Reverse Code Engineering RCE CD +sandman 2000

home *** CD-ROM | disk | FTP | other *** search

/ Reverse Code Engineering RCE CD +sandman 2000 / ReverseCodeEngineeringRceCdsandman2000.iso / RCE / Gthorne / reopsahl / gij!ida.txt < prev next >

Wrap

Text File | 2000-05-25 | 15.8 KB | 354 lines

The Idea Of IDA (A Small Primer For IDA Newbies) By Gij Hi there, gij here, i'm guessing most of you are reading this because you've heard about IDA and are thinking "why is it better then wdasm?", or you have already gotten IDA, but found it to complicated to use. This is being written to help you out with your first steps in using IDA. Hope it helps... The Disassembling Challenge --------------------------- Most software today is written using high level languages: C, C++, VB, JAVA, Delphi, etc'. These are ( generally speaking ) compiled languages that turn high-level code into the low-level code form that the computer understand, Assembler. We need to make a distinction between a Decompiler and a Disassembler. A decompiler takes a binary file generated by a compiler and try to reverse it into the high level language the file was compile from. So for example a C++ decompiler would take an .exe made by Visual C++ or any other compiler and turn out a C++ source file. A good decompiler is very hard to make. A Disassembler on the other hand, will take a binary file that could have been written in almost any language, and disassemble into an Assembler source file. A good disassembler needs to be able to fairly accurately distinguish between data and code. a good decompiler needs to do that AND be able to understand what code construct in the original high-level language generated this code. so what is IDA? neither. it's a hybrid between the two types of programs. IDA stands for "Interactive Disassembler", and it is. but it also has a of the characteristics of a decompiler, namely it's FLIRT feature. Those of you who have programmed in c, or indeed ever try to debug a windows program, know that every program uses some functions supplied by the compiler or as part of the Win32 API. "printf()" is one example, all c programs that call printf, and are compiled by the same compiler have the same piece of code inside them. In the compilation process the compiler links in the code for the "printf()" function from it's included libraries. This opens up an opportunity for a disassembler to recognize the code pattern of a particular function and pin a useful name on it. This also saves us from the embarrassment of tracing through a function for 20 minutes only to discover it's some compiler's variant of "fseek()". It saves us time by helping us understand what the program is doing easily by letting us see what functions it calls. This is exactly what FLIRT does, the FLIRT libraries that come with many signatures of functions from various compilers, not only for C but also for Pascal, Delphi and others. in a way You get the best of both worlds, IDA let's you reverse any binary file from any language, while taking advantage of the shared nature of compiler libraries. You can get more information on FLIRT at the IDA home page. IDA vs. Wdasm -------------- Those of you who have been using Wdasm up till now, will need to make a slight switch in attitude when moving over to IDA. Wdasm, takes in a file and gives out a disassembly. that's it. IDA is INTERACTIVE. this means the disassembly you get is very much editable, you can change code to be marked as data, and the other way around. you can add comments, see cross-references ( very useful, we'll get to it later ) , and probably a whole lot more. That's probably why most people consider it more complex, or heavier then Wdasm. in IDA, you have to do more work, but you can accomplish much more. it's possible to completely reverse an application inside IDA, generate a source and have it compile to a byte-identical exe file. ( I'm not saying it's easy though ). IDA by itself adds comments to some API calls or INT's, And using some tools availible, you can add your own comments to the databases. The Use of IDA -------------- There are two version of IDA you can use, idaw.exe and idax.exe. idaw.exe is a windows exe, while idax.exe is a dos file. I heard it said it's better to use idaw.exe because as a windows program it has less trouble with memory. I personally use idax.exe because i've found that with international versions of windows idaw.exe tends to have problems when typing in text. One Important thing to remember, and thank you to whatever kind soul on #cracking who helped me understand this when i was starting out with IDA , is that once you feed IDA an exe, dll, or whatever file, upon exit it saves a Disassembly database with the extension .IDB, when you wish to continue work on the disassembly, you do not reload the binary file, but tell IDA to load the .IDB file. once you've generated the .IDB file for a program you no longer need the original EXE, all changes to the disassembly are made an stored in the .IDB file. OK, let's get down to some real-life use of IDA. Actual Use Of IDA ----------------- You can load a program into