Jump to content

Interactive Disassembler: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous edit
Content deleted Content added
VisualWikitext
Citation bot (talk | contribs)
Bots
5,421,295 edits
Removed parameters. | Use this bot. Report bugs. | #UCB_CommandLine
 
(248 intermediate revisions by more than 100 users not shown)
Line 1: Line 1:
{{short description|Software reverse engineering tool}}
The '''Interactive Disassembler''', more commonly known as simply '''IDA''', is a commercial [[disassembler]] widely used for [[reverse engineering]]. It supports a variety of [[executable|executable format]]s for different [[central processing unit|processor]]s and [[operating system]]s. It also can be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables.
{{multiple issues|
{{more footnotes needed|date=September 2013}}
{{third-party|date=September 2013}}
}}


{{Infobox software
Although IDA performs a large degree of automatic code analysis to a certain extent, leveraging cross-references between code sections, knowledge of parameters of [[Application programming interface|API]] calls, and other information, it is focused on being interactive. A typical IDA user will begin with an automatically generated disassembly listing and then rename, annotate, or otherwise add information to the listing, until it becomes clear what it does, creating an effective reverse-engineering.
| name = Interactive Disassembler
| logo =
| screenshot = Mme de Maintenon.jpg
| caption = Portrait of [[Françoise d'Aubigné]], whose image is used as the IDA logo
| collapsible =
| author = [[Ilfak Guilfanov]]
| developer = Hex-Rays
| released = {{Start date and age|1991|05|21}}<ref>{{Cite web |last=Czokow |first=Geoffrey |date=2021-05-20 |title=IDA: celebrating 30 years of binary analysis innovation |url=https://hex-rays.com/blog/ida-celebrating-30-years-of-binary-analysis-innovation/ |access-date=2023-03-19 |website=Hex-Rays |language=en}}</ref>
| latest release version = 9.0sp1<ref>{{Cite web |url=https://docs.hex-rays.com/release-notes/9_0sp1 |title=IDA 9.0sp1 |access-date=Dec 20, 2024 }}</ref>
| latest release date = {{Start date and age|2024|12|19}}
| latest preview version =
| latest preview date =
| programming language = [[C++]]<ref>{{Cite web |url=http://www.hex-rays.com/ |title=Hex-rays Home |access-date=2008-03-31 |archive-date=2024-05-26 |archive-url=https://web.archive.org/web/20240526003338/https://hex-rays.com/ |url-status=live }}</ref>
| operating system = [[Microsoft Windows]], [[Mac OS X]], and [[Linux]]
| platform =
| size =
| language = [[English language|English]], [[Russian language|Russian]]
| genre = [[Disassembler]], [[Decompiler]]
| license = Proprietary
| website = {{URL|https://hex-rays.com/ida-pro/}}
}}
The '''Interactive Disassembler''' ('''IDA''') is a [[disassembler]] for [[software|computer software]] which generates [[assembly language]] [[source code]] from [[Machine code|machine-executable code]]. It supports a variety of [[executable|executable format]]s for different [[Central processing unit|processor]]s and [[operating system]]s. It can also be used as a [[debugger]] for [[Portable Executable|Windows PE]], [[Mac&nbsp;OS&nbsp;X]] [[Mach-O]], and [[Linux]] [[Executable and Linkable Format|ELF]] executables. A [[decompiler]] plug-in, which generates a high level, [[C (programming language)|C]] source code-like representation of the analysed program, is available at extra cost.<ref>{{Cite book |last=Eagle |first=Chris |url=https://www.worldcat.org/oclc/830164382 |title=The IDA Pro Book : the Unoffical Guide to the World's Most Popular Disassembler. |date=2011 |publisher=No Starch Press |isbn=978-1-59327-395-8 |edition=2nd |location=San Francisco |pages=500–502 |chapter=Chapter 23: Real-World IDA Plug-ins |oclc=830164382}}</ref><ref>{{Cite web |title=Hex-Rays Decompiler |url=https://hex-rays.com/decompiler/ |access-date=2023-03-18 |website=hex-rays.com}}</ref>


