Reverse Engineering Code with IDA Pro (eBook)

IOActive (Autor)

eBook Download: PDF

2011 | 1. Auflage
328 Seiten
Elsevier Science (Verlag)
978-0-08-055879-0 (ISBN)

Infos

If you want to master the art and science of reverse engineering code with IDA Pro for security R&D or software debugging, this is the book for you. Highly organized and sophisticated criminal entities are constantly developing more complex, obfuscated, and armored viruses, worms, Trojans, and botnets. IDA Pro's interactive interface and programmable development language provide you with complete control over code disassembly and debugging. This is the only book which focuses exclusively on the world's most powerful and popular took for reverse engineering code. - Reverse Engineer REAL Hostile Code To follow along with this chapter, you must download a file called !DANGER!INFECTEDMALWARE!DANGER!... 'nuff said - Portable Executable (PE) and Executable and Linking Formats (ELF) Understand the physical layout of PE and ELF files, and analyze the components that are essential to reverse engineering - Break Hostile Code Armor and Write your own Exploits Understand execution flow, trace functions, recover hard coded passwords, find vulnerable functions, backtrace execution, and craft a buffer overflow - Master Debugging Debug in IDA Pro, use a debugger while reverse engineering, perform heap and stack access modification, and use other debuggers - Stop Anti-Reversing Anti-reversing, like reverse engineering or coding in assembly, is an art form. The trick of course is to try to stop the person reversing the application. Find out how! - Track a Protocol through a Binary and Recover its Message Structure Trace execution flow from a read event, determine the structure of a protocol, determine if the protocol has any undocumented messages, and use IDA Pro to determine the functions that process a particular message - Develop IDA Scripts and Plug-ins Learn the basics of IDA scripting and syntax, and write IDC scripts and plug-ins to automate even the most complex tasks

Inhalt

Front Cover 1
Reverse Engineering Code with IDA Pro 4
Copyright Page 5
About IO Active 6
Contributing Authors 8
Contents 10
Chapter 1: Introduction 14
An Overview of Code Debuggers 15
Summary 18
Chapter 2: Assembly and Reverse Engineering Basics 20
Introduction 21
Assembly and the IA-32 Processor 21
The Stack, the Heap and Other Sections of a Binary Executable 32
IA-32 Instruction Set Refresher and Reference 37
Summary 48
Chapter 3: Portable Executable and Executable and Linking Formats 50
Introduction 51
Portable Executable Format 51
Executable and Linking Format 63
Summary 79
Chapter 4: Walkthroughs One and Two 80
Introduction 81
Following Execution Flow 81
Solutions Fast Track 97
Frequently Asked Questions 98
Chapter 5: Debugging 100
Introduction 101
Debugging Basics 101
Debugging in IDA Pro 105
Use of Debugging while Reverse Engineering 107
Heap and Stack Access and Modification 115
Other Debuggers 117
Summary 120
Chapter 6: Anti-Reversing 122
Introduction 123
Debugging 123
Example Overview 127
Obfuscation 129
Summary 149
Chapter 7: Walkthrough Four 150
The Protocol Problem 151
Protocol Structure 151
Chapter 8: Advanced Walkthrough 178
Introduction 179
Reversing Malware 180
Chapter 9: IDA Scripting and Plug-ins 212
Introduction 213
Basics of IDA Scripting 213
IDC Syntax 214
Simple Script Examples 222
Writing IDC Scripts 226
Basics of IDA Plug-ins 240
Plug-in Syntax 244
Setting up the Development Environment 245
Simple Plug-in Examples 247
The Indirect Call Plug-in 269
Plug-in Development and Debugging Strategies 314
Loaders 320
Processor Modules 321
Third-party Scripting Plug-ins 321
Frequently Asked Questions 323
Index 324

Produkt-Details

• Erscheint lt. Verlag: 18.4.2011
• Sprache: englisch
• Themenwelt: Informatik ► Netzwerke ► Sicherheit / Firewall
• Themenwelt: Mathematik / Informatik ► Informatik ► Programmiersprachen / -werkzeuge
• Themenwelt: Informatik ► Software Entwicklung ► User Interfaces (HCI)
• Themenwelt: Mathematik / Informatik ► Informatik ► Theorie / Studium
• Themenwelt: Mathematik / Informatik ► Mathematik
• Themenwelt: Naturwissenschaften
• Themenwelt: Wirtschaft ► Betriebswirtschaft / Management
• ISBN-10: 0-08-055879-8 / 0080558798
• ISBN-13: 978-0-08-055879-0 / 9780080558790