IDA in 2 ways: 1) on the command line: "idax.exe c:\target\program.exe" 2) through the file dialog which appears when starting IDA without a filename argument. Once you load the program into IDA, it will show you a panel of options to choose from, the default options are chosen for you according to the file format you loaded. The other options are either advanced ( meaning, if you need them, you know what how to use them ), or self-explanatory. IDA then goes through 2 phases: 1) Actual Disassembly, including separation of program into code and data areas. This is not fool-proof, IDA does make mistakes some times, don't expect to run a program through IDA and have a 100% percent accurate disassembly. IDA does come as close as anything i've ever seen. At this phase, it also marks functions and analyses their stack arguments, assigns label names to jump and call destinations, separates the file into segments if needed, and probably more. 2) If IDA recognize the file as compiled by a supported compiler, it will load a signature file, and try to assign names to as many function as possible. After IDA has finished doing it's work, you can see some of the results of the disassembly, besides the main screen, where the disassembly is shown, the is also the status window, where information about what IDA is doing is shown, and other screen you can activate to see information about the disassembly. To switch between the window you can use the "Windows" menu, or F6 and Shift-F6 to go back and forth between windows. The Disassembly window can be divided into 3 parts: 1) segment:offset ( to the left ) 2) code/data ( Taking up most of the width of the screen ). 3) Comments, These are actually part of the disassembly, but sometimes contain Important information like Cross-references and API call info. All in All, the disassembly screen should look familiar if you've ever written asm code. An IDA Disassembly is divided into 3 types of areas/entries: 1) Code. 2) Data. 3) Unexplored. You can distinguish between code and data just like you would in a normal asm file. data is preceded by some sort of data specifier: db,dw,dd,dt,dq.... You can detect unexplored code by looking at the left part of the screen, unexplored areas are marked by a "greyed out" segment:offset. Unexplored areas are the areas to which no reference is made in code ( it's not jumped or called to, or incorporated in to the code flow of the program in any other way. ), or as data ( that area is not read or written by code.) These places usually ( always? ) contain 0's, and are usually not relevant to the code, unless IDA missed marking some area as code, which references this area. This illustrates another point, with any change you make to the disassembly IDA checks if it can deduce anything else about the rest of the programs from the changes you've made. so for example, if you mark a data areas as code, IDA will look at it, and if it sees a jump to some unexplored space, it will mark that area as code, same with data, if that new code you've marked reads or writes to a previously unexplored address, IDA will mark that area as data. To change the markings of an area, you select it using the mouse, then press one of 3 keys: 1) 'c', marks that area as code. 2) 'd', marks that area as data, if you do not select an area, but place the cursor at a line, and press 'd', you will cycle through the data specifiers available. if you mark an area, you can use 'a' to declare it a string, which will make IDA automatically give the string name, and show it as "123", instead of "db 31h,32h,33h" for example. you can also use '*' to make it an array of data, which will pop up a dialog where you can set various options concerning the array (this is the same as marking an area and pressing 'd' ). 3) 'u', marks that area as unexplored. Names ----- Names are the most Important part of a disassembly, it's the difference between 'loc_0_200' and 'Show_Splash_Screen' that makes it possible to understand a program bit by bit. To change the name of a label, or create a new one, position the cursor at the desired line and press 'n', a dialog will appear which will let you enter or modify the label name. Cross-references And Information Screens --------------------------------- I've already mentioned Cross-references in this article a few times, it's only fair that i should explain what they are to those who do not know. a reference is created when a certain piece of code uses another area in some way, this could be a call ( one piece of code calls another ), a jump , or a read or write operation to a data location. IDA keeps track of this references, and maintains a table of cross-references for every label in the disassembly. for example: seg000:0200 seg000:0200 loc_0_200: ; CODE XREF: _main+1EAjump tablesj seg000:0200 cmp word_1B90_14C, 0 seg000:0205 jz loc_0_20A seg000:0207 jmp loc_0_2F2 This means that the label loc_0_200 is referenced as CODE ( jump or call, thus "CODE XREF" ) by another location in the program, to see the list of places that reference this location, position the cursor at the line of the label, and select "Cross