSection() which attempts to map the…
byteptr
  • 1,275
  • 11
  • 15
13
votes
2 answers

Can not find the strings window of IDA Pro

I use IDA Pro Advanced Edition v6. But I can not find the strings window. Only the function window, IDA View-A, IDA Hex View-A, Structures window, Enums window, Imports and Exports window are presented. Can somebody tell how I can open the strings…
user3097712
  • 1,565
  • 6
  • 27
  • 49
12
votes
2 answers

Not able to disassemble iOS Banking app

I use hopper disassembler to disassemble iOS apps. It works fine for most of the apps. However today I just got curious to understand a banking app so I tried to disassemble it. So, I moved the app from my jailbroken device to my mac and when I…
Jaffer Sheriff
  • 1,444
  • 13
  • 33
12
votes
1 answer

Debug executable with arguments in IDA

In the disassembler and debugger IDA, is there any way to run the currently loaded binary with command line parameters? For instance, say I have the command /bin/ls and want to debug it as /bin/ls test.txt, how could I do that in IDA?
Numeri
  • 1,027
  • 4
  • 14
  • 32
11
votes
4 answers

C++ name mangling by hand

I am writing a script for the IDA Pro disassembler in Python using the idapython plugin. Using this, I am able to fill in the gaps where IDA's auto-analysis falls short. One area that has me stumped is naming locations/functions with (for want of a…
Aidan Steele
  • 10,999
  • 6
  • 38
  • 59
10
votes
1 answer

Allocating variables on the stack in x86 assembly. rbp and rsp vs esp and ebp

I have recently been learning assembly, and decided to disassemble some of my own executables to study from. I've noticed online resources often reference esp and ebp, the stack and base pointer. I wrote this program: int comp(int a, int b) { …
Carson
  • 107
  • 1
  • 5
10
votes
1 answer

IDA - positive sp value has been found error

We have a DLL which we have lost the source for so I am trying to figure out how it works via IDA Dissembler. However there seems to be function that I can't access because I get the following error: Decompilation failure: 46AFAF: positive sp value…
A Dark Divided Gem
  • 419
  • 1
  • 4
  • 18
9
votes
3 answers

WinDBG - how to set all exception to be passed into app?

How can I set all exceptions behavior to pass to application and not appear in debugger? I'm using IDA Pro 6.6 and WinDbg.
AnArrayOfFunctions
  • 3,452
  • 2
  • 29
  • 66
9
votes
2 answers

Parameters of guarded_open_np

I found that guarded_open_np function is used by libsqlite3.dylib to open database file. I had a look into sqlite3 open source, there was no such thing. So definitely Apple has modified it to use guarded_open_np instead of unix's open. I know that…
Krypton
  • 3,337
  • 5
  • 32
  • 52
9
votes
1 answer

Can't decrypt these strings

Preamble I'm trying to disassemble and reverse-engineer a program whose author is long gone. The program provides some unique features that I have yet to find elsewhere and... I'm curious and intrigued by reverse-engineering the program. If you're…
Toby Lawrence
  • 408
  • 2
  • 10
1
2 3
42 43