TransWikia.com

Analyzing raw binary without ELF header in IDA Pro

Reverse Engineering Asked by Nicolai Prebensen on July 18, 2021

I am trying to analyze and disassemble a raw binary that does not have an ELF header using IDA Pro.

I have been trying to convert to code using MakeCode, but have not gotten anywhere as the binary is quite large.

I know it is supposed to be a 32 bit LSB binary, and Ghidra decompiles the same raw binary without any problems. However, I do prefer the IDA decompiler to Ghidra which is why I am trying to make it work in IDA as well.

The main problem is that the list of functions is missing (due to missing headers of course), but this does not seem to be a problem for Ghidra.

Is it possible to get the same result in IDA as I get in Ghidra? If so, how? What is the correct way to analyze raw binaries in IDA Pro / Hex-Rays?

One Answer

Yes, it's possible.

In order to do that you should choose on the landing page the correct architecture: enter image description here

The file will open without any functions, in it's raw form.

Then go to the beginning of the file, press the left mouse button, hold shift key, and scroll to the bottom of the file.

When all the disassembly is selected press c button and choose analyze/force on the pop-up. That should do the trick.

Correct answer by macro_controller on July 18, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP