654 questions
- Bountied 0
- Unanswered
- Frequent
- Score
- Trending
- Week
- Month
- Unanswered (my tags)
0
votes
0
answers
65
views
IDA cannot apply patch to input file
I am using IDA Pro 7.7.
In the menu bar, Edit → Patch Program, the Apply patches to input file... option is missing.
Normally, there should be:
Change byte...
Change word...
Assemble...
Patched ...
0
votes
0
answers
61
views
ida pro produced asm.file
I'm using IDA PRO for disassembling certain retro games and I have encountered a problem I can't fix anyhow.
I can export the .asm file with the disassembled code but it seems like I can't export the ...
0
votes
0
answers
47
views
How to make IDA show negative offset in an address?
When disassembling a program, IDA has detected the instruction lea eax, [myvar_a+ebx+3] with this data:
myvar_a db 0, 11, 22, 33, 44
myvar_b db 55, 66, 77
Actually, the instruction should be lea eax, ...
pts's user avatar
- 88.7k
0
votes
0
answers
18
views
How to make IDA 8.4 display NULL pointers in structs as valid (non-error)?
In IDA 8.4, when I define a struct in C syntax: struct mystruct { void *myptr; }, then I create a struct var with mystruct, and the value is 0, then IDA displays the pointer with red background, ...
pts's user avatar
- 88.7k
0
votes
1
answer
294
views
IDA Pro 9.1 displaying wrong values of local variables in locals window
Could you please advise on how to resolve the issue with variable display in the Locals window during debugging?
When execution is halted at a breakpoint at the beginning of a function, the variables ...
2
votes
1
answer
108
views
why is there a "RETF 4" at the end of the disassembled function?
im disassembling the old 1989 Borland tool TDSTRIP.EXE that can extract Turbo Debugger information from executables and stumpled over this path-normalizing function
this is the signature im using ...
0
votes
0
answers
77
views
IDA Pro: Assembly Patching - Stack Manipulation for Non-Local Access
In IDA Pro, I'm trying to patch assembly to manipulate the stack/display array and allow a function to access non-local variables from an outer scope.
My core question: How to calculate the correct ...
2
votes
1
answer
331
views
Find function name in Frida
I open binary file with Ida and see function name called send_packet.
I tried to hook this function with frida
Module.findExportByName(null, "send_packet")
Or
Module.findExportByName("...
2
votes
0
answers
255
views
How to force ida use only one pseudocode tab
When I'm debugging an executable in ida, every time when I press F7 to go inside the function, ida opens new pseudo code tab.
After 20-30 minutes, there are around 30 pseudo code tabs open, and this ...
1
vote
1
answer
82
views
Using WinRT Interface in Python
ref: ISystemMediaTransportControlsInterop
I compiled a dll about ISystemMediaTransportControlsInterop::GetForWindow.
I use IDA to decompile it.
Then I wrote the C-like code as Python.
I believe that I ...
0
votes
0
answers
87
views
Disassembling multiple files in IDA Pro using Python
I am quite new in IDA Pro. I am trying to disassemble multiple .exe files and save the assembly codes as .asm files. I tried to write a Python script for that. But I don't know how to load an .exe ...
0
votes
0
answers
308
views
Debug android game lib with IDA PRO 9.0
I'm attempting to debug an armeabi-v7a native library on a Genymotion emulator (Android 11 x86-based).
I pushed android_x86_server (from IDA Pro's dbgsrv) to the emulator, granted execute permissions, ...
0
votes
1
answer
533
views
How to Debug a Process Launched by Another Application with IDA
I'm learning reverse engineering with IDA Pro and debugging a launcher application (start.exe) that launches another executable (main.exe).
start.exe takes two inputs (call them X and Y), processes ...
0
votes
0
answers
206
views
How to prevent IDA 8.4 from switching arm disassembly from thumb to arm modes on every instruction step
I am trying to debug a cortex-m0+ code using IDA, but on each step of code the debugger switches the disassembly from thumb mode to arm mode on its own.
I can't find any relevent option in IDA that ...
1
vote
0
answers
214
views
Ghidra and IDA addresses not aligned
I'm loading the same binary to both ghidra and IDA. When looking at main(), here's what both of them show:
ghidra
undefined main()
undefined AL:1 ...