Custom data types and formats
Another new feature that will be available in the upcoming version of IDA Pro is the ability to create and render custom data types and formats.
(Embedded instructions disassembled and rendered along side with x86 code)
February 25, 2010
(Embedded instructions disassembled and rendered along side with x86 code)
February 16, 2010
Scriptable Processor modules
One of the new features we are preparing for the next version of IDA is the ability to write processor modules using your favorite scripting language.
After realizing how handy it is to write file loaders using scripting languages, we set out to making the same thing for processor modules. As an exercise for this new feature, we implemented a processor module for the EFI bytecode.
February 05, 2010
New IDC improvement in IDA Pro 5.6
Scripting with IDA Pro has always been a very handy feature, not only when used in scripts but also in expressions, breakpoint conditions, form fields, etc...
In IDA Pro 5.6 we improved the IDC language and made it more convenient to use by adding objects, exceptions, support for strings with embedded zeroes, string slicing and references.
In IDA Pro 5.6 we improved the IDC language and made it more convenient to use by adding objects, exceptions, support for strings with embedded zeroes, string slicing and references.
January 20, 2010
Hex-Rays against Aurora
As everyone knows, Google and some other companies were under a targeted attack a few days ago. A vulnerability in the Internet Explorer was used to penetrate the computers.
An IDA user very kindly sent us the following link
January 16, 2010
Practical Appcall examples
Last week we introduced the new Appcall feature in IDA Pro 5.6. Today we will talk a little about how it's implemented and describe some of the uses of Appcall in various scenarios.
When you encounter the control breakpoint:
you can issue the CleanupAppcall() IDC command to restore the previously saved thread context and resume your debugging session.
How Appcall works
Given a function with a correct prototype, the Appcall mechanism works like this:- Save the current thread context
- Serialize the parameters (we do not allocate memory for the parameters, we use the debuggee's stack)
- Modify the input registers in question
- Set the instruction pointer to the beginning of the function to be called
- Adjust the return address so it points to a special area where we have a breakpoint (we refer to it as control breakpoint)
- Resume the program and wait until we get an exception or the control breakpoint (inserted in the previous step)
- Deserialize back the input (only for parameters passed by reference) and save the return value
When you encounter the control breakpoint:
you can issue the CleanupAppcall() IDC command to restore the previously saved thread context and resume your debugging session.
January 12, 2010
Introducing the Appcall feature in IDA Pro 5.6
In this blog entry we are going to talk about the new Appcall feature that was introduced in IDA Pro 5.6.
Briefly, Appcall is a mechanism used to call functions inside the debugged program from the debugger or your script as if it were a built-in function. If you've used GDB (call command), VS (Immediate window), or Borland C++ Builder then you're already familiar with such functionality.
(Screenshot showing how we called three functions (printf, MessageBoxA, GetDesktopWindow) using IDC syntax)
(Screenshot showing how we called three functions (printf, MessageBoxA, GetDesktopWindow) using IDC syntax)
Before diving in, please keep in mind that this blog entry is a short version of the full Appcall reference found here.
Continue reading "Introducing the Appcall feature in IDA Pro 5.6" »
January 08, 2010
Debugging ARM code snippets in IDA Pro 5.6 using QEMU emulator
Introduction
IDA Pro 5.6 has a new feature: automatic running of the QEMU emulator. It can be used to debug small code snippets directly from the database. In this tutorial we will show how to dynamically run code that can be difficult to analyze statically.
Target
As an example we will use shellcode from the article "Alphanumeric RISC ARM Shellcode" in Phrack 66. It is self-modifying and because of alphanumeric limitation can be quite hard to undestand. So we will use the debugging feature to decode it.
Continue reading "Debugging ARM code snippets in IDA Pro 5.6 using QEMU emulator" »
The IDA Pro book Search
Categories
Archives
- February 2010
- January 2010
- November 2009
- October 2009
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- February 2009
- January 2009
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- April 2008
- March 2008
- February 2008
- January 2008
- November 2007
- October 2007
- September 2007
- August 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- October 2006
- September 2006
- August 2006
- June 2006
- May 2006
- April 2006
- March 2006
- February 2006
- January 2006
- December 2005
- November 2005
- October 2005
Recent Posts
- Custom data types and formats
- Scriptable Processor modules
- New IDC improvement in IDA Pro 5.6
- Hex-Rays against Aurora
- Practical Appcall examples
- Introducing the Appcall feature in IDA Pro 5.6
- Debugging ARM code snippets in IDA Pro 5.6 using QEMU emulator
- PDF file loader to extract and analyse shellcode
- Hex-Rays Plugin Contest
- Hex-Rays is hiring