IDA is used widely in software [[reverse engineering]], including for [[malware analysis]]<ref>{{Cite web |last=Staff |first=S. C. |date=2017-09-11 |title=Hex-Rays IDA Pro |url=https://www.scmagazine.com/product-test/content/hex-rays-ida-pro |access-date=2023-03-13 |website=SC Media |language=en}}</ref><ref>{{Cite book |last=Sikorski |first=Michael |url=https://www.worldcat.org/oclc/830164262 |title=Practical Malware Analysis : a Hands-On Guide to Dissecting Malicious Software. |date=2012 |publisher=No Starch Press |others=Andrew Honig |isbn=978-1-59327-430-6 |location=San Francisco |chapter=Chapter 5. IDA Pro |oclc=830164262}}</ref> and [[Vulnerability (computing)|software vulnerability]] research.<ref>{{Cite book |last1=Shoshitaishvili |first1=Yan |last2=Wang |first2=Ruoyu |last3=Salls |first3=Christopher |last4=Stephens |first4=Nick |last5=Polino |first5=Mario |last6=Dutcher |first6=Andrew |last7=Grosen |first7=John |last8=Feng |first8=Siji |last9=Hauser |first9=Christophe |last10=Kruegel |first10=Christopher |last11=Vigna |first11=Giovanni |chapter=SOK: (State of) the Art of War: Offensive Techniques in Binary Analysis |date=2016-05-22 |title=2016 IEEE Symposium on Security and Privacy (SP) |chapter-url=https://ieeexplore.ieee.org/document/7546500 |pages=138–157 |doi=10.1109/SP.2016.17|hdl=11311/1161277 |isbn=978-1-5090-0824-7 |hdl-access=free }}</ref><ref>{{Cite journal |last1=Guo |first1=Wei |last2=Wei |first2=Qiang |last3=Wu |first3=Qianqiong |last4=Guo |first4=Zhimin |date=2022-04-01 |title=CSChecker : A binary taint-based vulnerability detection method based on static taint analysis |journal=Journal of Physics: Conference Series |volume=2258 |issue=1 |pages=012069 |doi=10.1088/1742-6596/2258/1/012069 |issn=1742-6588|doi-access=free |bibcode=2022JPhCS2258a2069G }}</ref> IDA's decompiler is one of the most popular and widely used decompilation frameworks,<ref name=":02">{{Cite book |title=No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations |url=https://www.ndss-symposium.org/ndss2015/ndss-2015-programme/no-more-gotos-decompilation-using-pattern-independent-control-flow-structuring-and-semantics/ |access-date=2023-03-18 |website=NDSS Symposium |date=2015 |language=en-US |doi=10.14722/ndss.2015.23185 |last1=Yakdan |first1=Khaled |last2=Eschweiler |first2=Sebastian |last3=Gerhards-Padilla |first3=Elmar |last4=Smith |first4=Matthew |isbn=978-1-891562-38-9 }}</ref><ref name=":1">{{Cite journal |last1=Schulte |first1=Eric |last2=Ruchti |first2=Jason |last3=Noonan |first3=Matt |last4=Ciarletta |first4=David |last5=Loginov |first5=Alexey |date=2018 |title=Evolving Exact Decompilation |url=http://dx.doi.org/10.14722/bar.2018.23008 |journal=Proceedings 2018 Workshop on Binary Analysis Research |location=Reston, VA |publisher=Internet Society |doi=10.14722/bar.2018.23008|isbn=978-1-891562-50-1 }}</ref><ref name=":2">{{Cite book |last1=Liu |first1=Zhibo |last2=Wang |first2=Shuai |chapter=How far we have come: Testing decompilation correctness of C decompilers |date=2020-07-18 |title=Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis |chapter-url=https://doi.org/10.1145/3395363.3397370 |series=ISSTA 2020 |location=New York, NY, USA |publisher=Association for Computing Machinery |pages=475–487 |doi=10.1145/3395363.3397370 |isbn=978-1-4503-8008-9}}</ref> and IDA has been called the "de-facto industry standard" for program disassembly and static binary analysis.<ref>{{Cite book |last1=Di Federico |first1=Alessandro |last2=Payer |first2=Mathias |last3=Agosta |first3=Giovanni |chapter=Rev.ng: A unified binary analysis framework to recover CFGS and function boundaries |date=2017-02-05 |title=Proceedings of the 26th International Conference on Compiler Construction |chapter-url=https://doi.org/10.1145/3033019.3033028 |series=CC 2017 |location=New York, NY, USA |publisher=Association for Computing Machinery |pages=131–141 |doi=10.1145/3033019.3033028 |isbn=978-1-4503-5233-8 |quote="In an extensive evaluation, we test our [binary analysis] tool on binaries compiled for MIPS, ARM, and x86-64 using GCC and clang and compare them to the industry's state of the art tool, IDA Pro, and two well-known academic tools, BAP/ByteWeight and angr."}}</ref><ref>{{Cite web |last1=Garcia Prado |first1=Carlos |last2=Erickson |first2=Jon |date=April 10, 2018 |title=Solving Ad-hoc Problems with Hex-Rays API |url=https://www.fireeye.com/blog/threat-research/2018/04/solving-ad-hoc-problems-with-hex-rays-api.html |url-status=dead |archive-url=https://web.archive.org/web/20220602140613/https://www.fireeye.com/blog/threat-research/2018/04/solving-ad-hoc-problems-with-hex-rays-api.html |archive-date=June 2, 2022 |access-date=March 12, 2023 |website=FireEye Threat Research Blog |quote="IDA Pro is the de facto standard when it comes to binary reverse engineering."}}</ref><ref>{{Cite book |last=Andriesse |first=Dennis |url=https://www.worldcat.org/oclc/1050453850 |title=Practical binary analysis : build your own Linux tools for binary instrumentation, analysis, and disassembly |date=2019 |publisher=No Starch Press, Inc. |isbn=978-1-59327-913-4 |location=San Francisco, CA |chapter=Appendix C: List of Binary Analysis Tools |oclc=1050453850 |quote="This [IDA Pro] is the de facto industry-standard recursive disassembler."}}</ref>
Created as a [[shareware]] application by [[Ilfak Guilfanov]], it was later turned into a commercial product by DataRescue, a [[Belgium|Belgian]] company, who currently maintains and supports an improved version called IDA Pro. Along with the Professional version, DataRescue has constantly made a [[freeware]] version available.


