Difference between revisions of "IDA Pro"
m (→To sort) |
m (→Diaphora) |
||
Line 113: | Line 113: | ||
<br>When running scritp I got [https://groups.google.com/forum/#!topic/diaphora/6vDqztVgpJY this issue] about importing md5. |
<br>When running scritp I got [https://groups.google.com/forum/#!topic/diaphora/6vDqztVgpJY this issue] about importing md5. |
||
<br>To solve it I had to install manually libssl0.9.8:i386 from [https://packages.debian.org/squeeze-lts/i386/libssl0.9.8/download old Debian repo] |
<br>To solve it I had to install manually libssl0.9.8:i386 from [https://packages.debian.org/squeeze-lts/i386/libssl0.9.8/download old Debian repo] |
||
+ | <br>As bonus, it exports IDA DBs in Sqlite format |
||
+ | |||
==To sort== |
==To sort== |
||
* [https://bitbucket.org/daniel_plohmann/simplifire.idascope/ IDAscope] |
* [https://bitbucket.org/daniel_plohmann/simplifire.idascope/ IDAscope] |
Revision as of 16:59, 21 September 2015
Intro
IDA Pro combines an interactive, programmable, multi-processor disassembler coupled to a local and remote debugger and augmented by a complete plugin programming environment.
- Official page
- Windows, Linux, Mac OS X
- x86-32, x86-64, ARM and many others
- ELF, Java bytecode, Dalvik, ARM,...
- disassembler, some debugger
Resources
- The IDA Pro Book
- https://leanpub.com/IDAPython-Book
- Reverse Engineering Code with IDA Pro by IOActive
PIN Tracer
Install
Adapted from https://www.hex-rays.com/products/ida/support/tutorials/pin/pin_tutorial.pdf
apt-get install gcc-multilib g++-multilib pushd pin-2.13-61206-gcc.4.4.7-linux/ia32/runtime ln -s libelf.so.0.8.13 libelf.so popd pushd pin-2.13-61206-gcc.4.4.7-linux/intel64/runtime ln -s libelf.so.0.8.13 libelf.so popd mkdir pin-2.13-61206-gcc.4.4.7-linux/source/tools/@idapin66 cd pin-2.13-61206-gcc.4.4.7-linux/source/tools/@idapin66 wget https://www.hex-rays.com/products/ida/support/freefiles/idapin66.zip 7z x idapin66.zip make TARGET=ia32e make TARGET=ia32
Usage
In IDA select "PIN Tracer" and configure it.
- Path to PIN: pin-2.13-61206-gcc.4.4.7-linux/pin
- Path to tool: pin-2.13-61206-gcc.4.4.7-linux/source/tools/@idapin66/
See PIN tutorial
Python
Based on idapython (shipped with IDA Pro)
Install for ida 6.5
Some require PySide as well
To install it on Linux for IDA Pro, see Hexblog, but let's install it locally in idapython instead of /
Download PySide 2011/12/30 for IDAPython 1.5+, Python 2.7 (2.6) and Qt 4.8.4 (IDA 6.5), Linux version
tar xvfz os_package_pyside_python27_package.tgz -C /path/to/ida
Install for ida 6.6
PySide is now also part of IDA Pro, nothing to do anymore :)
Patching
IDA Pro can natively patch code/data in its DB but not the original file, but you can do:
- patch in the DB:
- Edit / Patch program / ...
- produce a diff file:
- File / Produce file / Create DIF
- patch the file:
- Edit / Patch program / Apply patches to input file
- patch the file from a DIF file:
See also plugins Fentanyl and idapatcher here below
Extensions
Development
ida-patcher
Make ida-patcher.py available in ida-6.6/plugins/
- View->Open subviews->Patches
Fentanyl
Easy patching!
See also here
File > Script file > Fentanyl/main.py
Alt-N Convert instructions to nops Alt-X Nop all xrefs to this function Alt-J Invert conditional jump Alt-P Patch instruction Alt-Z Undo modification (Won't always work. Should still be careful editing.) Alt-Y Redo modification (Won't always work. Should still be careful editing.) Alt-S Save file Alt-C Find Code Caves Ctrl-Alt-F Make jump unconditional Ctrl-Alt-N Neuter the binary (remove calls to fork, setuid, setgid, getpwnam, set groups, and chdir)
Hex-Rays
The most expensivepowerful IDA Pro plugin is the Hex-Rays decompiler
- x86 and ARM
- decompiler
Limitations specific to ARM:
- floating point instructions are not supported
- VFP/SIMD/Neon/... instructions are not supported
- functions having an argument that is passed partially on registers and partially on the stack are not supported (e.g. int64 passed in R3 and on the stack)
Addons
ida-decompiler
Decompile small functions in IDA
arm-thumb-decompiler
Mainly for Thumb right now
IDA Pro ARM debugger
Support ARM code debugging via JTAG or software emulators
Garts: Get all referenced text strings
aka A Better String Viewer
File > Script file > garts.py
IDA toolbag
- Under Linux put toolbag content under ~/.idapro
>>> import toolbag
Miasm
Some bridges between IDA and Miasm:
Diaphora
A program diffing plugin, working with IDA 6.7 and 6.8
Doc here (pdf)
When running scritp I got this issue about importing md5.
To solve it I had to install manually libssl0.9.8:i386 from old Debian repo
As bonus, it exports IDA DBs in Sqlite format
To sort
- IDAscope
- Zynamics bindiff
- patchdiff2 or here, couldn't get even the git version working on linux and IDA 6.8 (compiled after some patches but fail parsing IDA DB)
- DarunGrim, another binary diff tool, opensource but discontinued?
- x86emu, x86 Emulator plugin. Windows, Linux, OS X
- idapatchwork, emulator based on PyEmu (slides)
- epanos, a MIPS decompiler, for IDA > 6.5
- IDAStealth, anti-anti-debugging, for Windows
- IDA-sploiter, helps developing ROP exploits
- Plugin contests 2013, 2012, 2011, 2010, 2009
- dr.rer.oec.gadget, Develop and analyze ROP exploits for all processor architectures supported by IDA itself
- IDACompare
- IDAEye
- ADB Qt
- IDA IPython, An IDA Pro Plugin for embedding an IPython Kernel
- TurboDiff, a program diffing plugin
- IDA Pro Instruction Reference Plugin
- list
- list
- list
Debugging
IDA Pro has some debugging capabilities too.
Local debugging: win32, windbg
Remote debugging:
gdbserver --multi <client_ip>:<port> # default IDA port: 23946
Then on IDA: select Remote GDB debugger, paths should be paths on the gdbserver host.
Tuning:
- Debugger / options / Stop on process entry point
- Compatible with lib preloading, cf below
- from 6.4, can make use of Intel PIN tools for diff debugging, see tutorial (pdf)