IDA Pro is one of the best and most popular reverse engineering software tools. It’s an interactive disassembler that has a built-in command language (IDC) and supports a number of executable formats for various processors and operating systems. IDA Pro also has a great number of plugins that can extend the disassembler’s functionality even further.
The main advantage of IDA Pro is that it allows you to interactively change any element of the displayed data:
Screenshot 1. IDA Pro interface
Aside from the disassembler itself, let’s also look closer at some IDA plugins.
Basically, this plugin loads reports of code coverage tools into the IDA database and marks pieces of code depending on how many times they were executed. This makes it clear which part of the code is worth your attention while browsing the disassembly.
The main advantage of IDA Pro is that it allows you to interactively change any element of the displayed data:
- Give names to functions, variables, data structures, etc.
- Change data representation (as numbers, strings in various encodings, data structures)
- Build diagrams and code flow graphs to simplify the understanding of disassembled code
- Use type information about function arguments and structure definitions from C++ so that arguments and variables are automatically named
- Automatically recognize and name standard library functions in assembler code
- And much more
Screenshot 1. IDA Pro interface
Aside from the disassembler itself, let’s also look closer at some IDA plugins.
Hex-Rays Decompiler
This plugin can turn native processor code into a more readable, C-like version. The Hex-Rays Decompiler produces rather accurate C code comparable to that produced by a human reverse engineer. It correctly decompiles code produced by various C++ compilers, no matter the architecture. However, Hex-Rays Decompiler might have issues with processing complex assembler code, where the original code was specifically modified by adding the inline assembler or some manual optimization was made.Lighthouse
This plugin enables you to mark the execution path within the disassembler. As a result, you can understand which pieces of code are taking part in the execution and if they are involved in some algorithm or feature.Basically, this plugin loads reports of code coverage tools into the IDA database and marks pieces of code depending on how many times they were executed. This makes it clear which part of the code is worth your attention while browsing the disassembly.