== History ==
Ilfak is the main author of IDA (Interactive Disassembler Pro).
[[Ilfak Guilfanov]] began working on IDA in 1990,<ref>{{cite interview |last=Гильфанов |first=Ильфак |subject-link=Ilfak_Guilfanov |title=IDA Pro - samyj moshhnyj dizassembler v mire |url=https://fcenter.ru/online/softarticles/interview/6704 |access-date=14 March 2023 |archive-url=https://web.archive.org/web/20210515200735/https://fcenter.ru/online/softarticles/interview/6704 |archive-date=May 15, 2021 |publisher=Компания "Ф-Центр" |date=22 May 2003 |quote=Он начался как хобби в далеком 1991 году, просто увлечением для себя и для друзей. |interviewer-first=Алексей |interviewer-last=Доля |script-title=ru:IDA Pro - самый мощный дизассемблер в мире |trans-title=IDA Pro - the most powerful disassembler in the world |language=ru |at=sec. 2.30}}</ref><ref>{{Cite web |title=IDA Pro - Часто задаваемые вопросы |url=http://www.idapro.ru/faq.html#053 |url-status=dead |archive-url=https://web.archive.org/web/20031219030300/http://www.idapro.ru/faq.html#053 |archive-date=December 19, 2003 |quote=Первые строки для IDA были написаны в декабре 1990.}}</ref><ref name=":0">{{Cite web |last=Czokow |first=Geoffrey |date=2021-05-20 |title=IDA: celebrating 30 years of binary analysis innovation |url=https://hex-rays.com/blog/ida-celebrating-30-years-of-binary-analysis-innovation/ |access-date=2023-03-19 |website=Hex-Rays |language=en}}</ref><ref>{{Cite web |title=Hex Rays - State-of-the-art binary code analysis solutions |url=https://hex-rays.com/about-us/our-journey/ |access-date=2023-07-21 |website=hex-rays.com |archive-date=2023-05-31 |archive-url=https://web.archive.org/web/20230531100330/https://hex-rays.com/about-us/our-journey/ |url-status=live }}</ref> and initially distributed it as a [[shareware]] application. In 1996, the [[Belgium|Belgian]] company DataRescue took over the development of IDA and began to sell it as a commercial product, under the name IDA Pro.<ref>{{Citation |last=Guilfanov |first=Ilfak |title=CODE BLUE 2014 : Ilfak Guilfanov - Keynote : The story of IDA Pro |date=22 June 2015 |url=https://www.youtube.com/watch?v=hLBlck1lTUs |access-date=2023-03-16 |language=en |quote="Datarescue converted my hobby project into a commercial program in 1996."}}</ref><ref>{{Cite web |title=DataRescue IDA Pro Page |url=http://www.datarescue.com/ida.htm |url-status=dead |archive-url=https://web.archive.org/web/19970214111312/http://www.datarescue.com/ida.htm |archive-date=1997-02-14 |website=DataRescue}}</ref>


Initial versions of IDA did not have a [[Graphical user interface|graphical user interface (GUI)]], and ran as an [[extended DOS]], [[OS/2]], or Windows [[console application]].<ref>{{Cite web |date= |title=DataRescue IDA Page : download an evaluation version |url=http://www.datarescue.com/idadown.htm |archive-url=https://web.archive.org/web/19970214112722/http://www.datarescue.com/idadown.htm |archive-date=1997-02-14 |access-date= |website=DataRescue}}</ref> In 1999, DataRescue released the first version of IDA Pro with a GUI, IDA Pro 4.0.<ref>{{Cite web |date= |title=DataRescue IDA Pro What's new Page |url=http://datarescue.com:80/idanew.htm |archive-url=https://web.archive.org/web/19991010010636/http://datarescue.com:80/idanew.htm |archive-date=1999-10-10 |access-date= |website=DataRescue}}</ref>
== Scripting ==


In 2005, Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension.<ref>{{Cite web |title=Gegevens van de geregistreerde entiteit {{!}} KBO Public Search |url=https://kbopub.economie.fgov.be/kbopub/toonondernemingps.html?ondernemingsnummer=873473914 |access-date=2023-03-13 |website=kbopub.economie.fgov.be}}</ref><ref>{{Cite web |date= |title=Hex-Rays Decompiler |url=http://www.hex-rays.com/products.shtml |archive-url=https://web.archive.org/web/20071011044755/http://www.hex-rays.com/products.shtml |archive-date=2007-10-11 |access-date= |website=Hex-Rays}}</ref> In January 2008, Hex-Rays assumed the development and support of DataRescue's IDA Pro.<ref>{{Cite web |date= |title=DataRescue Home Page : home of the IDA Pro Disassembler and of PhotoRescue |url=http://www.datarescue.com/ |archive-url=https://web.archive.org/web/20080221202137/http://www.datarescue.com:80/ |archive-date=2008-02-21 |access-date= |website=DataRescue |quote="News 07/01/2008: IDA Pro moves to Hex-Rays."}}</ref><ref>{{Cite web |date= |title=Hex-Rays Home Page |url=http://www.hex-rays.com/index.shtml |archive-url=https://web.archive.org/web/20080212081246/http://www.hex-rays.com/index.shtml |archive-date=2008-02-12 |access-date= |website=Hex-Rays}}</ref>
"IDC scripts" make it possible to extend the operation of the disassembler. Some helpful scripts are provided, which can serve as the basis for user written scripts. Most frequently scripts are used for extra modification of the generated code. For example, external symbol tables can be loaded thereby using the function names of the original source code. There are websites devoted to IDA scripts and offer assistance for frequently arising problems.


