Name: Elias

Posts by 0xeb:

    Book review: IDA Pro Book, 2nd Edition

    August 3rd, 2011

    A few weeks ago we received an electronic copy of the “IDA Pro Book, 2nd Edition”. In the second edition of his 26 chapters book, Chris Eagle did a good job updating the book and covering the latest changes in IDA Pro 6.1: the IDA Qt graphical interface is illustrated in this edition (all screenshots are up to date), some chapters are slightly updated whereas some have new sections that cover topics such as IDAPython, various debugger plugins and other features.

    Read the rest of this entry “

    Comments Off

    IDA Pro 6.2 with database snapshots support

    July 29th, 2011

    The most frequently asked question we get during the IDA Pro trainings, on the support forum or via support emails is: “When will IDA Pro support the undo feature?” or “How can I undo an operation in IDA Pro”.

    Our answer has always been: “Sorry, it is not possible to undo in IDA Pro” or “This feature will eventually be implemented sometime in the future”.

    In this blog post, we introduce the new database snapshots feature that will be present in IDA Pro 6.2:

    snap_man

    Read the rest of this entry “

    9 Comments "

    Unpacking mpress’ed PE+ DLLs with the Bochs plugin

    July 1st, 2011

    In IDA Pro 6.1 we extended the Bochs debugger plugin to support debugging of 64bit code snippets. With IDA Pro 6.2 it will be possible to debug PE+ executables as well. Since the execution will be emulated inside Bochs, a 64bit operating system is not required and one could be equally running a 32 or 64bit Linux, Mac OS or Windows operating system and still be able to debug 64bit PE files from IDA Pro.

    To illustrate this new feature, we are going to unpack and briefly analyze a PE+ trojan that is compressed with MPRESS from MATCODE Software.We will illustrate how to unpack the DLL, recover the import table and cleanup the database to get it ready for analysis.

    bochs_options

    Read the rest of this entry “

    4 Comments "

    Precompiled PySide binaries for IDA Pro

    May 18th, 2011

    In a previous blog post we mentioned that it is possible to use IDA Pro with PySide (Python + Qt) after applying some minor code patches to PySide.

    For convenience purposes, we precompiled the PySide libraries that work with IDA Pro 6.0+ and Python 2.6/2.7. Below is a brief explanation on how to install and use those binaries.

    Edit: 2012-06-29 updated links for IDA 6.3/Python 2.7

    Read the rest of this entry “

    2 Comments "

    VirusTotal plugin for IDA Pro

    April 21st, 2011

    In this blog post, we are going to illustrate how to use some of the new UI features introduced in IDA Pro 6.1 (embedded choosers, custom icons, etc…) by writing a VirusTotal reporting and file submission plugin for IDA Pro. The plugin will allow you to get reports from VirusTotal based on the input file MD5 or a file of your choice. The plugin will offer to upload the file if the file was not analyzed before.

    vt_ui_dlg

    Read the rest of this entry “

    5 Comments "

    IDA Pro, Python and Qt

    October 30th, 2010

    IDA Pro 6.0 implements a cross-platform UI with the use of Qt framework. The good thing about it is that plugin writers can also develop cross-platform UI directly with Qt. But what about script writers?

    In this blog post we are going to illustrate how to use PySide to create UI interfaces for IDA Pro using IDAPython.

    ipq_intro

    Read the rest of this entry “

    15 Comments "

    Calculating API hashes with IDA Pro

    October 9th, 2010

    Many times when debugging malware you discover that the malware does not import any function, replaces API names by hashes and tries to resolve the addresses by looking up which API name has the desired hash!

    In this blog post we are going to demonstrate how to use IDA Pro to solve this problem and uncover all API hashes.

    hash_calc

    Read the rest of this entry “

    11 Comments "

    Implementing command completion for IDAPython

    July 19th, 2010

    In this blog post we are going to illustrate how to use the command line interpreter (CLI) interface from Python and how to write a basic command completion functionality for the Python CLI.

    Read the rest of this entry “

    Comments Off

    Running scripts from the command line with idascript

    July 8th, 2010

    In this blog post we are going to demonstrate how the ‘-S’ and ‘-t’ switches (that were introduced in IDA Pro 5.7) can be used to run IDC, Python or other supported scripts from the command line as if they were standlone scripts and how to use the idascript utility

    Read the rest of this entry “

    Comments Off

    IDA Pro 5.7 highlights

    July 2nd, 2010

    We have released a IDA Pro 5.7 few days ago. The complete whatsnew can be found here.
    In this blog post we will highlight some of the major changes and additions of this release.

    Read the rest of this entry “

    Comments Off