일 | 월 | 화 | 수 | 목 | 금 | 토 |
---|---|---|---|---|---|---|
1 | 2 | 3 | 4 | 5 | 6 | 7 |
8 | 9 | 10 | 11 | 12 | 13 | 14 |
15 | 16 | 17 | 18 | 19 | 20 | 21 |
22 | 23 | 24 | 25 | 26 | 27 | 28 |
29 | 30 | 31 |
- open office xml
- h5py.File
- debugging
- svn update
- hex-rays
- data distribution
- javascript
- error
- Rat
- x64
- MySQL
- idapython
- idapro
- TensorFlow
- NumPy Unicode Error
- error fix
- Ransomware
- pytest
- ecma
- idb2pat
- Python
- ida pro
- commandline
- Analysis
- Injection
- ida
- malware
- mock.patch
- why error
- 포인터 매핑
- Today
- Total
13 Security Lab
[Error] IDA Pro "Please refer to the manual to find appropriate actions" 본문
[Error] IDA Pro "Please refer to the manual to find appropriate actions"
Maj0r Tom 2019. 5. 12. 15:57
IDA Pro toast error message like "Please refer to the manual to find appropriate actions" that can be confuced meaning of error.
Problem?
I got this error when i modified some IDA pro stack value
It shows followed by error message "positive SP value has been found". But not this time
In conclusion, I fixed this problem by modifying call parameter type.
before the function call, it pushed twice. but in call function has 6 parameters -> (I fix 6 -> 2 parameter) then it works.
How to fix? :
1) we cusor point to start of function
2) right click and click "Set Type"
3) fix it like this
from: int __cdecl sub_10001234 (int, wchar_t, int, int, int, int)
to: int __cdecl sub_10001234 (int, wchar_t)
ida pro recognized it function has 6 param, but it's bug I think
+
hex-rays reffered
Set operand type
specified type on the cursor.
It must be entered as a C declaration. the tool itself does not use the operand type information.
However, it can be used by the Hex-Rays decompiler plugin. Setting operand type is most useful in case of indirect calls: the decompiler will use the type information to determine the input parameters to the call instead of guessing, which can make the decompiled code better.
declaration example : int (*func)(int param1, char param2);
Set function/item type
cursor on a name and edit it. or function type, (if there is a function) item type edit them.
example of a function declaration:
int main(int argc, const char *argv[]);
To delete a type declaration, please enter an empty string.
IDA supports the user-efined calling convention. In this calling convention, the user can explicitly specify the locations of arguments and the return value. For example:
int __usercall func@<ebx>(int x, int y@<esi>);