일 | 월 | 화 | 수 | 목 | 금 | 토 |
---|---|---|---|---|---|---|
1 | 2 | |||||
3 | 4 | 5 | 6 | 7 | 8 | 9 |
10 | 11 | 12 | 13 | 14 | 15 | 16 |
17 | 18 | 19 | 20 | 21 | 22 | 23 |
24 | 25 | 26 | 27 | 28 | 29 | 30 |
- javascript
- MySQL
- NumPy Unicode Error
- Rat
- error fix
- hex-rays
- Analysis
- x64
- open office xml
- Python
- why error
- error
- idapro
- ecma
- TensorFlow
- idapython
- data distribution
- malware
- svn update
- h5py.File
- idb2pat
- commandline
- pytest
- mock.patch
- 포인터 매핑
- Injection
- Ransomware
- ida pro
- ida
- debugging
- Today
- Total
13 Security Lab
[Error] IDA Pro "Please refer to the manual to find appropriate actions" 본문
[Error] IDA Pro "Please refer to the manual to find appropriate actions"
Maj0r Tom 2019. 5. 12. 15:57
IDA Pro toast error message like "Please refer to the manual to find appropriate actions" that can be confuced meaning of error.
Problem?
I got this error when i modified some IDA pro stack value
It shows followed by error message "positive SP value has been found". But not this time
In conclusion, I fixed this problem by modifying call parameter type.
before the function call, it pushed twice. but in call function has 6 parameters -> (I fix 6 -> 2 parameter) then it works.
How to fix? :
1) we cusor point to start of function
2) right click and click "Set Type"
3) fix it like this
from: int __cdecl sub_10001234 (int, wchar_t, int, int, int, int)
to: int __cdecl sub_10001234 (int, wchar_t)
ida pro recognized it function has 6 param, but it's bug I think
+
hex-rays reffered
Set operand type
specified type on the cursor.
It must be entered as a C declaration. the tool itself does not use the operand type information.
However, it can be used by the Hex-Rays decompiler plugin. Setting operand type is most useful in case of indirect calls: the decompiler will use the type information to determine the input parameters to the call instead of guessing, which can make the decompiled code better.
declaration example : int (*func)(int param1, char param2);
Set function/item type
cursor on a name and edit it. or function type, (if there is a function) item type edit them.
example of a function declaration:
int main(int argc, const char *argv[]);
To delete a type declaration, please enter an empty string.
IDA supports the user-efined calling convention. In this calling convention, the user can explicitly specify the locations of arguments and the return value. For example:
int __usercall func@<ebx>(int x, int y@<esi>);