Slashdot Mirror
The IDA Pro Book
An anonymous reader writes "After attending DEFCON in August and seeing the overwhelming interest in this book, I was eager to dive into The IDA Pro Book by Chris Eagle. Chris Eagle's team, School of Root, won the 'Capture the Flag' event at DEFCON this year and Chris gave a presentation on CollabREate, a tool that integrates with IDA Pro to allow collaboration in reverse engineering (RE). All of that — together with the fact that the book sold out — screamed that this book should quickly make it to the top of my list." This review originally appeared on The Ethical Hacker Network.
The IDA Pro Book
author
Chris Eagle
pages
640
publisher
No Starch Press
rating
9/10
reviewer
Ryan Linn
ISBN
1593271786
summary
An information-packed guide to IDA
Once I had the book in-hand, the cover alone offered some insight into what was to come. The quote on the front of the book is an endorsement from the creator of IDA Pro. The image on the front is a throwback to the Operation game by Milton Bradley, which reminds me of how I felt when I got started doing reverse engineering. I am not a professional Reverse Engineer or Malware Analyst; however, my coding background and my current position as a security professional at SAS affords the opportunity to dabble. This puts me in the perfect middle ground of being able to understand the material as well as assess its ability to teach.
The IDA Pro Book is broken up into a number of different "Parts" each having several chapters and its own goal. Even if the content appears to be beyond your level of knowledge in a certain area, I highly recommend that you keep reading. It may also be handy to point out the fact that the book is 640 pages. So this lends itself to being more of a reference guide than a book read straight through from cover to cover.
I should also mention at this point that the book is about the 5.X tree of IDA Pro, and not the freeware version. There is a demo that you can download off of the IDA Pro Website if you aren't able to purchase the full version right away. In addition, there is a reference at the back discussing how the freeware version differs from the commercial version, so as long as you are ok with those restrictions while you are learning, this book still should be very handy.
One of the most important sections of Chris' book is found in "Introduction to IDA." The author discusses disassembly and the challenges that go with it, the tools involved with reverse engineering and disassembly, and a general breakdown of how these tools approach the binaries that they are analyzing. He also references other tools that are handy alongside IDA Pro, and outlines how they fit into the reverse engineering process. Finally information about IDA Pro licensing and installation is discussed, and the base information that you will need for the rest of your IDA Pro adventure is laid out.
Once the basics of RE have been covered, the author addresses the fundamentals of using IDA Pro. Unlike some other books, this book does a great job of letting you know where you should be looking when it lays out a block of assembly code. The references are well laid out as well. "Part II: Basic IDA Usage" progresses logically and eases you into the interface. It does a great job helping you figure out what all the new windows are doing, and how to get to the information that IDA Pro is providing. The content moves from basic skills such as finding the disassembly into manipulating the disassembly to be more meaningful then to optimizing the disassembly process. It shows you how to navigate the code, and how to incorporate other knowledge that you have about the binary you are disassembling, such as what headers or what libraries might have been used in order to obtain the most useful disassembly possible and facilitate the disassembly of the binary.
"Part III: Advanced IDA Usage" gets deeper into using IDA Pro, including utilizing the Fast Library Identification and Recognition Technology (FLIRT) signatures and custom files in order to suck the most information possible out of a binary before analysis. You also get a glimpse into how to modify the pieces of the application which can be modified only through config files. It concludes by explaining the patch capabilities of IDA Pro and discussing what the limitations and expectations should be. This Part provides insight into creating your own signatures for custom libraries that might not be available in IDA Pro, so, as you start working on real life applications, you can tailor IDA Pro to be able to recognize libraries that you frequently encounter.
After the basics of using the application have been covered, the author explains how to extend the capabilities of IDA Pro in Parts III and IV. He discusses in depth the scripting engine and how to build plug-ins and modules. Throughout this Part numerous examples are given of how the scripting and plug-ins fit into the application. Short detailed examples are used to illustrate how to accomplish some tasks that would be useful for a reverse engineer including listing out function information. The beginning of the chapter was great. As a beginning Reverse Engineer, I was able to clearly see how this information would apply. For the stuff that was beyond my current knowledge level, it was easy to see that as my knowledge progresses in the future, I would be back to re-visit this information.
Throughout the entire fifth Part are goodies focusing on the real-world applications of IDA Pro. It goes into the different types of binaries that you might encounter while doing reverse engineering. This chapter also goes into two large areas where IDA Pro is used such as obfuscated code analysis and vulnerability analysis. After reading this Part, you should have some handy scripts and a series of applications and plug-ins to aid in your RE adventures. The author discusses a number of those plug-ins in-depth including adding in bindings for Python and Ruby. At the end of this chapter, I hadn't learned an incredible amount more about IDA Pro; however I definitely knew more about how to approach the problems I might encounter and how to extend IDA Pro's capabilities in order to tackle real world tasks.
