DataRescue - IDA Pro 3.8x Quick Start Guide

DataRescue

This book was produced in EPUB format by the Internet Archive.

The book pages were scanned and converted to EPUB format automatically. This process relies on optical character recognition, and is somewhat susceptible to errors. The book may not offer the correct reading sequence, and there may be weird characters, non-words, and incorrect guesses at structure. Some page numbers and headers or footers may remain from the scanned page. The process which identifies images might have found stray marks on the page which are not actually images from the book. The hidden page numbering which may be available to your ereader corresponds to the numbered pages in the print edition, but is not an exact match; page numbers will increment at the same rate as the corresponding print edition, but we may have started numbering before the print book's visible page numbers. The Internet Archive is working to improve the scanning process and resulting books, but in the meantime, we hope that this book will be useful to you.

The Internet Archive was founded in 1996 to build an Internet library and to promote universal access to all knowledge. The Archive's purposes include offering permanent access for researchers, historians, scholars, people with disabilities, and the general public to historical collections that exist in digital format. The Internet Archive includes texts, audio, moving images, and software as well as archived web pages, and provides specialized services for information access for the blind and other persons with disabilities.

Created with abbyy2epub (v.1.7.2)

Data Rescue sa/nv 45 quai de la Derivation 4020 Liege, Belgium tel : +32-4-3446510 fax : +32-4-3446514 www.datarescue.com/ida.htm

IDA Pro and its manual are proprietary copyrighted material and no part of either may be reproduced, transmitted, stored or translated without the express prior written permission

of DataRescue sa/nv

The software described in this manual is provided by DataRescue sa/nv under a DataRescue license agreement. It can be used only in accordance with the terms of this agreement.

Information in this manual may change without notice and does not represent a commitment on the part of DataRescue sa/nv.

IBM, PC, AT, XT, OS/2 and Warp are registered trademarks of International Business Machines Corporation.

386, Pentium, Pentium Pro are registered trademarks of Intel Corporation

Windows, Windows 95, Windows 98, Windows NT, MS-DOS are trademarks of Microsoft Corporation Netware is a registered trademark of Novell Corporation.

Other trademarks are registered trademarks of their respective companies.

IDA

cost

avai

ftp.

3.5"

Pro incorporates compression code by the Info-ZIP group. There are no extra charges or s due to the use of this code, and the original compression sources are freely lable from CompuServe in the IBMPRO forum and by anonymous ftp from the Internet site uu. net :/pub/archiving/zip. We will also, upon request, mail you the full sources on a MSDOS-format diskette for the cost of mailing.

Summer 1999, rev 3.8x 1996-99 DataRescue sa/nv Proudly Made in Europe

DataRescue sa/nv 45 Quai de la Derivation 4020 Liege Belgium

+32-4-3446510 (tel)

+32-4-3446514 (fax)

First of all, we would like to thank you for purchasing or considering the purchase of IDA Pro. If you decide to buy IDA Pro, let us stress that we don't see this as an end, but rather as the beginning of a relationship : our goal is not only to offer timely technical support but also to respond to your future needs. That is why your feedback is so valuable to us : please fell free to contact us; IDA Pro's users have made it what it is now.

Based on your feedback, we continue to improve IDA Pro. Be sure to regularly check our web pages for enhancements, corrections and new releases. All IDA Pro customers are entitled to free updates over the Internet for one year.

Writing a manual for IDA Pro is probably an impossible task: disassembler users are highly skilled specialists, IDA itself is hard to use, counterintuitive at times and, difficult to master. In addition, IDA Pro is so versatile that what applies to Java class disassemblies hardly matters for segmented 80x86 architectures and vice-versa. No matter how hard we try, the perfect manual is out of our reach. It is unlikely that we will ever be able to cover all your questions in advance but we are here to help you. Therefore, this startup guide does not aim to be an exhaustive introduction to IDA Pro. Rather, our hope is that it will expose the general philosophy behind its operation and help you get a faster start with IDA Pro.

Ilfak Guilfanov, Main Developer Pierre Vandevenne, Manager

#ifdef MSDOS

SCREEN_MODE = 0 // Screen mode to use

// 0 - don't change screen mode // DOS: AL for INT 10

#else

SCREEN_MODE = 0x8040 // Screen mode to use

// high byte/cols, low byte/rows //

i.e. 0x5020 is 80cols, 32rows

When IDA Pro loads a binary image, it will try to determine the format of the image and the processor that was targeted. If it cannot automatically make this determination, you will see the following dialog

File name: D:\IDA38VREGEXP. inary file

oading segment! Loading ffset!

0x1000

0x0

[X] reate segments OK Cancel

III! < in paragraphs >

i|

FI fir Hell

You can then select the appropriate processor for your project. Some of the processors we support need to be specified explicitly, for example if you want to force the endianness (ARM) or use specific processor extensions such as MMX or 3D-Now, you will have to select them manually.

ARM processors ARM processors ARM processors DEC series Hitachi SH3 Intel 196 series Intel 51 series Intel 51 series Intel 51 series Intel 51 series Intel 51 series Intel 80x86 processors Intel 80x86 processors Intel 80x86 processors Intel 80x86 processors

Intel 80x86 processors Intel 80x86 processors Intel 80x86 processors Intel 80x86 processors