State-of-the-art binary code analysis tools
During the work with binaries, IDA sometimes shows warnings to inform the user about unusual or potentially dangerous behavior or asks questions: Hiding messages For some of such messages there is a checkbox “Don’t Display this message again”. If you enable it before answering or confirming the message (hint: you can press ‘D’ to
Quick rename can be useful when you have code which copies data around so the variable names stay the same or similar. However, sometimes there is a way to get rid of duplicate variables altogether. Reasons for duplicate variables Even if in the source code a specific variable may appear only once, on the machine code […]
One of the features added in IDA 7.6 was automatic renaming of variables in the decompiler. Unlike PIT, it is not limited to stack variables but also handles variables stored in registers and not just calls but also assignments and some other expressions. It also tries to interpret function names which include a verb […]
In C, union is a type similar to a struct but in which all members (possibly of different types) occupy the same memory, overlapping each other. They are used, for example, when there is a need to interpret the same data in different ways, or to save memory when storing data of different types […]
Many features of IDA and other disassemblers are taken for granted nowadays but it’s not always been the case. As one example, let’s consider automatic variable naming. A little bit of history In the first versions, IDA did not differ much from a dumb disassembler with comments and renaming and showed pretty much raw instructions with […]
The first 2022 IDA training session will take place online from 16-20 and 23-25 May 2022 , from 9am Pacific Standard Time. The session is devised to help professional reverse engineers master IDA Pro, the de-facto industry standard reverse engineering tool and take their reversing skills to the next level. Provided by the experts behind […]
Output window is part of IDA’s default desktop layout and shows various messages from IDA and possibly third-party components (plugins, processor modules, scripts…). It also contains the Command-line interface (CLI) input box. Opening the Output window Although it is present by default, it is possible to close this window, or use a desktop layout without it. […]
Hex-Rays announces the release of IDA Service Pack 1 (SP1) for IDA 7.7. This Service Pack is primarily a bugfix release for a few errors that might affect some users. How to request the new versions As usual, the new versions are free for users with an active support plan. Please use the “Help > Check for free […]
We’ve covered basics of working with string constants (aka string literals) before but IDA support additional features which may be useful in some situations. Exotic string types Pascal and derived languages (such as Delphi) sometimes employ string literals which start with the length followed by the characters. Similarly to the wide (Unicode) strings, they can be […]
Although the Hex-Rays decompiler was originally written to deal with compiler-generated code, it can still do a decent job with manually written assembly. However, such code may use non-standard instructions or use them in non-standard ways, in which case the decompiler may fail to produce equivalent C code and has to fall back to _asm […]