ida | 易学教程

Android未root环境下使用IDA调试

阅读更多关于 Android未root环境下使用IDA调试

引言众所周知，IDA在我们调试Android程序的时候是一个很棒的利器，在做调试前我们需要的就是一部root过的移动设备，当然这是很理想的情况，但是现实总是事与愿违的，对于我们大部分人来说可能会碰到各种各样的问题（技术大牛除外），比如说我是开发人员，我不会root、后者是手机不支持root，没有官方和第三方的root包、还有就是刷root的本身就是一件有风险的事情，如果点背的话刷成板砖了等等；即时最后root成功了，可能你在上面花费的时间远远大于你调试软件的时间。针对root手机的不方便性、我来介绍一种不需要root手机直接调试的方法。前期准备配置好JDK, SDK环境变量，并且在开发者模式下开启调试状态一台未root的手机（我用的是vivo X23） Android Studio IDA (我用的汉化的7.0版本） android:debuggable=“true” 直接上干货从图片看出我的设备是未root的，没有su权限；接下来我们使用run-as命令操作：到达这步我们就有权限操作被调试进程了，下面我们把IDA的远程调试服务拷贝到当前进程目录下，然后对我需要的服务进行提权操作，然后就可以正常运行服务了，具体如下图：从图中看到，已经成功连接IDA的服务了，可以从图中看见我导入了两个服务 android_server 和 android_server64

What does an equals sign = on the right side of a LDR instruction in ARM mean?

阅读更多关于 What does an equals sign = on the right side of a LDR instruction in ARM mean?

问题 Been googling this for a while but i can't find any documentation relating to this. I've been trying to learn ARM and have been looking at the compiled ARM assembly code for a simple calculator.c program i wrote in order to see if I could understand what was going on. The thing I keep seeing is instructions like these: LDR R3, =__stack_chk_guard__GLIBC_2.4 or LDR R0, =aEnterOperator ; "Enter operator: " or LDR R0, =aSIsNotAValidOp ; "%s is not a valid operator. Enter +, -" Note: the stuff

200kB file to search for 8! (40320 permutations) in Python or IDA

阅读更多关于 200kB file to search for 8! (40320 permutations) in Python or IDA

问题 I am working on disassembling a firmware (Siemens C165 processor - https://www.infineon.com/dgdl/Infineon-C165-DS-v02_00-en%5B8%5D.pdf?fileId=db3a304412b407950112b43a49a66fd7) in IDA. I have the firmware, so I can also read it via Python. I need to find a string being permutation of 0, 1, 2, 3, 4, 5, 6, 7 (0-7) Wrote this simple program: from itertools import permutations l = list(permutations(range(0,8))) print(len(l)) with open("firm.ori", 'rb') as f: s = f.read() for i in l: hexstr = '\\x'

How to find the memory address offsets from IDA in binary file

阅读更多关于 How to find the memory address offsets from IDA in binary file

问题 I am trying to write a command line application which can modify a .so file using hex values at specific addresses. I'm using IDA Demo and HxD Hex Editor to attain the addresses which need to be updated, however, each time I try to modify the file, no matter which language I use (bash scripting, php, python) every time I edit the file, it updates from the wrong address offsets which I have from IDA and HxD Hex Editor. I have seen a few posts regarding this, but as of yet, none have been able

Force IDA decompiler to use different function signature of static functions in namespaces

阅读更多关于 Force IDA decompiler to use different function signature of static functions in namespaces

问题 I'm testing IDA with some simple code to learn how to use it and I'm getting stuck because it doesn't decompile properly a static function in a namespace: function declared this way: namespace pvrtex { bool transcode(CPVRTexture& tex, const PixelType fmt, const EPVRTVariableType chType, const EPVRTColourSpace clrSpace, const ECompressorQuality q, const bool dither = false); } this function ends up wiht this signature: ?transcode@pvrtex@@YA_NAAVCPVRTexture@1@TPixelType@1@W4EPVRTVariableType@