references" from the "View" Menu, a window should appear with a list of locations, you can jump to that location by selecting it in the window and pressing ENTER. IDA also keeps tabs of your little "field-trips" inside the code, so after you've traced 12 function deep into the code you can press ESC to get back to the place you where before your present location. Data Cross Reference are Much the same, no need to explain them separately. Cross references are very Important because they give us a little info about a piece of code or data by telling us it is related to another piece of code. so potentially, if you've understood one piece of code, you can us it as an "anchor" into other locations in the program. I should take a minute to tell you about the other items in the view menu, even though they are fairly self-explanatory: 1) Disassembly: shows you the Disassembly screen for the current file. 2) Functions: shows you a list of location marked as function entry points. 3) Names: shows you a complete list of FLIRT Recognized functions, and locations marked as strings. 4) Signatures: shows you the FLIRT signature files currently loaded and applied to the file, you can manually add other signature files here. 5) Segments: shows you the created segments 6) Segment registers: it seems to show you the changes in, and the value of, each segment register between any range of locations in the file. 7) Selectors: This Is Pmode related, won't show anything normally, perhaps you need to add them manually. probably used when disassembling extenders, or something else that's fairly dodgy. 8) Cross references: you know. 9) Structures: You can define structures and assign them to data areas, this will show the currently defines structs. ( see how advanced IDA is? ) 10) Enumerations: I think Enum's are used to give Names to numbers, or maybe array elements. i've never had to use it, normally, neither would you. Comments -------- There are two types of comments: repeatable and regular. 1) Repeatable: made by pressing ';', when adding this sort of comment to a function, the comment will appear next to any call to that function anywhere in the file. 2) Regular: when adding this sort of comment, it will appear only once, at the location you've entered it. Marking Positions ----------------- Sometimes after disassembling for a while, you want to mark a location it could be the beginning of the data strings section, an Important function, your lucky number as an offset, whichever. IDA has a feature that let's you mark positions, and give the mark a name. to plant a mark, got the location you wish to mark, and then press Alt-M, or select "Mark Location" from the "Navigate" Menu, this will pop up a window, press enter on an empty line ( if there are no marked location, they will all be blank ), a dialog will appear asking what name you wish to give to that mark, this is NOT like generating a label for a location, only the marked positions table will show that name. To go to a marked position, select "Jump To/Marked Position" out of the "Navigate Menu", a list of marked positions will show up, choose the one you want to jump to and press ENTER. Getting Around -------------- Sometimes You need to get around IDA, and you just can't be bothered to do it by pressing PgUp a 3-digit number of times. That's when you can use the "Navigate" menu, the sub menus you need are: 1) Jump to: You can go to a specific address,function,string,segment, entry point,cross reference, marked positions etc'. 2) Search for: allows you to search for text, specific operands to an instruction, next code/data/unexplored, etc'. Exporting --------- Those of us that write articles ( yeah, me too ), use IDA to rip code out and paste it into our text as examples. To do this you need to export the code you want to a file, and that is done by using the "File/Produce Output File" menu item. there are 3 options we care about right now: 1) Produce ASM file: this will put out an .ASM file that you should be able to feed TASM or MASM with. 2) Produce LST file: same, but will also put segment:offset pairs into the file, use this for articles. 3) Produce DIF file: IDA can also server as a patcher, look at "EDIT/Patch Program", if you modify the program and use this option you will get a file similar to the output of the dos program "fc". Final Notes ----------- There is more to write about IDA, you should know that it has a scripting language, which let's you automate some rather mundane disassembling procedures. If you would like to learn more about IDA scripting, check the help file for syntax and a list of functions, and you can also get some very nice scripts at mammon's place. For real-life examples of cracking with IDA i direct you to the normal place ( you know )m plenty of articles out there. I Appreciate Input on my articles, comments and criticism, you can reach me on EFNET's #cracking4newbies, or at my email at gij <at sign> iname.com, i can't promise a reply, but i do read all my mail. GREETZ ------ All The Guys (and girl) On #c4n: Never has so much newbiness been in the hands of so few people. Gij. yep.