Two of the new UI highlights in the upcoming IDA release are filtering capability for choosers and shortcut management. I’ll be discussing them in this post, although seeing them live in action is much nicer.
Filters make it possible to either show, hide or highlight one or more categories of items. But enough talk, let’s start with a screenshot.
The new IDA Pro 6.2 release will be featuring a new view called the “proximity browser” (only available in the Qt version).
The proximity view
Last month I visited the Recon conference and had a great time again. I gave a talk on C++ decompilation and how to handle it in IDA and Hex-Rays decompiler. You can get the slides here, and download the recorded talk here.
Edit: for some reason the streaming version does not show anything after the intro, please download the Quicktime version until it’s fixed.
The most frequently asked question we get during the IDA Pro trainings, on the support forum or via support emails is: “When will IDA Pro support the undo feature?” or “How can I undo an operation in IDA Pro”.
Our answer has always been: “Sorry, it is not possible to undo in IDA Pro” or “This feature will eventually be implemented sometime in the future”.
In this blog post, we introduce the new database snapshots feature that will be present in IDA Pro 6.2:
In IDA Pro 6.1 we extended the Bochs debugger plugin to support debugging of 64bit code snippets. With IDA Pro 6.2 it will be possible to debug PE+ executables as well. Since the execution will be emulated inside Bochs, a 64bit operating system is not required and one could be equally running a 32 or 64bit Linux, Mac OS or Windows operating system and still be able to debug 64bit PE files from IDA Pro.
To illustrate this new feature, we are going to unpack and briefly analyze a PE+ trojan that is compressed with MPRESS from MATCODE Software.We will illustrate how to unpack the DLL, recover the import table and cleanup the database to get it ready for analysis.
In a previous blog post we mentioned that it is possible to use IDA Pro with PySide (Python + Qt) after applying some minor code patches to PySide.
For convenience purposes, we precompiled the PySide libraries that work with IDA Pro 6.0+ and Python 2.6/2.7. Below is a brief explanation on how to install and use those binaries.
Edit: 2012-06-29 updated links for IDA 6.3/Python 2.7
In this blog post, we are going to illustrate how to use some of the new UI features introduced in IDA Pro 6.1 (embedded choosers, custom icons, etc…) by writing a VirusTotal reporting and file submission plugin for IDA Pro. The plugin will allow you to get reports from VirusTotal based on the input file MD5 or a file of your choice. The plugin will offer to upload the file if the file was not analyzed before.
We should permanently and prominently publish this ad on our site
We are looking for strong software engineers to join our team and participate in the development of unique software security tools. The candidates must know low-level details of modern software as well as high-level data structures and algorithms.
- strong knowledge of C/C++
- knowledge of the x86 assembler and unwillingness to use it in development
- cross platform development (Windows/Linux/Mac) is a plus
- knowing the graph theory and how compilers work is a plus
- ability and willingness to write secure yet fast code
- good problem solving and communication skills
If you want a challenging job in a friendly environment, please apply by sending your resume to firstname.lastname@example.org
With the upcoming IDA 6.1 it will be possible to create forms which host chooser controls. This feature will be available in the Qt and text version (not so in the VCL one).