In 2022, Hex-Rays was acquired by a group of investors led by Smartfin, a European [[venture capital]] and [[private equity investor]]. Co-investors in the acquisition included the Belgian public holding company {{Interlanguage link|The Federal Holding & Investment Company (SFPIM)|fr|Société Fédérale de Participations et d'Investissement}}, and the [[Wallonia|Walloon]] public investment firm [[Regional Investment Company of Wallonia|Regional Investment Company of Wallonia (SRIW)]].<ref>{{Cite web |title=A consortium of investors acquires Hex-Rays – Hex Rays |date=19 October 2022 |url=https://hex-rays.com/blog/hex-rays-acquisition/ |access-date=2023-07-21 |language=en |archive-date=2023-07-21 |archive-url=https://web.archive.org/web/20230721143654/https://hex-rays.com/blog/hex-rays-acquisition/ |url-status=live }}</ref><ref>{{Cite web |last= |first= |date=2022-10-20 |title=News Industry {{!}} Smartfin led consortium acquires Hex-Rays to accelerate product innovation efforts |url=https://www.helpnetsecurity.com/2022/10/21/hex-rays-smartfin/ |access-date=2023-07-21 |website=Help Net Security |language=en-US |archive-date=2023-07-21 |archive-url=https://web.archive.org/web/20230721143654/https://www.helpnetsecurity.com/2022/10/21/hex-rays-smartfin/ |url-status=live }}</ref>
Users have created plugins that allow other common scripting languages to be used instead of, or in addition to, IDC. [http://www.metasploit.com/users/spoonm/idarub/ IdaRUB] supports [[Ruby programming language|Ruby]] and [http://www.d-dome.net/idapython IDAPython] adds support for [[Python (programming language)|Python]].


== Features ==
== Supported systems/processors/compilers ==
IDA disassembles a compiled program back into an assembly language representation. In addition to performing basic disassembly, IDA also automatically annotates disassembled programs with information about:<ref>{{Cite book |last=Eagle |first=Chris |url=https://www.worldcat.org/oclc/830164382 |title=The IDA Pro Book : the Unoffical Guide to the World's Most Popular Disassembler. |date=2011 |publisher=No Starch Press |isbn=978-1-59327-395-8 |edition=2nd |location=San Francisco |chapter=Part II. Basic IDA Usage |oclc=830164382}}</ref>
* Operating systems

** x86 Windows GUI
* cross-references between code and data in the program
** x86 Windows console
* function locations, function [[stack frame]]s, and function [[calling convention]]s
** x86 Linux console
* reconstructed [[data type]]s
* Executable file formats

** PE (Windows)
However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until its functionality becomes clear.
** ELF (Linux, most *BSD)

** Mach-O (MacOS X)
=== Scripting ===
** Netware .exe
"IDC scripts" make it possible to extend the operation of the disassembler. Some helpful scripts are provided, which can serve as the basis for user written scripts. Most frequently scripts are used for extra modification of the generated code. For example, external symbol tables can be loaded thereby using the function names of the original source code.
** OS/2 .exe

** Geos .exe
Users have created plugins that allow other common scripting languages to be used instead of, or in addition to, IDC. IdaRUB<ref>{{Cite web |url=https://github.com/spoonm/idarub |title=Spoonm/Idarub |website=[[GitHub]] |access-date=2011-12-05 |archive-date=2016-01-08 |archive-url=https://web.archive.org/web/20160108085820/https://github.com/spoonm/idarub |url-status=live }}</ref> supports [[Ruby programming language|Ruby]] and IDAPython<ref>{{cite web | url=http://d-dome.net/idapython/ | archive-url=https://web.archive.org/web/20060116123556/http://d-dome.net/idapython/ | archive-date=2006-01-16 | title=Idapython &#91;d-dome.net&#93; }}</ref> adds support for [[Python (programming language)|Python]]. As of version 5.4, IDAPython (dependent on Python 2.5) comes preinstalled with IDA Pro.
** raw binary, such as a ROM image

* Processors
=== Debugging ===
** Intel 80x86 family
IDA Pro supports a number of debuggers,<ref>{{cite book |last=Eagle |first=Chris |title=The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler |publisher=[[No Starch Press]] |year=2008 |isbn=978-1-59327-178-7}}</ref> including:
** ARM, including thumb code

** Motorola 68xxx/h8
* Remote Windows, Linux, and Mac applications (provided by Hex-Rays) allow running an executable in its native environment (presumably using a virtual machine for malware)
** Zilog Z80
* [[GNU Debugger]] (gdb) is supported on Linux and OS X, as well as the native Windows debugger
** MOS Technology 6502
* A [[Bochs]] plugin is provided for debugging simple applications (i.e., damaged [[UPX]] or mpress compacted executables)
** Intel i860
* An [[Pin (computer program)|Intel PIN]]-based debugger
** DEC Alpha
* A trace replayer
** Analog Devices ADSP218x

** Angstrem KR1878
== Versions ==
** Atmel AVR series
The latest full version of IDA Pro is commercial (version 8.4 as of June 2024), while a less capable version, named IDA Free, is available for download free of cost.<ref>{{Cite web |url=http://www.hex-rays.com/idapro/idadownfreeware.htm |title=IDA Pro Freeware version download |access-date=2008-03-31 |archive-date=2008-08-08 |archive-url=https://web.archive.org/web/20080808195925/http://www.hex-rays.com/idapro/idadownfreeware.htm |url-status=live }}</ref>
** DEC series PDP11

