Acknowledgments |
|
xix | |
Introduction |
|
xxi | |
|
PART I INTRODUCTION TO IDA |
|
|
|
1 Introduction To Disassembly |
|
|
3 | (12) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
Software Interoperability |
|
|
7 | (1) |
|
|
7 | (1) |
|
|
7 | (1) |
|
|
7 | (7) |
|
A Basic Disassembly Algorithm |
|
|
8 | (1) |
|
|
9 | (2) |
|
Recursive Descent Disassembly |
|
|
11 | (3) |
|
|
14 | (1) |
|
2 Reversing And Disassembly Tools |
|
|
15 | (16) |
|
|
16 | (4) |
|
|
16 | (2) |
|
|
18 | (1) |
|
|
19 | (1) |
|
|
20 | (7) |
|
|
20 | (2) |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
24 | (1) |
|
|
25 | (1) |
|
|
25 | (2) |
|
|
27 | (2) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
29 | (2) |
|
|
31 | (12) |
|
Hex-Ray's Stance on Piracy |
|
|
32 | (1) |
|
|
33 | (2) |
|
|
33 | (1) |
|
|
33 | (1) |
|
|
34 | (1) |
|
|
34 | (1) |
|
|
35 | (1) |
|
|
36 | (4) |
|
|
36 | (1) |
|
OS X and Linux Installation |
|
|
37 | (1) |
|
|
38 | (1) |
|
|
38 | (1) |
|
|
38 | (2) |
|
Thoughts on IDA'S User Interface |
|
|
40 | (1) |
|
|
40 | (3) |
|
|
|
4 Getting Started With Ida |
|
|
43 | (16) |
|
|
44 | (4) |
|
|
45 | (2) |
|
Using the Binary File Loader |
|
|
47 | (1) |
|
|
48 | (5) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
52 | (1) |
|
Introduction to the IDA Desktop |
|
|
53 | (3) |
|
Desktop Behavior During Initial Analysis |
|
|
56 | (1) |
|
IDA Desktop Tips and Tricks |
|
|
57 | (1) |
|
|
58 | (1) |
|
|
58 | (1) |
|
|
59 | (20) |
|
The Principal IDA Displays |
|
|
60 | (6) |
|
|
60 | (6) |
|
|
66 | (1) |
|
|
66 | (1) |
|
|
66 | (4) |
|
|
67 | (1) |
|
|
68 | (1) |
|
|
68 | (1) |
|
|
69 | (1) |
|
|
70 | (1) |
|
|
70 | (7) |
|
|
70 | (2) |
|
|
72 | (2) |
|
|
74 | (1) |
|
|
74 | (1) |
|
The Type Libraries Window |
|
|
75 | (1) |
|
The Function Calls Window |
|
|
76 | (1) |
|
|
76 | (1) |
|
|
77 | (2) |
|
|
79 | (22) |
|
|
80 | (3) |
|
|
80 | (2) |
|
|
82 | (1) |
|
|
82 | (1) |
|
|
83 | (15) |
|
|
85 | (4) |
|
|
89 | (1) |
|
|
89 | (4) |
|
|
93 | (5) |
|
|
98 | (2) |
|
|
99 | (1) |
|
|
99 | (1) |
|
|
100 | (1) |
|
7 Disassembly Manipulation |
|
|
101 | (26) |
|
|
102 | (4) |
|
Parameters and Local Variables |
|
|
102 | (1) |
|
|
103 | (2) |
|
|
105 | (1) |
|
|
106 | (2) |
|
|
107 | (1) |
|
|
107 | (1) |
|
Anterior and Posterior Lines |
|
|
108 | (1) |
|
|
108 | (1) |
|
Basic Code Transformations |
|
|
108 | (12) |
|
|
109 | (3) |
|
Formatting Instruction Operands |
|
|
112 | (1) |
|
|
113 | (6) |
|
Converting Data to Code (and Vice Versa) |
|
|
119 | (1) |
|
Basic Data Transformations |
|
|
120 | (6) |
|
|
121 | (1) |
|
|
122 | (2) |
|
|
124 | (2) |
|
|
126 | (1) |
|
8 Datatypes And Data Structures |
|
|
127 | (40) |
|
Recognizing Data Structure Use |
|
|
130 | (12) |
|
|
130 | (5) |
|
|
135 | (7) |
|
|
142 | (4) |
|
Creating a New Structure (or Union) |
|
|
142 | (2) |
