4

I am following the Begin RE tutorial here but I am stuck towards the end, where I load a file into IDA. I am using IDA Free 8.2 on Windows 11 x64.

On the graph view it is only showing the main function, which is different to the screenshot in the tutorial. Also, I get the below errors about signature files:

Could not find signature file 'vc32_14'

Could not find signature file 'vc32ucrt'

Unless I am mistaken, I think it is because I need to use an older version of IDA which includes those signature files, or I need to find the signature files and put them into C:\Program Files\IDA Freeware 8.2\sig\pc where they are currently missing.

A) Where can I download IDA Free version 7.2 because the Hex-Rays website is only showing the newer version 8.2

B) Additionally, is there a place where I could download missing signature files

Edit:

First signature error

Second signature error

Loaded

securityauditor
  • 195
  • 6
  • 1
    Please show us a screen shot of your IDA, then we will understand what is different. The default file layout of IDA looks different, you can try to enter the "block flow mode" (or what ever it is called) by pressing space. The error message may simply indicator that IDA Free does not contain FLIRT signature files. – Robert Mar 31 '23 at 16:58
  • @Robert Please see the update. My first priority is to resolve the signature errors, it appears older versions of IDA include those missing signatures but I cannot find a download anywhere. Next, is why it took me to a single block, whereas the tutorial shows several blocks joined together. – securityauditor Apr 04 '23 at 14:25
  • 1
    Even paying customers don't have access to older IDA versions. HexRays always only provides the latest version of their software products. If you want older versions you have to download them when they are available and keep them. So the only way to get an older version of IDA Free is to check non-official servers and search for older versions. – Robert Apr 04 '23 at 14:29
  • The screen shot of the tutorial is low res so it is not visible which function (or better which address) it displays.Event the text does not mention the address of the shown function. You simply have selected a different function that does not make use of conditional branch ops (if ... in C code) . Select different functions of the executable and try to find the one that has a similar graphical layout. – Robert Apr 04 '23 at 14:34
  • @Robert It might be low resolution, but it clearly has numerous blocks, unlike my screenshot which just has one block. I assumed once I loaded the executable it would have taken me to the same place as the person who wrote the tutorial? Please do not forget about the signature files I need. – securityauditor Apr 04 '23 at 14:36
  • 2
    Seems like the tutorial is simply not that exact, it also mentions that you should see see something like this. You simply have to select the correct function. Most likely the function you search is at address 0x00401159. Press g and then enter 401159 to go to this function. – Robert Apr 04 '23 at 14:50
  • Those specific signature files are likely not included in IDA free and are only available on licensed versions. You can probably use a search engine to find any specific files you need, however (despite being handy when looking at real-world binaries) the signatures are not really too important if you're just learning. – Ali Rizvi-Santiago Jun 29 '23 at 15:48
  • @AliRizvi-Santiago Older versions of IDA do contain those signature files, I was hoping to avoid torrenting... – securityauditor Jul 09 '23 at 01:37
  • I am facing the same problem did you find an answer to it if you can I would appreciate if you would tell me how to solve it – BStacks Dec 16 '23 at 09:41
  • The signature files were nothing to do with it. Instead, the author of the tutorial made a mistake, you had to look elsewhere (click another box). – securityauditor Dec 16 '23 at 20:54
  • @BStacks Sorry, I forgot to write your name in my comment above (where I answer your question). – securityauditor Dec 27 '23 at 08:40

0 Answers0