Toolbag

Presented at REcon 2012, June 16, 2012, 3:30 p.m. (30 minutes)

IDA Pro presents the reverse engineer with a vast array of tools andcapabilities, but after using it for our daily tasks for quite sometime, we’ve realized there are some forms of functionality forsituations the authors did not build into the tool. This presentationis intended to motivate the audience to think outside the confines ofthe current capabilities IDA provides. We will present ideas forsolutions to help overcome many tedious tasks and common pitfallsfaced by reverse engineers. Starting with demonstrating how to extractdata from IDA to create an out-of-band database, we will then proceedto show the immediate efficiency improvements this allows. We willshow how to store and subsequently query arbitrary metadata, newtechniques for navigating code (complete with UI enhancements), animproved marking system, and the ability to collaborate with others bytransferring marshaled objects from one IDA instance to another.Additionally, we will demonstrate both intra- and inter-function pathfinding capability based off of our custom query language and externalgraph database. The benefits these capabilities bestow will becomeapparent when we show how you can tie in an external debugger toperform arbitrary analysis (hit tracing, taint analysis, and so on) tocomplement your static reverse engineering efforts.


Presenters:

Links:

Similar Presentations: