The Easter holidays have passed, and you might think we have forgotten to create a challenge. Good news! There will be a game, and it will last for 5 days. Ready? Here is the deal… The #IDATrivia game! Starting today, we will post a pair of questions each day until Friday, 21 […]
Read MoreWhen exporting disassembly, sometimes you need to modify it so that it is accepted by a specific assembler you’re using. One little-known fact is that some of IDA’s processor modules support different assembler syntaxes, so it may be useful to try a different one to see if it matches your needs better. The assembler can […]
Read MoreAlthough most of the time you can probably do all of the reversing inside IDA, occasionally you may need to continue it using other tools. While sometimes it may be enough to analyze the input file with another tool, or use the Export Data feature, the disassembly listing is more convenient in many cases. […]
Read MoreIf you ever looked at IDA ARM module’s processor-specific settings, you may have been puzzled by the option “Disable BL jumps detection”. What is it and when to use it? Background The ARM instruction set initially used fixed-width 32-bit instructions. The relative branch instruction, B, allocated 24 bits for the offset, giving it a range of ±32MB. Some […]
Read MoreSometimes you may see mysterious align keywords in the disassembly, which can appear both in code and data areas: Usually they’re only apparent in the text view. These directives are used by many assemblers to indicate alignment to a specific address boundary, usually a power of two. IDA uses it to replace potentially irrelevant bytes by a […]
Read MoreThis is a guest entry written by Chris Eagle. His views and opinions are his own and not those of Hex-Rays. Any technical or maintenance issues regarding the code herein should be directed to the author. The SK3wldbg Plugin When I first started analyzing obfuscated code, I quite often wished that I could simply de-obfuscate the code […]
Read MoreWhen analyzing firmware or other binaries without metadata, IDA is not always able to discover and analyze all functions which means the cross-references can be missing. Let’s say you found a string in the binary (e.g. in the String list) which has no cross references, but you’re reasonably sure it’s actually used. How to […]
Read MoreWe’ve covered choosers previously and talked about searching, sorting and filtering. The default filter (Ctrl–F shortcut) is pretty simple: it performs case-insensitive match on any column of the list. Advanced filters Advanced filter dialog is accessible via the context menu entry “Modify filters…” or the shortcut Ctrl–Shift–F In the dialog you can: match any or a specific […]
Read MoreDebug information, whether present in the binary or loaded separately, can contain not only symbols such as function or variable names, but also mapping of binary’s instructions to the original source files. It can be used by IDA’s debugger for source-level debugging, but what if you want to see this mapping during static […]
Read MoreUsing the string list is one way to look for text in the binary but it has its downsides: building the list takes time for big binaries, some strings may be missing initially so you may need several tries to get the options right, and then you need to actually find what you need […]
Read More