==Supported systems/processors/compilers==
* System hosts
** [[Microsoft Windows|Windows]] x86 and ARM
** Linux x86
** {{nowrap|Mac OS X}} x86
* Recognized executable file formats
** [[COFF]] and derivatives, including Win32/64/generic [[Portable Executable|PE]]
** [[Executable and Linkable Format|ELF]] and derivatives (generic)
** [[Mach-O]] ([[Mach (kernel)|Mach]])
** [[NetWare Loadable Module|NLM]] ([[NetWare]])
** [[Linear Executable#OS/2|LC/LE/LX]] (OS/2 2.x+ and various DOS extenders)
** [[New Executable|NE]] (OS/2 1.x, Win16, and various DOS extenders)
** [[DOS MZ executable|MZ]] ([[MS-DOS]])
** [[Relocatable Object Module Format|OMF]] and derivatives (generic)
** [[Arm Image Format|AIM]] (generic)
** raw binary, such as a ROM image or a [[COM file]]
* Instruction sets
** [[Intel]] 80x86 family
** [[ARM architecture]]
** [[Motorola 68000 family|Motorola 68k]] and H8
** [[Zilog Z80]]
** [[MOS Technology 6502|MOS 6502]]
** [[Intel i860]]
** [[DEC Alpha]]
** [[Analog Devices]] ADSP218x
** [[Angstrem (company)|Angstrem]] KR1878
** [[Atmel AVR]] series
** DEC series [[PDP-11|PDP11]]
** Fujitsu F2MC16L/F2MC16LX
** Fujitsu F2MC16L/F2MC16LX
** Fujitsu FR 32-bit Family
** Fujitsu FR 32-bit Family
** Hitachi SH3/SH3B/SH4/SH4B
** Hitachi [[Hitachi SH-3|SH3]]/SH3B/[[Hitachi SH4|SH4]]/SH4B
** Hitachi H8: h8300/h8300a/h8s300/h8500
** [[Hitachi H8]]: h8300/h8300a/h8s300/h8500
** Intel 196 series: 80196/80196NP
** Intel 196 series: 80196/80196NP
** Intel 51 series: 8051/80251b/80251s/80930b/80930s
** Intel 51 series: 8051/80251b/80251s/80930b/80930s
** Intel i960 series
** [[Intel i960]] series
** Intel ia64 series
** [[Intel Itanium]] (ia64) series
** Java virtual machine
** [[Java virtual machine]]
** MIPS: mipsb/mipsl/mipsr/mipsrl/r5900b/r5900l
** [[MIPS architecture processors|MIPS]]: mipsb/mipsl/mipsr/mipsrl/r5900b/r5900l
** Microchip PIC: PIC12Cxx/PIC16Cxx/PIC18Cxx
** Microchip PIC: PIC12Cxx/PIC16Cxx/PIC18Cxx
** Microsoft Visual Studio .NET: cli/net
** [[Microsoft Intermediate Language|MSIL]]
** Mitsubishi 7700 Family: m7700/m7750
** Mitsubishi 7700 Family: m7700/m7750
** Mitsubishi m32/m32rx
** Mitsubishi m32/m32rx
Line 55: Line 111:
** Mitsubishi m7900
** Mitsubishi m7900
** Motorola DSP 5600x Family: dsp561xx/dsp5663xx/dsp566xx/dsp56k
** Motorola DSP 5600x Family: dsp561xx/dsp5663xx/dsp566xx/dsp56k
** Motorola ColdFire
** [[Motorola ColdFire]]
** Motorola HCS12
** Motorola HCS12
** NEC 78K0/78K0S
** NEC 78K0/78K0S
** PA-RISC
** [[PA-RISC]]
** PowerPC
** [[PowerPC]]
** Xenon PowerPC Family
** SGS-Thomson ST20/ST20c4/ST7
** SGS-Thomson ST20/ST20c4/ST7
** SPARC Family
** [[SPARC]] Family
** Samsung SAM8
** [[Samsung]] SAM8
** Siemens C166 series
** [[Siemens C166]]
** TMS320Cxxx series
** [[Texas Instruments TMS320|TMS320Cxxx]] series
* Compiler/libraries (for automatic library function recognition)<ref>{{cite web | url=http://www.hex-rays.com/idapro/idaflirtcomp.htm | title=FLIRT Compiler Support | publisher=[[Hex-Rays]] | access-date=2010-04-13 | archive-date=2011-10-03 | archive-url=https://web.archive.org/web/20111003155049/http://www.hex-rays.com/idapro/idaflirtcomp.htm | url-status=live }}</ref>
* Compiler/libraries (for automatic library function recognition)
** Borland C++ 5.x for DOS/Windows
** [[Borland]] C++ 5.x for DOS/Windows
** Borland C++ 3.1
** Borland C++ 3.1
** Borland C Builder v4 for DOS/Windows
** Borland C Builder v4 for DOS/Windows
** GNU C++ for Cygwin
** GNU C++ for [[Cygwin]]
** [[Microsoft C]]
** MS C (16 bit) for DOS/Windows
** Microsoft [[QuickC]]
** MS Visual Studio .NET
** MS Visual C++ v6
** Microsoft [[Visual C++]]
** Watcom C++ (16/32 bit) for DOS/OS2
** [[Watcom C/C++]] (16/32 bit) for [[DOS]]/[[OS/2|OS2]]
** ARM C v1.2
** ARM C v1.2
** GNU C++ for Unix/common
** GNU C++ for Unix/common

