This is a guest entry written by Rolf Rolles from Mobius Strip Reverse Engineering. His views and opinions are his own, and not those of Hex-Rays. Any technical or maintenance issues regarding the code herein should […]
Read MoreSince a picture is worth thousand words below are a few drawings for your perusal. Let us start at the top level, with the mbl_array_t class, which represents the entire microcode object: The above picture does not show the control flow graph. For that we use predecessor and successor lists: Pay attention to the block types here, […]
Read MoreIntended audience IDAPython developers who enjoy the occasional headache, leaky abstraction enthousiasts, or simply the curious. TL;DR IDAPython wraps C++ types, and the lifecycle of C++ objects (and in particular members of larger objects) is not necessarily the same as that of the Python wrapper object that is wrapping it. The problem One of our users reported IDA crashes when […]
Read MoreIt is a nice feeling, when, after long debugging nights, your software finally runs and produces meaningful results. Another hallmark is when other users start to use it and obtain useful results. Usually this period is very busy: lots of new bugs are discovered and fixed, unforeseen corner cases are handled. Then another period starts: when users come back for […]
Read MoreA few days ago a customer sent us a sample file. The code he sent us was using a very simple technique to obfuscate string constants by building them on the fly and using ‘xor’ to hide the string contents from static disassembly: The decompiler recovered most of the xor’ed values but some of them […]
Read MoreThe problem Some users running IDA on Windows & Linux X11 platforms with Hi-DPI displays, have reported that IDA looks rather odd: the navigator bar is too narrow, the text under it gets truncated, and there is overall feeling of packing & clumsiness: Windows: Linux X11: Looking closely, one can notice the following issues (probably […]
Read MoreA handful of our users have already requested information regarding the Qt 5.6.3 build, that is shipped with IDA 7.1. Configure options Here are the options that were used to build the libraries on: Windows: …\5.6.3\configure.bat “-nomake” “tests” “-qtnamespace” “QT” “-confirm-license” “-accessibility” “-opensource” “-force-debug-info” “-platform” “win32-msvc2015” “-opengl” “desktop” “-prefix” “C:/Qt/5.6.3-x64” Note that you will have […]
Read MoreIntended audience IDAPython plugins, loaders or processor modules developers. The problem Until now, IDAPython would load all loaders, processor modules & plugins in the ‘__main__’ module. This causes namespace pollution, which can sometimes leads to very obscure errors. The solution Starting with version 7.1, IDA will import plugins, loaders & processor modules in their own, separate Python modules. The names of those […]
Read MoreWith IDA 7.0 switching fully to native x64 architecture, we also switched to the x64 Python which brought some new issues but also exposed some we’ve seen before. This post tries to summarize the most common issues we’ve seen our users encounter as well as suggestions about how to fix them or at […]
Read MoreA handful of our users have already requested information regarding the Qt 5.6.0 build, that is shipped with IDA 7.0. Configure options Here are the options that were used to build the libraries on: Windows: …\5.6.0\configure.bat “-nomake” “tests” “-qtnamespace” “QT” “-confirm-license” “-accessibility” “-opensource” “-force-debug-info” “-platform” “win32-msvc2015” “-opengl” “desktop” “-prefix” “C:/Qt/5.6.0-x64” Note that you will have to […]
Read More