Intro

IDA Pro combines an interactive, programmable, multi-processor disassembler coupled to a local and remote debugger and augmented by a complete plugin programming environment.

Official page
Windows, Linux, Mac OS X
x86-32, x86-64, ARM and many others
ELF, Java bytecode, Dalvik, ARM,...
disassembler, some debugger

PIN Tracer

Install

Adapted from https://www.hex-rays.com/products/ida/support/tutorials/pin/pin_tutorial.pdf

apt-get install gcc-multilib g++-multilib
pushd pin-2.13-61206-gcc.4.4.7-linux/ia32/runtime
ln -s libelf.so.0.8.13 libelf.so
popd
pushd pin-2.13-61206-gcc.4.4.7-linux/intel64/runtime
ln -s libelf.so.0.8.13 libelf.so
popd
mkdir pin-2.13-61206-gcc.4.4.7-linux/source/tools/@idapin66
cd pin-2.13-61206-gcc.4.4.7-linux/source/tools/@idapin66
wget https://www.hex-rays.com/products/ida/support/freefiles/idapin66.zip
7z x idapin66.zip
make TARGET=ia32e
make TARGET=ia32

Usage

In IDA select "PIN Tracer" and configure it.

Path to PIN: pin-2.13-61206-gcc.4.4.7-linux/pin
Path to tool: pin-2.13-61206-gcc.4.4.7-linux/source/tools/@idapin66/

See PIN tutorial

Python

Based on idapython (shipped with IDA Pro)

Install for ida 6.5

Some require PySide as well
To install it on Linux for IDA Pro, see Hexblog, but let's install it locally in idapython instead of /
Download PySide 2011/12/30 for IDAPython 1.5+, Python 2.7 (2.6) and Qt 4.8.4 (IDA 6.5), Linux version

tar xvfz os_package_pyside_python27_package.tgz -C /path/to/ida

Install for ida 6.6

PySide is now also part of IDA Pro, nothing to do anymore :)

Patching

IDA Pro can natively patch code/data in its DB but not the original file, but you can do:

patch in the DB:
- Edit / Patch program / ...
produce a diff file:
- File / Produce file / Create DIF
patch the file:
- Edit / Patch program / Apply patches to input file
patch the file from a DIF file:
- see e.g. http://resources.infosecinstitute.com/applied-cracking-byte-patching-ida-pro/

See also plugins Fentanyl and idapatcher here below

Extensions

ida-patcher

Make ida-patcher.py available in ida-6.6/plugins/

View->Open subviews->Patches

Fentanyl

Easy patching!
See also here

File > Script file > Fentanyl/main.py

Alt-N      Convert instructions to nops
Alt-X      Nop all xrefs to this function
Alt-J      Invert conditional jump
Alt-P      Patch instruction
Alt-Z      Undo modification (Won't always work. Should still be careful editing.)
Alt-Y      Redo modification (Won't always work. Should still be careful editing.)
Alt-S      Save file
Alt-C      Find Code Caves
Ctrl-Alt-F Make jump unconditional
Ctrl-Alt-N Neuter the binary (remove calls to fork, setuid, setgid, getpwnam, set groups, and chdir)

Hex-Rays

The most ~~expensive~~powerful IDA Pro plugin is the Hex-Rays decompiler

x86 and ARM
decompiler

Limitations specific to ARM:

floating point instructions are not supported
VFP/SIMD/Neon/... instructions are not supported
functions having an argument that is passed partially on registers and partially on the stack are not supported (e.g. int64 passed in R3 and on the stack)

Addons

ida-decompiler

Decompile small functions in IDA

arm-thumb-decompiler

Mainly for Thumb right now

IDA Pro ARM debugger

Support ARM code debugging via JTAG or software emulators

Garts: Get all referenced text strings

aka A Better String Viewer

File > Script file > garts.py

IDA toolbag

Under Linux put toolbag content under ~/.idapro

>>> import toolbag

Miasm

Some bridges between IDA and Miasm:

To sort

IDAscope
patchdiff2
Zynamics bindiff
DarunGrim, another binary diff tool, opensource but discontinued?
x86emu, x86 Emulator plugin. Windows, Linux, OS X
idapatchwork, emulator based on PyEmu (slides)
epanos, a MIPS decompiler, for IDA > 6.5
IDAStealth, anti-anti-debugging, for Windows
IDA-sploiter, helps developing ROP exploits
Plugin contests 2013, 2012, 2011, 2010, 2009
dr.rer.oec.gadget, Develop and analyze ROP exploits for all processor architectures supported by IDA itself
list
IDACompare
IDAEye
ADB Qt
IDA IPython, An IDA Pro Plugin for embedding an IPython Kernel

Debugging

IDA Pro has some debugging capabilities too.
Local debugging: win32, windbg Remote debugging:

gdbserver --multi <client_ip>:<port> # default IDA port: 23946

Then on IDA: select Remote GDB debugger, paths should be paths on the gdbserver host.
Tuning:

Debugger / options / Stop on process entry point
Compatible with lib preloading, cf below
from 6.4, can make use of Intel PIN tools for diff debugging, see tutorial (pdf)

IDA Pro

Contents