== Logo ==
IDA Pro's logo is a cropped image of [[Françoise d'Aubigné, Marquise de Maintenon]]. The logo image is similar to a miniature painting of Françoise d'Aubigné attested to a painter in the circle of [[Pierre Mignard]].<ref>{{Cite web |title=Französische Schule, Nachfolge Pierre Mignard - Osterauktion 17.04.2019 - Schätzwert: EUR 1.500 bis EUR 2.600 - Dorotheum |url=https://www.dorotheum.com/de/l/6130641/,%20https://www.dorotheum.com/de/l/6130641/ |url-status=live |archive-url=https://web.archive.org/web/20230814052857/https://www.dorotheum.com/de/l/6130641/,%20https://www.dorotheum.com/de/l/6130641/ |archive-date=2023-08-14 |access-date=2024-07-08 |website=www.dorotheum.com |language=de-AT}}</ref>

The original greyscale version of the logo was introduced in September 1999, with the release of IDA 4.0.<ref name=":0" /> Ilfak Guilfanov has stated that the logo is not a depiction of [[Saint Ida of Louvain]].<ref>{{Cite web |last=Guilfanov |first=Ilfak |date=2006-04-13 |title=Sainte Ida {{!}} Hex Blog |url=http://www.hexblog.com/?p=38 |url-status=live |archive-url=https://web.archive.org/web/20110617113702/http://www.hexblog.com/?p=38 |archive-date=2011-06-17 |access-date=2024-07-08 |website=Hex Blog}}</ref>

== See also ==
* [[Binary Ninja]]
* [[Cheat Engine]]
* [[Ghidra]]
* [[JEB decompiler|JEB]]
* [[Radare2]]


==References==
==References==
{{Reflist}}
{{Primarysources|date=March 2007}}
{{Refbegin}}
{{refend}}


==Further reading==
== External links ==
* {{cite book |title=[[Reversing: Secrets of Reverse Engineering]] |last=Eilam |first=Eldad |year=2005 |publisher=[[Wiley Publishing]] |isbn=0-7645-7481-7 |pages=595}}


==External links==
* [http://www.infosecinstitute.com/courses/reverse_engineering_training.html IDA Pro Training]
* {{official website|https://www.hex-rays.com/products/ida/index.shtml}}
* [http://www.datarescue.com/idabase/ English-language IDA Pro home page]
* [http://www.idapro.ru/ Russian-language IDA Pro home page]
* {{cite web |url=http://www.idapro.ru/ |archive-url=https://web.archive.org/web/20150116040613/http://www.idapro.ru/ |archive-date=2015-01-16 |language=ru |title=IDA Pro on Internet Archive}}
* [http://www.openrce.org OpenRCE.org: Large collection of IDA plug-ins and scripts]
* {{cite web |url=http://www.openrce.org |website=Open Reverse Code Engineering (OpenRCE) |title=IDA plug-ins and scripts}}
* [http://www.themel.com/idafree.zip IDA Freeware v4.1 download] - A Windows program that can only disassemble 80x86 code. See also [http://www.datarescue.be/idafreeware/freeida43.exe IDA Freeware v4.3 download].


[[Category:Disassemblers]]
[[Category:Debuggers]]
[[Category:Debuggers]]
[[Category:Software for modeling software]]

[[Category:1991 software]]
[[de:The Interactive Disassembler]]
[[fr:IDA (logiciel)]]
[[it:Interactive Disassembler]]
[[ru:IDA]]

Latest revision as of 04:21, 24 December 2024

Interactive Disassembler
Original author(s)Ilfak Guilfanov
Developer(s)Hex-Rays
Initial releaseMay 21, 1991; 33 years ago (1991-05-21)[1]
Stable release
9.0sp1[2] / December 19, 2024; 15 days ago (2024-12-19)
Written inC++[3]
Operating systemMicrosoft Windows, Mac OS X, and Linux
Available inEnglish, Russian
TypeDisassembler, Decompiler
LicenseProprietary
Websitehex-rays.com/ida-pro/

The Interactive Disassembler (IDA) is a disassembler for computer software which generates assembly language source code from machine-executable code. It supports a variety of executable formats for different processors and operating systems. It can also be used as a debugger for Windows PE, Mac OS X Mach-O, and Linux ELF executables. A decompiler plug-in, which generates a high level, C source code-like representation of the analysed program, is available at extra cost.[4][5]

IDA is used widely in software reverse engineering, including for malware analysis[6][7] and software vulnerability research.[8][9] IDA's decompiler is one of the most popular and widely used decompilation frameworks,[10][11][12] and IDA has been called the "de-facto industry standard" for program disassembly and static binary analysis.[13][14][15]

History

[edit]

Ilfak Guilfanov began working on IDA in 1990,[16][17][18][19] and initially distributed it as a shareware application. In 1996, the Belgian company DataRescue took over the development of IDA and began to sell it as a commercial product, under the name IDA Pro.[20][21]

Initial versions of IDA did not have a graphical user interface (GUI), and ran as an extended DOS, OS/2, or Windows console application.[22] In 1999, DataRescue released the first version of IDA Pro with a GUI, IDA Pro 4.0.[23]

In 2005, Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension.[24][25] In January 2008, Hex-Rays assumed the development and support of DataRescue's IDA Pro.[26][27]

In 2022, Hex-Rays was acquired by a group of investors led by Smartfin, a European venture capital and private equity investor. Co-investors in the acquisition included the Belgian public holding company The Federal Holding & Investment Company (SFPIM) [fr], and the Walloon public investment firm Regional Investment Company of Wallonia (SRIW).[28][29]

Features

[edit]

IDA disassembles a compiled program back into an assembly language representation. In addition to performing basic disassembly, IDA also automatically annotates disassembled programs with information about:[30]

However, the nature of disassembly precludes total accuracy, and a great deal of human intervention is necessarily required; IDA has interactive functionality to aid in improving the disassembly. A typical IDA user will begin with an automatically generated disassembly listing and then convert sections from code to data and vice versa, rename, annotate, and otherwise add information to the listing, until its functionality becomes clear.