The final Part of the book is on the IDA Debugger. The debugging features of IDA Pro were an afterthought and aren't the primary focus of IDA Pro. Chris Eagle goes into what to expect from the debugger, how it's used, and then finally how to integrate the information obtained from the debugger into the overall RE process. He concludes with a discussion of how to automate debugging tasks with scripts and plug-ins and discusses some of the real-world problems that people might encounter, such as dealing with UPX packing that has been modified. This chapter also goes into remote debugging, where you can be running a binary on one machine and having it come back to a GUI on another. Knowing this information is especially useful if you are doing analysis across multiple platforms. The Windows GUI is the only non-console GUI in the IDA Pro supported platforms.
Chris Eagle's The IDA Pro Book provides a significantly better understanding not of just IDA Pro itself, but of the entire RE process. There are little gems littered throughout the book that bring in real-life experience and knowledge that you don't always get from other books instructing you in the use of an application. Although it is impossible to absorb everything in this book due to its size, it helped greatly in overcoming some of the initial hurdles of understanding a highly technical topic. As I continue down my reverse engineering path, I'm confident that I will use this book repeatedly as a reference.
If you are interested in getting deep into the assembly and figuring out what applications are doing when you don't have the source, then I would highly recommend this book to get you started with IDA Pro; it won't turn you into a reverse engineering expert, but it certainly will provide you with a major tool that will help you along the way.
You can purchase The IDA Pro Book from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
The IDA Pro Book is broken up into a number of different "Parts" each having several chapters and its own goal. Even if the content appears to be beyond your level of knowledge in a certain area, I highly recommend that you keep reading. It may also be handy to point out the fact that the book is 640 pages. So this lends itself to being more of a reference guide than a book read straight through from cover to cover.
I should also mention at this point that the book is about the 5.X tree of IDA Pro, and not the freeware version. There is a demo that you can download off of the IDA Pro Website if you aren't able to purchase the full version right away. In addition, there is a reference at the back discussing how the freeware version differs from the commercial version, so as long as you are ok with those restrictions while you are learning, this book still should be very handy.
One of the most important sections of Chris' book is found in "Introduction to IDA." The author discusses disassembly and the challenges that go with it, the tools involved with reverse engineering and disassembly, and a general breakdown of how these tools approach the binaries that they are analyzing. He also references other tools that are handy alongside IDA Pro, and outlines how they fit into the reverse engineering process. Finally information about IDA Pro licensing and installation is discussed, and the base information that you will need for the rest of your IDA Pro adventure is laid out.
Once the basics of RE have been covered, the author addresses the fundamentals of using IDA Pro. Unlike some other books, this book does a great job of letting you know where you should be looking when it lays out a block of assembly code. The references are well laid out as well. "Part II: Basic IDA Usage" progresses logically and eases you into the interface. It does a great job helping you figure out what all the new windows are doing, and how to get to the information that IDA Pro is providing. The content moves from basic skills such as finding the disassembly into manipulating the disassembly to be more meaningful then to optimizing the disassembly process. It shows you how to navigate the code, and how to incorporate other knowledge that you have about the binary you are disassembling, such as what headers or what libraries might have been used in order to obtain the most useful disassembly possible and facilitate the disassembly of the binary.
"Part III: Advanced IDA Usage" gets deeper into using IDA Pro, including utilizing the Fast Library Identification and Recognition Technology (FLIRT) signatures and custom files in order to suck the most information possible out of a binary before analysis. You also get a glimpse into how to modify the pieces of the application which can be modified only through config files. It concludes by explaining the patch capabilities of IDA Pro and discussing what the limitations and expectations should be. This Part provides insight into creating your own signatures for custom libraries that might not be available in IDA Pro, so, as you start working on real life applications, you can tailor IDA Pro to be able to recognize libraries that you frequently encounter.
After the basics of using the application have been covered, the author explains how to extend the capabilities of IDA Pro in Parts III and IV. He discusses in depth the scripting engine and how to build plug-ins and modules. Throughout this Part numerous examples are given of how the scripting and plug-ins fit into the application. Short detailed examples are used to illustrate how to accomplish some tasks that would be useful for a reverse engineer including listing out function information. The beginning of the chapter was great. As a beginning Reverse Engineer, I was able to clearly see how this information would apply. For the stuff that was beyond my current knowledge level, it was easy to see that as my knowledge progresses in the future, I would be back to re-visit this information.
