Intro to IDA Pro
31/15 Objec0ves Gain understanding of what IDA Pro is and what it can do Expose students to the tool GUI Discuss some of the important func<onality of tool
31/15 What is IDA Pro Disassembler used to explore program binaries Helps to iden<fy paths of execu<on when source code is unavailable Shows instruc<ons that are actually executed in a symbolic representa<on called assembly language
31/15 Launching IDA New- Provides a standard File Open dialog box to select file to be disassembled Go- Opens IDA in an empty work space Previous- Allows user to reopen saved files from the recent list
31/15 IDA File Loading Selec<ng a file provides op<ons on how the file may be disassembled
31/15 IDA File Loading cont.. IDA selects loader op<ons best suited for dealing with the selected file Most pe32 files (executables) will provide Windows PE loader (pe.ldw) and MS- DOS EXE (dos.ldw) loader as op<ons Binary file is the default for loading files that IDA does not recognize IDA will also select the processor type needed disassemble a file, unless the file is not recognized
31/15 Loader Warnings
31/15 Loader Warnings Be aware that various messages may arise when loading files The messages may provide informa<on such as: Iden<fying addi<onal data inside of the file that can be processed Poin<ng out that files may be obfuscated and don t match standard file formats Providing op<ons on the views available to analyze files etc
31/15 IDA Database File Created when opening a new file to be analyzed Produced from result of examining an en<re execuable Makes an.idb archive containing four files name.id0 contains contents of B- tree style database, name.id1 contains flags that describe each program byte, name.nam contains index informa<on related to named program loca<ons, name.<l contains informa<on about local type defini<ons All further analysis is performed on the database file and not the actual executable
IDA Desktop. Toolbar area- contains tools corresponding to commonly used opera<ons. Overview navigator- horizontal band that presents a linear view of the address space for loaded file. Different colors represent different types of file content, such as data or code. Tabs- shows currently open data displays 31/15 1
IDA Desktop cont... Disassembly view can provide two display styles: graph and lis<ng view. Primary window for determining flow of a file. Graph view- Provides a zoomed- out snapshot of the basic graph structure. FuncMon window- List of func<ons found within file being analyzed 31/15 1
2 1 3 6 4 5 31/15 1
Other Views There are a number of other windows that are available in IDA These windows can be found under View à Open subviews Some window op<ons include Hex View- Presents hex dump of file Exports- list of func<ons that can be used by outside files Imports- list of func<ons that execute calls that are not contained in its own code Names- display all names and strings found within the executable program Structures- display the layout of any complex data structures 31/15 1
Sample Walk- Through Will reverse IDA_Intro_Example.exe to help understand IDA Pro op<ons. First open IDA Pro Free Next press OK on the following pop- up screen 31/15 1
Sample Walk- Through cont.. Open o_example.exe cify loca<on) 31/15 1
Loading file into IDA IDA has already selected how the load the file and the processor type 31/15 to use. 1
IDA Overview Navigator Loading a file ini<ally can take some <me IDA will take some type to load the en<re navigator bar Afer it has completed, click around in the navigator will take you to different parts of the disassembly Overview navigator 31/15 1
IDA Menu Bar Allows you to access any of IDA s func<ons and capabili<es Many viewing op<ons can be found under Viewà Open Subviews 31/15 1
ames window Displays a list of all global names within a binary Helps user navigate to known loca<ons where the names were used 31/15 1
trings Window Provides a lis<ng of the available strings found within the load applica<on 31/15 2
IDA Graph/Disassemble View Switching between Graph and Disassemble View can be done using the Space bar. 31/15 2
IDA Pro Quick Tips Selec<ng an instruc<on will highlight all other instruc<ons of the same type Simply click the instruc<on (Clicked call below) 31/15 2
DA Pro Quick Tips cont Click outside of the boxes and drag the mouse to move through the graphed disassemble 31/15 2
IDA Pro Quick Tips cont To view the disassembly of a func<on, double click on the func<on you would like to see To return to the previous posi<on press the Esc key. 31/15 2
IDA Pro Quick Tips cont Blocks of the graph are connected with arrows varying in color Blue- direct flow to next instruc<on Green- Branch condi<on true Red- Branch condi<on false Any of the above in bold, indicates a loop 31/15 2
IDA Pro Shortcuts Addi<onal informa<on on how to use IDA Pro can be found below: jps://www.hex- rays.com/products/ida/support/freefiles/ A_Pro_Shortcuts.pdf 31/15 2
Summary Presented the disassembly tool IDA Pro Discussed some of the important components of IDA Pro Allowed students to gain experience using the tool GUI 31/15 2
References hjps://www.hex- rays.com/products/ida/ida- execu<ve.pdf hjp://resources.infosecins<tute.com/basics- of- ida- pro- 2/ Chris Eagle. 2008. The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler. No Starch Press, San Francisco, CA, USA 31/15 2
Ques0ons 31/15 2