The IDA Pro Book,First & Second Edition

The IDA Pro Book,First & Second Edition: The Unofficial Guide to the World’s Most Popular Disassembler

• The biggest news is that IDA is a native 64-bit application! First of all it means that now it can eat all memory of your computer and thrash it :) But jokes aside, switching to 64-bit aligns IDA with other modern software and makes it more compatible with the rest of the world. For example, IDAPython integration will be easier and more streamlined because many operating systems nowadays come with the 64-bit Python preinstalled (32-bit Python won’t work anymore).

• Second, we took this change as an opportunity (since old 32-bit plugins won’t work with 64-bit IDA anyway) to clean up the IDA API, make it more consistent and less confusing. If we failed or succeeded is to be seen, but we ourselves like the new API much more. The fundamental concepts remain the same and IDA did not lose any bit of its functionality during the cleanup. We minutely tested all changes and ensured that all our tests continue to pass as before or better. We also tried to make our 3 APIs: C++, Python, and IDC, to be closer to each other. Function names and their functionality are the same in most cases, but we tried to stay pythonic in Python and C++-ish in the C++ interface. Since the changes are huge and it is easy to lose your way, we prepared a Porting guide from the IDA 4.9-6.x API to the IDA 7.0 API which explains what has changed and how. We hope that it will greatly help you when porting your plugins to the new 7.0 API.

• For Python and IDC we implemented a compatibility layer that will help you with your scripts. Most of them should run fine on 7.0 with very minor or no changes. We plan to turn off the compatibility layer in the next release, so please dedicate some of your time to port your scripts to run without it. See the IDA 7.0: IDAPython backward-compatibility with 6.95 APIs page for more info.

No source code? No problem. With IDA Pro, the interactive disassembler, you live in a source code-optional world. IDA can automatically analyze the millions of opcodes that make up an executable and present you with a disassembly. But at that point, your work is just beginning. With The IDA Pro Book, you’ll learn how to turn that mountain of mnemonics into something you can actually use.

Hailed by the creator of IDA Pro as “profound, comprehensive, and accurate,” the second edition of The IDA Pro Book covers everything from the very first steps to advanced automation techniques. You’ll find complete coverage of IDA’s new Qt-based user interface, as well as increased coverage of the IDA debugger, the Bochs debugger, and IDA scripting (especially using IDAPython). But because humans are still smarter than computers, you’ll even learn how to use IDA’s latest interactive and scriptable interfaces to your advantage.

Save time and effort as you learn to:

• Navigate, comment, and modify disassembly
• Identify known library routines, so you can focus your analysis on other areas of the code
• Use code graphing to quickly make sense of cross references and function calls
• Extend IDA to support new processors and filetypes using the SDK
• Explore popular plug-ins that make writing IDA scripts easier, allow collaborative reverse engineering, and much more
• Use IDA’s built-in debugger to tackle hostile and obfuscated code

Whether you’re analyzing malware, conducting vulnerability research, or reverse engineering software, a mastery of IDA is crucial to your success. Take your skills to the next level with this 2nd edition of The IDA Pro Book.