Throughout the entire fifth Part are goodies focusing on the real-world applications of IDA Pro. It goes into the different types of binaries that you might encounter while doing reverse engineering. This chapter also goes into two large areas where IDA Pro is used such as obfuscated code analysis and vulnerability analysis. After reading this Part, you should have some handy scripts and a series of applications and plug-ins to aid in your RE adventures. The author discusses a number of those plug-ins in-depth including adding in bindings for Python and Ruby. At the end of this chapter, I hadn't learned an incredible amount more about IDA Pro; however I definitely knew more about how to approach the problems I might encounter and how to extend IDA Pro's capabilities in order to tackle real world tasks.
The final Part of the book is on the IDA Debugger. The debugging features of IDA Pro were an afterthought and aren't the primary focus of IDA Pro. Chris Eagle goes into what to expect from the debugger, how it's used, and then finally how to integrate the information obtained from the debugger into the overall RE process. He concludes with a discussion of how to automate debugging tasks with scripts and plug-ins and discusses some of the real-world problems that people might encounter, such as dealing with UPX packing that has been modified. This chapter also goes into remote debugging, where you can be running a binary on one machine and having it come back to a GUI on another. Knowing this information is especially useful if you are doing analysis across multiple platforms. The Windows GUI is the only non-console GUI in the IDA Pro supported platforms.
Chris Eagle's The IDA Pro Book provides a significantly better understanding not of just IDA Pro itself, but of the entire RE process. There are little gems littered throughout the book that bring in real-life experience and knowledge that you don't always get from other books instructing you in the use of an application. Although it is impossible to absorb everything in this book due to its size, it helped greatly in overcoming some of the initial hurdles of understanding a highly technical topic. As I continue down my reverse engineering path, I'm confident that I will use this book repeatedly as a reference.
If you are interested in getting deep into the assembly and figuring out what applications are doing when you don't have the source, then I would highly recommend this book to get you started with IDA Pro; it won't turn you into a reverse engineering expert, but it certainly will provide you with a major tool that will help you along the way.
You can purchase The IDA Pro Book from amazon.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
But my binding did break after a week.
I can never get Tator Tots(tm) right.
Will this b00k teach me to cr4ck Call of Duty 4?
Just disrupt the deflector shield with a tachyon burst.
Since the review doesn't really make it clear, IDA is a dissassembler. It allows you to take an executable for which you don't have source and construct a (generally partial) representation of what a program that would have produced that executable would look like. It can't of course give you back the actual source code (comments, variable names, etc. being lost forever) but it gives you a much, much better idea of what's going on than a hex dump would.
--MarkusQ
It sure would be nice if "IDA" were defined somewhere in the lead blurb. It would have been almost as nice if it were defined anywhere in the full review text. Wikipedia says IDA can stand for many things. It's likely that the book is about the Interactive Disassembler, but I may be wrong.
Coffee is my drug of choice.
Originally posted here: http://www.ethicalhacker.net/content/view/210/2/
Lights in the parlor, fires in the grate,
Clock on the mantle says it's a'gettin' late,
Curtains on the window, snowy white,
The parlor's pleasant on Sunday night.
Chorus:
Ida Red, Ida Red, I'm a plumb fool 'bout Ida Red,
Lamp on the table, picture on the wall,
There's a pretty sofa and that's not all,
If I'm not mistaken and I'm sure I'm right,
They's somebody else in the parlor tonight.
Repeat chorus:
Chicken in the bread pan peckin' out dough,
Granny will-ya dog bite, no chile no,
Hurry up boys and don't fool around,
Grab your partner and truck on down.
Repeat chorus:
My Ol' Missus swore to me,
When she died she'd set me free,
She lived so long her head got bald,
She took a notion not to die at all.
Repeat chorus:
Light's a'burnin' dim, fires a'gettin' low,
Somebody says it's time to go,
I hear the whisper, gentle and light,
Don't forget to come next Sunday night.
Repeat chorus:
Ubiquitously - A Ubiquity Developer Community
This is nice educated review of the book. There are a lot of guide books out there that over complicate instruction and this appears to focus on both new and experienced users.
should be enough for anyone.
This is the only good book on IDA there is. There are several other books on RE that bring up IDA, but never dives in to any interesting details. That includes the book "Reverse Engineering Code with IDA Pro" which does a passable job of introducing you to RE, but doesn't tell you much about IDA that you couldn't get from spending an evening with it just experimenting.
So, to anyone interested in IDA: This is the book you should buy. Now. With express delivery.
*laugh* I think what's really going on is that I bounce between levels so much that I don't really honor the distinction. Asm, HLA, LLL, HLA, scripting languages, TILs, SPILs, DSLs, it all kind of blurs together if you step away from it just a short distance. Not that I don't see such distinctions, just that I don't always see them in the traditional places. For instance, I see a much bigger divide between pairs like Haskel v. C or SQL v. prolog than I do between C and Assembly.
