Writing a book about IDA Pro is a challenging task. The fact that it is a complex piece of software with more features than can even be mentioned, let alone detailed in a book of reasonable size, is the least of the difficulties. New releases of IDA also tend to occur frequently enough that any book will almost certainly be one, if not two, versions behind by the time it hits the streets. Including version 5.3, which was released just as the first edition was going to press, seven new versions of IDA have been released since the first edition was published. The release of version 6.0 with a new, Qt-based graphical user interface motivated me to update the book and address many of the features that have been introduced in the interim. Of course, true to form, another version of IDA (6.1) was released late in the process just to make things more exciting.

My goal with this edition remains to help others get started with IDA and perhaps develop an interest in reverse engineering in general. For anyone looking to get into the reverse engineering field, I can’t stress how important it is that you develop competent programming skills. Ideally, you should love code, perhaps going so far as to eat, sleep, and breathe code. If programming intimidates you, then reverse engineering is probably not for you. It is possible to argue that reverse engineering requires no programming at all because all you are doing is taking apart someone else’s program; however, without committing to developing scripts and plug-ins to help automate your work, you will never become a truly effective reverse engineer. In my case, programming and reverse engineering substitute for the challenge of The New York Times Sunday crossword puzzle, so it is rarely tedious.

For continuity purposes, this edition preserves the overall structure of the first edition while elaborating and adding material where appropriate. There are a number of ways to read this book. Users with little reverse engineering background may wish to begin with Chapter 1 and Chapter 2 for some background information on reverse engineering and disassemblers. Users without much IDA experience who are looking to dive right in can begin with Chapter 3, which discusses the basic layout of an IDA installation, while Chapter 4 covers what goes on when you launch IDA and load a file for analysis. Chapter 5 through Chapter 7 discuss IDA’s user interface features and basic capabilities.

Readers possessing some familiarity with IDA may wish to begin with Chapter 8, which discusses how to use IDA to deal with complex data structures, including C++ classes. Chapter 9, in turn, covers IDA cross-references, which are the foundation for IDA’s graph-based displays (also covered in Chapter 9). Chapter 10 provides a bit of a diversion useful for readers interested in running IDA on non-Windows platforms (Linux or OS X).

More advanced IDA users may find Chapter 11 through Chapter 14 a good place to start, because they cover some of the fringe uses of IDA and its companion tools. A brief run-through of some of IDA’s configuration options is presented in Chapter 11. Chapter 12 covers IDA’s FLIRT/FLAIR technology and related tools that are used to develop and utilize signatures to distinguish library code from application code. Chapter 13 offers some insight into IDA type libraries and ways to extend them, while Chapter 14 addresses the much-asked question of whether IDA can be used to patch binary files.

IDA is a quite capable tool right out of the box; however, one of its greatest strengths is its extensibility, which users have taken advantage of to make IDA do some very interesting things over the years. IDA’s extensibility features are covered in Chapter 15 through Chapter 19, which begin with coverage of IDA’s scripting features, including increased coverage of IDAPython, and follow with a systematic walk through IDA’s programming API, as provided by its software development kit (SDK). Chapter 16 provides an overview of the SDK, while Chapter 17 through Chapter 19 walk you through plug-ins, file loaders, and processor modules.

With the bulk of IDA’s capabilities covered, Chapter 20 through Chapter 23 turn to more practical uses of IDA for reverse engineering by examining how compilers differ (Chapter 20); how IDA may be used to analyze obfuscated code, as is often encountered when analyzing malware (Chapter 21); and how IDA may be used in the vulnerability discovery and analysis process (Chapter 22). Chapter 23 concludes the section by presenting some useful IDA extensions (plug-ins) that have been published over the years.

The book concludes with expanded coverage of IDA’s built-in debugger in Chapter 24 through Chapter 26. Chapter 24 begins by introducing the basic features of the debugger. Chapter 25 discusses some of the challenges of using the debugger to examine obfuscated code, including the challenge of dealing with any anti-debugging feature that may be present. Chapter 26 concludes the book with a discussion of IDA’s remote debugging capabilities and the use of the Bochs emulator as an integrated debugging platform.

At the time of this writing, IDA version 6.1 was the most current version available, and the book is written largely from a 6.1 perspective. Hex-Rays is generous enough to make an older version of IDA available for free; the freeware version of IDA is a reduced-functionality version of IDA 5.0. While many of the IDA features discussed in the book apply to the freeware version as well, Appendix A provides a brief rundown of some of the differences a user of the freeware version can expect to encounter.

Finally, since it is a somewhat natural progression to begin with IDA scripting and move on to creating compiled plug-ins, Appendix B provides a complete mapping of every IDC function to its corresponding SDK counterparts. In some cases you will find a one-to-one correspondence between an IDC function and an SDK function (though in all cases the names of those functions are different); in other cases, you will find that several SDK function calls are required to implement a single IDC function. The intent of Appendix B is to answer questions along the lines of “I know how to do X in IDC, how can I do X with a plug-in?” The information in Appendix B was obtained by reverse engineering the IDA kernel, which is perfectly legal under IDA’s atypical licensing agreement.

Throughout the book, I have tried to avoid long sequences of code in favor of short sequences that demonstrate specific points. The vast majority of sample code, along with many of the binary files used to generate examples, is available on the book’s official website, http://www.idabook.com/, where you will also find additional examples not included in the book as well as a comprehensive list of references used throughout the book (such as live links to all URLs referred in footnotes).