Scripting

[edit]

"IDC scripts" make it possible to extend the operation of the disassembler. Some helpful scripts are provided, which can serve as the basis for user written scripts. Most frequently scripts are used for extra modification of the generated code. For example, external symbol tables can be loaded thereby using the function names of the original source code.

Users have created plugins that allow other common scripting languages to be used instead of, or in addition to, IDC. IdaRUB[31] supports Ruby and IDAPython[32] adds support for Python. As of version 5.4, IDAPython (dependent on Python 2.5) comes preinstalled with IDA Pro.

Debugging

[edit]

IDA Pro supports a number of debuggers,[33] including:

  • Remote Windows, Linux, and Mac applications (provided by Hex-Rays) allow running an executable in its native environment (presumably using a virtual machine for malware)
  • GNU Debugger (gdb) is supported on Linux and OS X, as well as the native Windows debugger
  • A Bochs plugin is provided for debugging simple applications (i.e., damaged UPX or mpress compacted executables)
  • An Intel PIN-based debugger
  • A trace replayer

Versions

[edit]

The latest full version of IDA Pro is commercial (version 8.4 as of June 2024), while a less capable version, named IDA Free, is available for download free of cost.[34]

Supported systems/processors/compilers

[edit]
[edit]

IDA Pro's logo is a cropped image of Françoise d'Aubigné, Marquise de Maintenon. The logo image is similar to a miniature painting of Françoise d'Aubigné attested to a painter in the circle of Pierre Mignard.[36]

The original greyscale version of the logo was introduced in September 1999, with the release of IDA 4.0.[18] Ilfak Guilfanov has stated that the logo is not a depiction of Saint Ida of Louvain.[37]

See also

[edit]