Memory map in IDA Pro similar to OllyDbg

阅读更多关于 Memory map in IDA Pro similar to OllyDbg

问题 Does IDA Pro have a memory mapping functionality similar to that in OllyDbg? If so, I can't find it. I know there is that skinny bar at the top of the screen showing where you are in the address space and where memory is allocated, but I consider that kind of inadequate. This is what the memory map looks like in OllyDbg: 回答1: Program Segmentation in View > Open Subview > Segments but it doesn't have that detailed information as OllyDbg has. 来源： https://stackoverflow.com/questions/22513863

How does one change an instruction with a hex editor?

阅读更多关于 How does one change an instruction with a hex editor?

问题 I am messing around with some reverse engineering, but I don't know how to change a jnz to jz with a hex editor. I understand it will vary between systems but I'm not sure where to look to find this information. I'm working on Mac OS X 64 bit and I disassembled code with IDA Pro. 回答1: If you've found a jz , it will either look like 74 XX or 0F 84 XX XX XX XX . If it's a 74 , change it to 75 . If it's the one with 84 , change it to 85 . This information can be found, among other places, in

IDA常用快捷键说明

阅读更多关于 IDA常用快捷键说明

IDA Pro:交互式反汇编器，是典型的递归下降反汇编器。导航条: 蓝色表示常规的指令函数黑色节与节之间的间隙银白色数据内容粉色表示外部导入符号暗黄色表示ida未识别的内容 IDA主界面: IDA View三种反汇编视图:文本视图、图表视图、路径视图 Hex View 十六进制窗口 Imports 导入函数窗口 Struceures 结构体窗口 Exports 导出函数窗口 Enums 枚举窗口 Strings 字符串窗口常用功能及快捷键: 空格键:切换文本视图与图表视图 ESC:返回上一个操作地址 G:搜索地址和符号 N:对符号进行重命名冒号键:常规注释分号键:可重复注释 Alt+M:添加标签 Ctrl+M:查看标签 Ctrl+S:查看段的信息代码数据切换 C-->代码/D-->数据/A-->ascii字符串/U-->解析成未定义的内容 X:查看交叉应用 F5:查看伪代码 Alt+T:搜索文本 Alt+B:搜索十六进制导入jni.h分析jni库函数。伪C代码窗口: 右键 comment-注释伪c代码。 copy to -assembly-把伪c代码复制到反汇编窗口的汇编代码。来源： CSDN 作者： piracy123 链接： https://blog.csdn.net/a916879788/article/details/103460742

How to locate where an error arises in a “PackageManager.AddPackageAsync” method call?

阅读更多关于 How to locate where an error arises in a “PackageManager.AddPackageAsync” method call?

I'm debugging an example app that deploys an Windows Metro App Package (".Appx" file). It call a WinRT method " PackageManager.AddPackageAsync " which fails with detailed error code text (retrieved from the call return value after the operation was finished): error 0x80070002: Windows cannot register the package because of an internal error or low memory. My target is to find where exactly this error arises in the WinRT call. I think the best way for achieving this is by finding where the error code is set. I've done this before with the old simple Win32 API but now with this new complex com

RE - IDA finding function offset

阅读更多关于 RE - IDA finding function offset

问题 I am just starting out with Reverse Engineering. I've created a small C++ ConsoleApplication and I am trying to call the NewFunction via an injected DLL. void NewFunction() { DWORD dwImageBase = (DWORD)GetModuleHandle(NULL); std::cout << "ImageBase: " << ToHex(dwImageBase) << std::endl; std::cout << "NewFunction: " << ToHex((DWORD)&NewFunction) << std::endl; std::cout << "Offset: " << ToHex((DWORD)&NewFunction - dwImageBase) << std::endl; } Example Output: ImageBase: F90000 NewFunction:

订阅 ida