|
Editing Structure Members |
|
|
144 | (2) |
|
Stock Frames as Specialized Structures |
|
|
146 | (1) |
|
Using Structure Templates |
|
|
146 | (3) |
|
|
149 | (2) |
|
Parsing C Structure Declarations |
|
|
149 | (1) |
|
|
150 | (1) |
|
Using Standard Structures |
|
|
151 | (3) |
|
|
154 | (2) |
|
|
155 | (1) |
|
|
155 | (1) |
|
|
156 | (10) |
|
|
156 | (1) |
|
Virtual Functions and Vtables |
|
|
157 | (3) |
|
|
160 | (2) |
|
|
162 | (1) |
|
Runtime Type Identification |
|
|
163 | (1) |
|
Inheritance Relationships |
|
|
164 | (1) |
|
C++ Reverse Engineering References |
|
|
165 | (1) |
|
|
166 | (1) |
|
9 Cross-References And Graphing |
|
|
167 | (22) |
|
|
168 | (8) |
|
|
169 | (2) |
|
|
171 | (2) |
|
|
173 | (2) |
|
|
175 | (1) |
|
|
176 | (11) |
|
IDA External (Third-Party) Graphing |
|
|
176 | (9) |
|
IDA's Integrated Graph View |
|
|
185 | (2) |
|
|
187 | (2) |
|
|
189 | (12) |
|
|
190 | (6) |
|
Common Features of Console Mode |
|
|
190 | (1) |
|
Windows Console Specifics |
|
|
191 | (1) |
|
|
192 | (2) |
|
|
194 | (2) |
|
|
196 | (2) |
|
|
198 | (3) |
|
PART III ADVANCED IDA USAGE |
|
|
|
|
201 | (10) |
|
|
201 | (6) |
|
The Main Configuration File: ida.cfg |
|
|
202 | (1) |
|
The GUI Configuration File: idagui.cfg |
|
|
203 | (3) |
|
The Console Configuration File: idatui.cfg |
|
|
206 | (1) |
|
Additional IDA Configuration Options |
|
|
207 | (3) |
|
|
207 | (1) |
|
|
208 | (2) |
|
|
210 | (1) |
|
12 Library Recognition Using Flirt Signatures |
|
|
211 | (16) |
|
Fast Library Identification and Recognition Technology |
|
|
212 | (1) |
|
Applying FLIRT Signatures |
|
|
212 | (4) |
|
Creating FLIRT Signature Files |
|
|
216 | (9) |
|
Signature-Creation Overview |
|
|
217 | (1) |
|
Identifying and Acquiring Static Libraries |
|
|
217 | (2) |
|
|
219 | (2) |
|
|
221 | (3) |
|
|
224 | (1) |
|
|
225 | (2) |
|
13 Extending Ida's Knowledge |
|
|
227 | (10) |
|
Augmenting Function Information |
|
|
228 | (5) |
|
|
230 | (1) |
|
|
231 | (2) |
|
Augmenting Predefined Comments with loadint |
|
|
233 | (2) |
|
|
235 | (2) |
|
14 Patching Binaries And Other Ida Limitations |
|
|
237 | (12) |
|
The Infamous Patch Program Menu |
|
|
238 | (3) |
|
Changing Individual Database Bytes |
|
|
238 | (1) |
|
Changing a Word in the Database |
|
|
239 | (1) |
|
Using the Assemble Dialog |
|
|
239 | (2) |
|
IDA Output Files and Patch Generation |
|
|
241 | (4) |
|
|
242 | (1) |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
|
244 | (1) |
|
|
245 | (1) |
|
|
245 | (4) |
|
PART IV EXTENDING IDA'S CAPABILITIES |
|
|
|
|
249 | (36) |
|
|
250 | (2) |
|
|
252 | (9) |
|
|
252 | (1) |
|
|
253 | (1) |
|
|
254 | (1) |
|
|
254 | (2) |
|
|
256 | (1) |
|
|
257 | (1) |
|
|
258 | (1) |
|
Persistent Data Storage in IDC |
|
|
259 | (2) |
|
Associating IDC Scripts with Hotkeys |
|
|
261 | (1) |
|
|
