Objec0ves. Gain understanding of what IDA Pro is and what it can do. Expose students to the tool GUI

Transcription

1 Intro to IDA Pro

2 31/15 Objec0ves Gain understanding of what IDA Pro is and what it can do Expose students to the tool GUI Discuss some of the important func<onality of tool

3 31/15 What is IDA Pro Disassembler used to explore program binaries Helps to iden<fy paths of execu<on when source code is unavailable Shows instruc<ons that are actually executed in a symbolic representa<on called assembly language

4 31/15 Launching IDA New- Provides a standard File Open dialog box to select file to be disassembled Go- Opens IDA in an empty work space Previous- Allows user to reopen saved files from the recent list

5 31/15 IDA File Loading Selec<ng a file provides op<ons on how the file may be disassembled

6 31/15 IDA File Loading cont.. IDA selects loader op<ons best suited for dealing with the selected file Most pe32 files (executables) will provide Windows PE loader (pe.ldw) and MS- DOS EXE (dos.ldw) loader as op<ons Binary file is the default for loading files that IDA does not recognize IDA will also select the processor type needed disassemble a file, unless the file is not recognized

7 31/15 Loader Warnings

8 31/15 Loader Warnings Be aware that various messages may arise when loading files The messages may provide informa<on such as: Iden<fying addi<onal data inside of the file that can be processed Poin<ng out that files may be obfuscated and don t match standard file formats Providing op<ons on the views available to analyze files etc

9 31/15 IDA Database File Created when opening a new file to be analyzed Produced from result of examining an en<re execuable Makes an.idb archive containing four files name.id0 contains contents of B- tree style database, name.id1 contains flags that describe each program byte, name.nam contains index informa<on related to named program loca<ons, name.<l contains informa<on about local type defini<ons All further analysis is performed on the database file and not the actual executable

10 IDA Desktop. Toolbar area- contains tools corresponding to commonly used opera<ons. Overview navigator- horizontal band that presents a linear view of the address space for loaded file. Different colors represent different types of file content, such as data or code. Tabs- shows currently open data displays 31/15 1

11 IDA Desktop cont... Disassembly view can provide two display styles: graph and lis<ng view. Primary window for determining flow of a file. Graph view- Provides a zoomed- out snapshot of the basic graph structure. FuncMon window- List of func<ons found within file being analyzed 31/15 1

12 /15 1

13 Other Views There are a number of other windows that are available in IDA These windows can be found under View à Open subviews Some window op<ons include Hex View- Presents hex dump of file Exports- list of func<ons that can be used by outside files Imports- list of func<ons that execute calls that are not contained in its own code Names- display all names and strings found within the executable program Structures- display the layout of any complex data structures 31/15 1

14 Sample Walk- Through Will reverse IDA_Intro_Example.exe to help understand IDA Pro op<ons. First open IDA Pro Free Next press OK on the following pop- up screen 31/15 1

15 Sample Walk- Through cont.. Open o_example.exe cify loca<on) 31/15 1

16 Loading file into IDA IDA has already selected how the load the file and the processor type 31/15 to use. 1

17 IDA Overview Navigator Loading a file ini<ally can take some <me IDA will take some type to load the en<re navigator bar Afer it has completed, click around in the navigator will take you to different parts of the disassembly Overview navigator 31/15 1

18 IDA Menu Bar Allows you to access any of IDA s func<ons and capabili<es Many viewing op<ons can be found under Viewà Open Subviews 31/15 1

19 ames window Displays a list of all global names within a binary Helps user navigate to known loca<ons where the names were used 31/15 1

20 trings Window Provides a lis<ng of the available strings found within the load applica<on 31/15 2

21 IDA Graph/Disassemble View Switching between Graph and Disassemble View can be done using the Space bar. 31/15 2

22 IDA Pro Quick Tips Selec<ng an instruc<on will highlight all other instruc<ons of the same type Simply click the instruc<on (Clicked call below) 31/15 2

23 DA Pro Quick Tips cont Click outside of the boxes and drag the mouse to move through the graphed disassemble 31/15 2

24 IDA Pro Quick Tips cont To view the disassembly of a func<on, double click on the func<on you would like to see To return to the previous posi<on press the Esc key. 31/15 2

25 IDA Pro Quick Tips cont Blocks of the graph are connected with arrows varying in color Blue- direct flow to next instruc<on Green- Branch condi<on true Red- Branch condi<on false Any of the above in bold, indicates a loop 31/15 2

26 IDA Pro Shortcuts Addi<onal informa<on on how to use IDA Pro can be found below: jps:// rays.com/products/ida/support/freefiles/ A_Pro_Shortcuts.pdf 31/15 2

27 Summary Presented the disassembly tool IDA Pro Discussed some of the important components of IDA Pro Allowed students to gain experience using the tool GUI 31/15 2

28 References hjps:// rays.com/products/ida/ida- execu<ve.pdf hjp://resources.infosecins<tute.com/basics- of- ida- pro- 2/ Chris Eagle The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler. No Starch Press, San Francisco, CA, USA 31/15 2

29 Ques0ons 31/15 2