IDAPRO

A presentation on the security tool IDAPRO including features and demonstrations.

1. 1 - 1 IDAPro Dr. Gregory Vert By Cristian gArcia and Matthew Vieyra cs - 432

2. Download and Installation The IDAPRO software (Now called IDA by Hex-Rays) can be downloaded form : https://www.hex-rays.com/products/ida/support/download.shtml

3. Download and Installation Select demo/evaluation version and choose the version appropriate for the your operating system. For our project we choose the IDA demo for MS Windows.

4. Navigate to Setup File Navigate to File Explorer to the location where the IDA demo was downloaded. This is usually the Downloads Folder unless otherwise specified.

5. Installation: License Agreement Double-Click the setup file to begin the installation process. Read and Agree to the License Agreement.

6. Installation: File Location Select destination for IDA Demo to install. Default is the Program Files Folder.

7. Installation: Desktop Icon You will be given the option to create a Desktop Icon. By default the option will unchecked.

8. Installation: Review Before installing IDA will go over the options you selected. Take time to review all selection are correct. If anything is incorrect use the back button to correct. Otherwise, continue with installation.

9. Installation: Finished Once the installation finishes IDA will ask the you computer if you want to launch. Select the finish button to finalize installation and start using IDA.

10. Assembly Language Assembly language, often abbreviated as asm . Low-level programming language for a computer Very strong correspondence between the language and architectures machine code instructions.

11. Assembly Language Each assembly language is specific to a particular computer architecture In contrast, most high-level programming languages are portable across different architectures. Assembly language is converted into executable machine code by a utility program called an assembler. The conversion process is referred to as assembly or assembling the source code.

12. Assembly Language Assembly time is the computational step where an assembler is run Assembly language uses a mnemonic to represent each low-level machine instruction or opcode. Many operations require one or more operands to complete instruction Most assemblers can take expressions of numbers and named constants as well as registers and labels as operands, freeing the programmer from tedious repetitive calculations

13. Assembly Language Depending on the architecture, these elements may also be combined for specific instructions or addressing modes using offsets or other data as well as fixed addresses Many assemblers offer additional mechanisms facilitate program development Control the assembly process Aid debugging Motorola MC6800 Assembly listing, showing original assembly language and the assembled form

14. Terminology A Macro assembler includes macroinstruction facility so that assembly language text can be represented by a name, and that name can be used to insert the expanded text into other code. A cross assembler is an assembler that is run on a computer or operating system of a different type from the system on which the resulting code is to run. A high-level assembler is a program that provides language abstractions more often associated with high-level languages, such as advanced control structures (IF/THEN/ELSE, DO CASE, etc.) and high-level abstract data types, including structures/records, unions, classes, and sets.

15. Key Concepts An assembler program creates object code by translating combinations of mnemonics and syntax for operations and addressing modes into their numerical equivalents. This representation typically includes an operation code ("opcode") as well as other control bits and data. The assembler also calculates constant expressions and resolves symbolic names for memory locations and other entities. The use of symbolic references is a key feature of assemblers, saving tedious calculations and manual address updates after program modifications.

16. Key Concept Most assemblers also include macro facilities for performing textual substitution – e.g., to generate common short sequences of instructions as inline, instead of called subroutines. Some assemblers may also be able to perform some simple types of instruction set-specific optimizations. One concrete example of this may be the ubiquitous x86 assemblers from various vendors. Most of them are able to perform jump-instruction replacements (long jumps replaced by short or relative jumps) in any number of passes, on request.

17. Basic Elements There is a large degree of diversity in the way the authors of assemblers categorize statements and in the nomenclature that they use. In particular, some describe anything other than a machine mnemonic or extended mnemonic as a pseudo-operation (pseudo-op). A typical assembly language consists of 3 types of instruction statements that are used to define program operations: Opcode mnemonics Data definitions Assembly directives

18. Historical Perspective Assembly languages, and the use of the word assembly, date to the introduction of the stored-program computer. The Electronic Delay Storage Automatic Calculator (EDSAC) had an assembler called initial orders featuring one-letter mnemonics in 1949. SOAP (Symbolic Optimal Assembly Program) was an assembly language for the IBM 650 computer written by Stan Poley in 1955. An IBM 650 at Texas A&M University. The IBM 533 Card Read Punch unit is on the right.