But yes, I see your point, for people who aren't comfortable reading Assembly and expect it to give them C++ or something the distinction would be important. Effectively, the choice of source language is one of the things that gets lost along with procedure names, module structure, and the like. You may be able to infer it but IDA isn't going to hand it to you and there is no certainty you'll be correct.
--MarkusQ
Who has a crack for ida? The full version! Anyone got a pdf of the book yet? With TOC, index. All code in binary form. Come on! Chop! Chop! I'm waiting here!
I'm weening myself off an addiction to esoteric info in compsci to deepen a few areas. This would be great to learn how things work, but what are you going to build with it? I'm not so keen on learning for its sake these days. What is the reader going to build? I think just taking the work of others and stealing it to sell it is a bit feeble. Is there a constructive use here beyond knowledge for knowledge's sake?
"An anonymous reader writes "
[...]
"Read below for the rest of Ryan's review. "
Slightly disreputable, albeit gregarious
Sounds good, except that the cost of IDA Pro puts me off. I think I'll stick with OllyDbg; now what that needs is a "how to" book!
My web domain.
meh, objdump -dCS, nm -C, readelf and binutils in general get the job done for me more often than not, and across various CPU architectures. fyr free.
http://validator.w3.org/check?uri=http%3A%2F%2Fwww.slashdot.org Errors found while checking this document as HTML5!
While browsing IDA Pro product
pages at http://www.hex-rays.com/idapro/idadown.htm
I noticed that there are downloads for two libraries that IDA seems to use:
Linux TVision port for the IDA Interface - source code (updated 20/11/2007)
This download is password protected, but seems it is a copy of
Linux TVision - http://tvision.sourceforge.net/ which is under GPL.
Another and more obvious their problem is:
Wingraph v 1.03: source code the Wingraph we use and modified (GPL).
(updated 25/08/2004)
Which is available for actual downloading and is nothing more than VCG library
A Visualization Tool for compiler graphs
Copyright (C) 1993--1995 by Iris Lemke, Georg Sander, and the Compare Consortium
Which is distributed under GPL v2
The sources also contain the following text:
* WinGraph32 - Graph Visualization Program
* Version 1.0
* The WIN32 interface written by Ilfak Guilfanov. (ig@datarescue.com)
*
* This program is under GPL (GNU General Public License)
* It is based on the VCG tool written by Georg Sander and Iris Lemke
Seems that IDA author (Ilfak Guilfanov) does not understand GPL terms.
I notified all related parties, as well as gpl-violations.org on March 21, 2008.
But nothing happened.
The only reply I got was from Linux TVision author, where he says IDA seem to use modified GPL code.
I used to use IDAPro a lot -- but then they went to the new pricing model which increased the cost dramatically. So while it is a great product it really isn't affordable for people that don't have a corporate expense account.
Invalid Checksum. Retrying.
Seriously, for god's sake, who needs a book to use a disassembler?
Why does this have an Idaho tag?
Defective Logic
This is a well-distributed application (v5.3) on bittorrent. And you wonder which disassembler they used to fix it hehe :-P I've used it myself and it's amazing how many different processors are supported and the plugins that are made for them. A few I know of are the C decompiler plugin and the BinDiff plugin (helpful if you are interested in finding the main changes between an original and cracked app.) But of course you have to have enough free cash to buy the product and plugins because no one here would ever cheat or steal, right?
Why would you need to purchase a guide?
I bet most of the valuable info in this book could be found on the internet for free (as in beer).
Since there is obviously some collaboration between the book and software authors, maybe they should give the book away as a bonus to those who purchase the full version.
It comes with a help file which describes some of its API functions for scripting and describes some of its windows. What is in this book is not just a top to bottom overview of a very complex application but extensive documentation on areas such as plugin development and internal data structures which absolutely are not documented anywhere. even on the series of tubes we call the internet. The book is also focused towards how to actually accomplish real world tasks with the program, which you would never find in a regular manual.
FWIW, I am a professional reverse engineer and have been using IDA for many years and I can easily say this book is very useful and is very well done to boot.
Nearly half of all people are below average
In fact, it is the disassembler of choice for groups like "myg0t" to crack a game client.
For example, there was a certain sports game that has client-sided speed hack detection. Within a few days it was cracked by the myg0t people, and they claim that they used IDA Pro.
Young man in NYC, fresh from BYU, asks the girl on the corner if she's been to Idaho. She looks up, in a crack whore sort of way, and says, "Yeah!, I'da'ho".