261 | (9) |
|
Functions for Reading and Modifying Data |
|
|
262 | (1) |
|
User Interaction Functions |
|
|
263 | (1) |
|
String-Manipulation Functions |
|
|
264 | (1) |
|
File Input/Output Functions |
|
|
264 | (2) |
|
Manipulating Database Names |
|
|
266 | (1) |
|
Functions Dealing with Functions |
|
|
266 | (1) |
|
Code Cross-Reference Functions |
|
|
267 | (1) |
|
Data Cross-Reference Functions |
|
|
268 | (1) |
|
Database Manipulation Functions |
|
|
268 | (1) |
|
Database Search Functions |
|
|
269 | (1) |
|
Disassembly Line Components |
|
|
270 | (1) |
|
|
270 | (10) |
|
|
270 | (1) |
|
|
271 | (1) |
|
Enumerating Cross-References |
|
|
272 | (3) |
|
Enumerating Exported Functions |
|
|
275 | (1) |
|
Finding and Labeling Function Arguments |
|
|
275 | (3) |
|
Emulating Assembly Language Behavior |
|
|
278 | (2) |
|
|
280 | (2) |
|
|
281 | (1) |
|
IDAPython Scripting Examples |
|
|
282 | (2) |
|
|
282 | (1) |
|
|
282 | (1) |
|
Enumerating Cross-References |
|
|
283 | (1) |
|
Enumerating Exported Functions |
|
|
283 | (1) |
|
|
284 | (1) |
|
16 The Ida Software Development Kit |
|
|
285 | (30) |
|
|
286 | (3) |
|
|
287 | (1) |
|
|
287 | (2) |
|
Configuring a Build Environment |
|
|
289 | (1) |
|
The IDA Application Programming Interface |
|
|
289 | (25) |
|
|
290 | (4) |
|
|
294 | (8) |
|
|
302 | (2) |
|
Commonly Used SDK Functions |
|
|
304 | (6) |
|
Iteration Techniques Using the IDA API |
|
|
310 | (4) |
|
|
314 | (1) |
|
17 The Ida Plug-In Architecture |
|
|
315 | (32) |
|
|
316 | (8) |
|
|
318 | (2) |
|
|
320 | (1) |
|
|
321 | (1) |
|
|
322 | (2) |
|
|
324 | (5) |
|
|
329 | (1) |
|
|
330 | (1) |
|
|
331 | (2) |
|
Plug-in User Interface Options |
|
|
333 | (11) |
|
Using the SDK's Chooser Dialogs |
|
|
334 | (3) |
|
Creating Customized Forms with the SDK |
|
|
337 | (4) |
|
Windows-Only User Interface-Generation Techniques |
|
|
341 | (1) |
|
User Interface Generation with Qt |
|
|
342 | (2) |
|
|
344 | (2) |
|
|
346 | (1) |
|
18 Binary Files And Ida Loader Modules |
|
|
347 | (30) |
|
|
348 | (1) |
|
Manually Loading a Windows PE File |
|
|
349 | (9) |
|
|
358 | (1) |
|
Writing an IDA Loader Using the SDK |
|
|
358 | (14) |
|
|
361 | (5) |
|
Building an IDA Loader Module |
|
|
366 | (1) |
|
|
366 | (6) |
|
Alternative Loader Strategies |
|
|
372 | (1) |
|
Writing a Scripted Loader |
|
|
373 | (2) |
|
|
375 | (2) |
|
|
377 | (38) |
|
|
378 | (1) |
|
|
379 | (1) |
|
Writing a Processor Module Using the SDK |
|
|
380 | (23) |
|
|
380 | (1) |
|
Basic initialization of the LPH Structure |
|
|
381 | (4) |
|
|
385 | (5) |
|
|
390 | (4) |
|
|
394 | (5) |
|
|
399 | (2) |
|
|
401 | (2) |
|
Building Processor Modules |
|
|
403 | (4) |
|
Customizing Existing Processors |
|
|
407 | (2) |
|
Processor Module Architecture |
|
|
409 | (2) |
|
Scripting a Processor Module |
|
|
411 | (1) |
