The autoanalysis engine is the heart of IDA’s disassembly functionality. In most cases it “just works” but in rare situations tweaking it may be necessary. Analysis options The generic analysis options are available in Options > General, Analysis tab, Kernel Options 1..3. The same settings are also available at the initial load time. You can even turn off the […]
Read MoreWe have covered basic usage of cross-references before, but there are situations where they may not behave as you may expect. Accessing large data items If there is a large structure or an array and the code reads or writes data deep inside it, you may not see cross-references from that code listed at the […]
Read MoreA friendly heads-up to IDA users: we just published a vulnerability fix for a potential double-free during DWARF parsing. Please grab it from www.hex-rays.com/vulnfix/ and replace the original files with those you will find in the archive.
Read MoreAlthough most of the time IDA is used to work on single, self-contained file (e.g. an executable, library, or a firmware image), this is not always the case. Sometimes the program may refer to or load additional files or data, and it may be useful to have that data in the database and analyze it […]
Read MoreAs we’ve mentioned before, the same numerical value can be used represented in different ways even if it’s the same bit pattern on the binary level. One of the representations used in IDA is offset. Offsets In IDA, an offset is a numerical value which is used as an address (either directly or as part of […]
Read MoreThe next 2022 IDA training course will take place online 12–16 and 19-21 September 2022, CEST time. standard training: (12-16 September) aims to teach standard knowledge about IDA by demonstrating its use to analyze binary programs on modern operating systems. advanced training: (19-21 September) intended for experienced IDA users who want to take advantage […]
Read MoreVariable-sized structures is a construct used to handle binary structures of variable size with the advantage of compile-time type checking. In source code Usually such structures use a layout similar to following: struct varsize_t { // some fixed fields at the start int id; size_t datalen; //[more fields] unsigned char data[];// variable part }; In other words, a fixed-layout part at […]
Read MoreThis is a guest entry written by Elias Bachaalany. His views and opinions are his own, and not those of Hex-Rays. Any technical or maintenance issues regarding the code herein should be directed to him. ida-qscripts or QScripts is a productivity plugin for better/faster scripting and coding workflow/experience for IDA. IDA provides two […]
Read MoreCOM aka Component Object Model is the technology used by Microsoft (and others) to create and use reusable software components in a manner independent from the specific language or vendor. It uses a stable and well-defined ABI which is mostly compatible with Microsoft C++ ABI, allowing easy implementation and usage of COM components in C++. COM […]
Read MoreThe address details pane is a rather recent addition to IDA so probably not many users are familiar with it yet. However, it can be a quite useful addition to the standard workflow, permitting you to perform some common tasks faster. Address details view On invoking View > Open subview > Address details (you can also use […]
Read More