The IDA Pro Book

No source code? No problem. With IDA Pro, the interactive disassembler, you live in a source code-optional world. IDA can automatically analyze the millions of opcodes that make up an executable and present you with a disassembly. But at that point, your work is just beginning. With The IDA Pro Book, you’ll learn how to turn that mountain of mnemonics into something you can actually use.

Hailed by the creator of IDA Pro as “profound, comprehensive, and accurate,” the second edition of The IDA Pro Book covers everything from the very first steps to advanced automation techniques. You’ll find complete coverage of IDA’s new Qt-based user interface, as well as increased coverage of the IDA debugger, the Bochs debugger, and IDA scripting (especially using IDAPython). But because humans are still smarter than computers, you’ll even learn how to use IDA’s latest interactive and scriptable interfaces to your advantage.

Save time and effort as you learn to:

–Navigate, comment, and modify disassembly

–Identify known library routines, so you can focus your analysis on other areas of the code

–Use code graphing to quickly make sense of cross references and function calls

–Extend IDA to support new processors and filetypes using the SDK

–Explore popular plug-ins that make writing IDA scripts easier, allow collaborative reverse engineering, and much more

–Use IDA’s built-in debugger to tackle hostile and obfuscated code

Whether you’re analyzing malware, conducting vulnerability research, or reverse engineering software, a mastery of IDA is crucial to your success. Take your skills to the next level with this 2nd edition of The IDA Pro

Table of Contents

PART I: Introduction to IDA

1: Introduction to Disassembly

2: Reversing and Disassembly Tools

3: IDA Pro Background

PART II: Basic IDA Usage

4: Getting Started with I DA

5: IDA Data Displays

6: Disassembly Navigation

7: Disassembly Manipulation

8: Datatypes and Data Structures

9: Cross-References and Graphing

10: The Many Faces of IDA

PART Ill: Advanced IDA Usage

11: Customizing I DA

12: Library Recognition Using FU RT Signatures

13: Extending IDA’s Knowledge

14: Patching Binaries and Other IDA Limitations

PART IV: Extending IDA’s Capabilities

15: I DA Scripting

16: The IDA Software Development Kit

17: The IDA Plug-in Architecture

18: Binary Files and I DA Loader Modules

19: IDA Processor Modules

PART V: Real-World Applications

20: Compiler Personalities

21: Obfuscated Code Analysis

22: Vulnerability Analysis

23: Real-World IDA Plug-ins

PART VI: The IDA Debugger

24: The IDA Debugger

25: Disassembler/Debugger Integration

26: Additional Debugger Features

A: Using IDA Freeware 5.0

B: IDC/SDK Cross-Reference

About the Author

Chris Eagle is a Senior Lecturer of Computer Science at the Naval Postgraduate School in Monterey, CA. He is the author of many IDA plug-ins and co-author of Gray Hat Hacking, and he has spoken at numerous security conferences, including Black Hat, Defcon, ToorCon, and ShmooCon.