|
|
412 | (3) |
|
PART V REAL-WORLD APPLICATIONS |
|
|
|
20 Compiler Personalities |
|
|
415 | (18) |
|
Jump Tables and Switch Statements |
|
|
416 | (4) |
|
|
420 | (1) |
|
|
421 | (7) |
|
Debug vs. Release Binaries |
|
|
428 | (2) |
|
Alternative Calling Conventions |
|
|
430 | (2) |
|
|
432 | (1) |
|
21 Obfuscated Code Analysis |
|
|
433 | (42) |
|
Anti-Static Analysis Techniques |
|
|
434 | (15) |
|
Disassembly Desynchronization |
|
|
434 | (3) |
|
Dynamically Computed Target Addresses |
|
|
437 | (7) |
|
Imported Function Obfuscation |
|
|
444 | (4) |
|
Targeted Attacks on Analysis Tools |
|
|
448 | (1) |
|
Anti-Dynamic Analysis Techniques |
|
|
449 | (5) |
|
|
449 | (2) |
|
Detecting Instrumentation |
|
|
451 | (1) |
|
|
452 | (1) |
|
|
453 | (1) |
|
Static De-obfuscation of Binaries Using IDA |
|
|
454 | (18) |
|
Script-Oriented De-obfuscation |
|
|
455 | (5) |
|
Emulation-Oriented De-obfuscation |
|
|
460 | (12) |
|
Virtual Machine-Based Obfuscation |
|
|
472 | (2) |
|
|
474 | (1) |
|
22 Vulnerability Analysis |
|
|
475 | (24) |
|
Discovering New Vulnerabilities with IDA |
|
|
476 | (7) |
|
After-the-Fact Vulnerability Discovery with IDA |
|
|
483 | (5) |
|
IDA and the Exploit-Development Process |
|
|
488 | (7) |
|
|
488 | (4) |
|
Locating Instruction Sequences |
|
|
492 | (2) |
|
Finding Useful Virtual Addresses |
|
|
494 | (1) |
|
|
495 | (3) |
|
|
498 | (1) |
|
23 Real-World Ida Plug-Ins |
|
|
499 | (14) |
|
|
500 | (3) |
|
|
503 | (1) |
|
|
503 | (3) |
|
|
506 | (1) |
|
|
506 | (2) |
|
|
508 | (1) |
|
|
509 | (1) |
|
|
510 | (3) |
|
|
|
|
513 | (26) |
|
|
514 | (4) |
|
|
518 | (3) |
|
|
521 | (9) |
|
|
522 | (4) |
|
|
526 | (2) |
|
|
528 | (1) |
|
|
529 | (1) |
|
Automating Debugger Tasks |
|
|
530 | (8) |
|
Scripting Debugger Actions |
|
|
530 | (6) |
|
Automating Debugger Actions with IDA Plug-ins |
|
|
536 | (2) |
|
|
538 | (1) |
|
25 Disassembler/Debugger Integration |
|
|
539 | (30) |
|
|
540 | (1) |
|
IDA Databases and the IDA Debugger |
|
|
541 | (2) |
|
Debugging Obfuscated Code |
|
|
543 | (17) |
|
|
545 | (1) |
|
Simple Decryption and Decompression Loops |
|
|
546 | (4) |
|
Import Table Reconstruction |
|
|
550 | (5) |
|
|
555 | (5) |
|
|
560 | (1) |
|
|
561 | (7) |
|
|
568 | (1) |
|
26 Additional Debugger Features |
|
|
569 | (12) |
|
Remote Debugging with IDA |
|
|
569 | (5) |
|
Using a Hex-Rays Debugging Server |
|
|
570 | (3) |
|
Attaching to a Remote Process |
|
|
573 | (1) |
|
Exception Handling During Remote Debugging |
|
|
574 | (1) |
|
Using Scripts and Plug-ins During Remote Debugging |
|
|
574 | (1) |
|
|
574 | (4) |
|
|
575 | (1) |
|
|
576 | (1) |
|
|
577 | (1) |
|
|
578 | (1) |
|
|
579 | (2) |
|
|
581 | (4) |
|
Restrictions on IDA Freeware |
|
|
582 | (1) |
|
|
583 | (2) |
|
B Idc/Sdk Cross-Reference |
|
|
585 | (24) |
Index |
|
609 | |