REVERSE ENGINEERING CODE WITH IDA PRO

By EMILY WHITE

CHAPTER 1 INTRODUCTION AN OVERVIEW OF CODE DEBUGGERS SUMMARY CHAPTER 2 ASSEMBLY AND REVERSE ENGINEERING BASICS INTRODUCTION ASSEMBLY AND THE IA-32 PROCESSOR THE STACK, THE HEAP AND OTHER SECTIONS OF A BINARY EXECUTABLE IA-32 INSTRUCTION SET REFRESHER AND REFERENCE CHAPTER 3 PORTABLE EXECUTABLE AND EXECUTABLE AND LINKING FORMATS PORTABLE EXECUTABLE FORMAT EXECUTABLE AND LINKING FORMAT CHAPTER 4 WALKTHROUGHS ONE AND TWO FOLLOWING EXECUTION FLOW REVERSING WHAT THE BINARY DOES THE PROCESSING SUBROUTINE SOLUTIONS FAST TRACK FREQUENTLY ASKED QUESTIONS CHAPTER 5 DEBUGGING DEBUGGING BASICS BREAKPOINTS HARDWARE BREAKPOINTS SOFTWARE BREAKPOINTS USING BREAKPOINTS SINGLE STEPPING WATCHES EXCEPTIONS TRACING DEBUGGING IN IDA PRO CONTENTS USE OF DEBUGGING WHILE REVERSE ENGINEERING HEAP AND STACK ACCESS AND MODI? CATION OTHER DEBUGGERS WINDBG OLLYDBG IMMUNITY DEBUGGER (IMMDBG) PAIMEI/PYDBG GDB CHAPTER 6 ANTI-REVERSING DEBUGGING EXAMPLE OVERVIEW OBFUSCATION CHAPTER 7 WALKTHROUGH FOUR THE PROTOCOL PROBLEM PROTOCOL STRUCTURE FRAMING AND REASSEMBLY SELF SIMILARITY HIT MARKING EXAMPLE HITLIST CHAPTER 8 ADVANCED WALKTHROUGH REVERSING MALWARE CHAPTER 9 IDA SCRIPTING AND PLUG-INS BASICS OF IDA SCRIPTING IDC SYNTAX OUTPUT VARIABLES CONDITIONALS LOOPS FUNCTIONS LOCAL AND GLOBAL SCOPE GLOBAL VARIABLES SIMPLE SCRIPT EXAMPLES WRITING IDC SCRIPTS PROBLEM SOLVING WITH IDC THE PROBLEM PROBLEM BACKGROUND PROPOSED SOLUTION POSSIBLE IMPROVEMENTS NEW IDC DEBUGGER FUNCTIONALITY USEFUL IDC FUNCTIONS READING AND WRITING MEMORY CROSS REFERENCES CODE XREFS DATA XREFS DATA REPRESENTATION COMMENTS CODE TRAVERSAL INPUT AND OUTPUT BASICS OF IDA PLUG-INS MODULE/PLUG-IN RESOURCES INTRODUCING THE IDA PRO SDK SDK LAYOUT PLUG-IN SYNTAX SETTING UP THE DEVELOPMENT ENVIRONMENT SIMPLE PLUG-IN EXAMPLES THE HELLO WORLD PLUG-IN THE ? ND MEMCPY PLUG-IN COLLECTING DATA DISPLAYING DATA CONCLUSION THE INDIRECT CALL PLUG-IN USER INTERFACE IMPLEMENTING THE CALLBACK DBG_BPT DBG_STEP_INTO DBG_PROCESS_EXIT PRESENTING RESULTS PLUG-IN DEVELOPMENT AND DEBUGGING STRATEGIES CREATE A NEW IDA DEVELOPMENT DIRECTORY EDITING CON? GURATION FILES USING AN UNPACKED DATABASE ENABLING EXIT WITHOUT SAVING PLUG-IN ARGUMENTS SCRIPTING TO HELP PLUG-IN DEVELOPMENT LOADERS PROCESSOR MODULES THIRD-PARTY SCRIPTING PLUG-INS IDAPYTHON SUPPORTED PLATFORMS IDARUB