References

[edit]
  1. ^ Czokow, Geoffrey (2021-05-20). "IDA: celebrating 30 years of binary analysis innovation". Hex-Rays. Retrieved 2023-03-19.
  2. ^ "IDA 9.0sp1". Retrieved Dec 20, 2024.
  3. ^ "Hex-rays Home". Archived from the original on 2024-05-26. Retrieved 2008-03-31.
  4. ^ Eagle, Chris (2011). "Chapter 23: Real-World IDA Plug-ins". The IDA Pro Book : the Unoffical Guide to the World's Most Popular Disassembler (2nd ed.). San Francisco: No Starch Press. pp. 500–502. ISBN 978-1-59327-395-8. OCLC 830164382.
  5. ^ "Hex-Rays Decompiler". hex-rays.com. Retrieved 2023-03-18.
  6. ^ Staff, S. C. (2017-09-11). "Hex-Rays IDA Pro". SC Media. Retrieved 2023-03-13.
  7. ^ Sikorski, Michael (2012). "Chapter 5. IDA Pro". Practical Malware Analysis : a Hands-On Guide to Dissecting Malicious Software. Andrew Honig. San Francisco: No Starch Press. ISBN 978-1-59327-430-6. OCLC 830164262.
  8. ^ Shoshitaishvili, Yan; Wang, Ruoyu; Salls, Christopher; Stephens, Nick; Polino, Mario; Dutcher, Andrew; Grosen, John; Feng, Siji; Hauser, Christophe; Kruegel, Christopher; Vigna, Giovanni (2016-05-22). "SOK: (State of) the Art of War: Offensive Techniques in Binary Analysis". 2016 IEEE Symposium on Security and Privacy (SP). pp. 138–157. doi:10.1109/SP.2016.17. hdl:11311/1161277. ISBN 978-1-5090-0824-7.
  9. ^ Guo, Wei; Wei, Qiang; Wu, Qianqiong; Guo, Zhimin (2022-04-01). "CSChecker : A binary taint-based vulnerability detection method based on static taint analysis". Journal of Physics: Conference Series. 2258 (1): 012069. Bibcode:2022JPhCS2258a2069G. doi:10.1088/1742-6596/2258/1/012069. ISSN 1742-6588.
  10. ^ Yakdan, Khaled; Eschweiler, Sebastian; Gerhards-Padilla, Elmar; Smith, Matthew (2015). No More Gotos: Decompilation Using Pattern-Independent Control-Flow Structuring and Semantics-Preserving Transformations. doi:10.14722/ndss.2015.23185. ISBN 978-1-891562-38-9. Retrieved 2023-03-18. {{cite book}}: |website= ignored (help)
  11. ^ Schulte, Eric; Ruchti, Jason; Noonan, Matt; Ciarletta, David; Loginov, Alexey (2018). "Evolving Exact Decompilation". Proceedings 2018 Workshop on Binary Analysis Research. Reston, VA: Internet Society. doi:10.14722/bar.2018.23008. ISBN 978-1-891562-50-1.
  12. ^ Liu, Zhibo; Wang, Shuai (2020-07-18). "How far we have come: Testing decompilation correctness of C decompilers". Proceedings of the 29th ACM SIGSOFT International Symposium on Software Testing and Analysis. ISSTA 2020. New York, NY, USA: Association for Computing Machinery. pp. 475–487. doi:10.1145/3395363.3397370. ISBN 978-1-4503-8008-9.
  13. ^ Di Federico, Alessandro; Payer, Mathias; Agosta, Giovanni (2017-02-05). "Rev.ng: A unified binary analysis framework to recover CFGS and function boundaries". Proceedings of the 26th International Conference on Compiler Construction. CC 2017. New York, NY, USA: Association for Computing Machinery. pp. 131–141. doi:10.1145/3033019.3033028. ISBN 978-1-4503-5233-8. In an extensive evaluation, we test our [binary analysis] tool on binaries compiled for MIPS, ARM, and x86-64 using GCC and clang and compare them to the industry's state of the art tool, IDA Pro, and two well-known academic tools, BAP/ByteWeight and angr.
  14. ^ Garcia Prado, Carlos; Erickson, Jon (April 10, 2018). "Solving Ad-hoc Problems with Hex-Rays API". FireEye Threat Research Blog. Archived from the original on June 2, 2022. Retrieved March 12, 2023. IDA Pro is the de facto standard when it comes to binary reverse engineering.
  15. ^ Andriesse, Dennis (2019). "Appendix C: List of Binary Analysis Tools". Practical binary analysis : build your own Linux tools for binary instrumentation, analysis, and disassembly. San Francisco, CA: No Starch Press, Inc. ISBN 978-1-59327-913-4. OCLC 1050453850. This [IDA Pro] is the de facto industry-standard recursive disassembler.
  16. ^ Гильфанов, Ильфак (22 May 2003). "IDA Pro - samyj moshhnyj dizassembler v mire" IDA Pro - самый мощный дизассемблер в мире [IDA Pro - the most powerful disassembler in the world] (Interview) (in Russian). Interviewed by Доля, Алексей. Компания "Ф-Центр". sec. 2.30. Archived from the original on May 15, 2021. Retrieved 14 March 2023. Он начался как хобби в далеком 1991 году, просто увлечением для себя и для друзей.
  17. ^ "IDA Pro - Часто задаваемые вопросы". Archived from the original on December 19, 2003. Первые строки для IDA были написаны в декабре 1990.
  18. ^ a b Czokow, Geoffrey (2021-05-20). "IDA: celebrating 30 years of binary analysis innovation". Hex-Rays. Retrieved 2023-03-19.
  19. ^ "Hex Rays - State-of-the-art binary code analysis solutions". hex-rays.com. Archived from the original on 2023-05-31. Retrieved 2023-07-21.
  20. ^ Guilfanov, Ilfak (22 June 2015), CODE BLUE 2014 : Ilfak Guilfanov - Keynote : The story of IDA Pro, retrieved 2023-03-16, Datarescue converted my hobby project into a commercial program in 1996.
  21. ^ "DataRescue IDA Pro Page". DataRescue. Archived from the original on 1997-02-14.
  22. ^ "DataRescue IDA Page : download an evaluation version". DataRescue. Archived from the original on 1997-02-14.
  23. ^ "DataRescue IDA Pro What's new Page". DataRescue. Archived from the original on 1999-10-10.
  24. ^ "Gegevens van de geregistreerde entiteit | KBO Public Search". kbopub.economie.fgov.be. Retrieved 2023-03-13.
  25. ^ "Hex-Rays Decompiler". Hex-Rays. Archived from the original on 2007-10-11.
  26. ^ "DataRescue Home Page : home of the IDA Pro Disassembler and of PhotoRescue". DataRescue. Archived from the original on 2008-02-21. News 07/01/2008: IDA Pro moves to Hex-Rays.
  27. ^ "Hex-Rays Home Page". Hex-Rays. Archived from the original on 2008-02-12.
  28. ^ "A consortium of investors acquires Hex-Rays – Hex Rays". 19 October 2022. Archived from the original on 2023-07-21. Retrieved 2023-07-21.
  29. ^ "News Industry | Smartfin led consortium acquires Hex-Rays to accelerate product innovation efforts". Help Net Security. 2022-10-20. Archived from the original on 2023-07-21. Retrieved 2023-07-21.
  30. ^ Eagle, Chris (2011). "Part II. Basic IDA Usage". The IDA Pro Book : the Unoffical Guide to the World's Most Popular Disassembler (2nd ed.). San Francisco: No Starch Press. ISBN 978-1-59327-395-8. OCLC 830164382.
  31. ^ "Spoonm/Idarub". GitHub. Archived from the original on 2016-01-08. Retrieved 2011-12-05.
  32. ^ "Idapython [d-dome.net]". Archived from the original on 2006-01-16.
  33. ^ Eagle, Chris (2008). The IDA Pro Book: The Unofficial Guide to the World's Most Popular Disassembler. No Starch Press. ISBN 978-1-59327-178-7.
  34. ^ "IDA Pro Freeware version download". Archived from the original on 2008-08-08. Retrieved 2008-03-31.
  35. ^ "FLIRT Compiler Support". Hex-Rays. Archived from the original on 2011-10-03. Retrieved 2010-04-13.
  36. ^ "Französische Schule, Nachfolge Pierre Mignard - Osterauktion 17.04.2019 - Schätzwert: EUR 1.500 bis EUR 2.600 - Dorotheum". www.dorotheum.com (in Austrian German). Archived from the original on 2023-08-14. Retrieved 2024-07-08.
  37. ^ Guilfanov, Ilfak (2006-04-13). "Sainte Ida | Hex Blog". Hex Blog. Archived from the original on 2011-06-17. Retrieved 2024-07-08.

Further reading

[edit]
[edit]
Retrieved from "https://en.wikipedia.org/enwiki/w/index.php?title=Interactive_Disassembler&oldid=1264913440"