19. Historical Perspective Assembly languages eliminate much of the error-prone, tedious, and time-consuming first-generation programming needed with the earliest computers, freeing programmers from tedium such as remembering numeric codes and calculating addresses. They were once widely used for all sorts of programming. However, by the 1980s (1990s on microcomputers), their use had largely been supplanted by higher-level languages, in the search for improved programming productivity. Today assembly language is still used for direct hardware manipulation, access to specialized processor instructions, or to address critical performance issues.

20. IDA: Quick Start IDA has a “Quick Start” at startup to start a new project or open a current one. Select your desired initiation of the program.

21. IDA: 1 st attempt at Disassembly We used a malware executable “Google_Adobe_FlashPlayer.exe”

22. IDA: Malware Disassemble Fail IDA refused to disassemble the malware .exe. Windows Defender identify the malware and proceeded to try and remove it.

23. IDA: Quarantined Trojan Windows Defender Identified the Malware as a Trojan with a security lever alert of “Severe.” Proceeded to Remove Malware .

24. IDA: 2 nd attempt at Disassembly We used malware executable “ Bombermania ” Source: TekDefense.com

25. IDA: Loading New File Load a new file into IDA. In this case we used “ Bombermania.exe ” We used the default selected options for disassembly.

26. IDA: Demo Warning IDA warning is in place because the IAT is located in a non-standard section. Procced to click ”OK” as you are using the Demo version.

27. Ida: Disassembly successful IDA will give you a full “workstation” from the get to analyze the disassembled malware. This will include several windows which include view graphs, functions and search tools.

28. IDA: Function & List of Problems Functions for this file currently include “read” .  List of problems will include all occurrences when IDA was unable to properly dissemble components of the malware. 

29. IDA: Output Window The “Output Window” includes the full description of the current total memory allocation for the malware and also includes such things of the b-tree , virtual array , and pointers .

30. Ida: Output W indow IDA will let you know if your malware has been successfully added into your database and will proceed to analyze the different functions such as the main , on load , input file , and types .

31. IDA: View Graph Overview IDA will take your malware and create an overview graph of its components. The arrows show flow of execution . This helps you understand the how the malware operates at different stages .

32. IDA: View Graph – Beginning The view graph will show you the initiation process of the malware. The traversal of the malware at point of execution has has many different options to execute its different components.

33. IDA: View Graph – Middle As traversal continues through the view graph it locates all possible pathways of execution . This disassembly shows that there is complexity in the malware.

34. IDA: View Graph – end At the end of the view graph we have components that show the point of termination for the malware or loop back . This particular malware has both options in place.

35. IDA: Hex View The “Hex View” shows the hexadecimal version of the malware code. This allow us to see the malware from a different source view in an editor format.

36. IDA: structures and Enumbs IDA gives you the option to create or delete structures to modify your current project.  IDA gives you the option to create, delete, or edict numeration types to modify your current project. 

37. IDA: Imports and Exports IDA gives you the option to use “Imports” found in libraries and lets you use this libraries or include new ones for different functions.  IDA also give you the option to “Export” some of your work. 

38. Ida: Search Tools IDA has great variety of “Search Tools” such as Immediate , Text and Binary . This tools can be used to search through your disassembled malware to identify key elements.

39. IDA: Function Calls IDA has a lot “Function Calls” for example here it is taking our malware and executed what appears to be the GUI of our start button in our malware .

40. IDA: Disassembly View The ”Disassembly View” summarizes the disassembly as whole. Here on the right was our output for our malware.

41. IDA: Proximity Browser IDA’s ”Proximity Browser” allows you to identify all major components in your malware as by group types.

42. Works Cited "IDA Support: Download Center."  IDA Support: Download Center . N.p ., n.d. Web. 19 Mar. 2017. https:// www.hex-rays.com /products/ ida /support/ download.shtml " TekDefense ."  Downloads . N.p ., n.d. Web. 20 Mar. 2017. http://www.tekdefense.com/downloads / "IBM Knowledge Center."  IBM Knowledge Center . N.p ., 1990. Web. 24 Mar. 2017. <https:// www.ibm.com /support/ knowledgecenter /SSLTBW_2.1.0/com.ibm.zos.v2r1.asma400/asmr102112.htm>. 1 - 42