IDA Pro 7.7.220118

Official website address:

52Address:

Chinese:丨Nangong丨Purple

introduce

IDA Pro (IDA for short) is an interactive disassembly tool produced by DataRescue (home of PhotoRescue, data recovery solution for flash memory cards). It is powerful and complex to operate. To fully master it requires a lot of knowledge. The main features of IDA are interaction and multiprocessing. The operator can guide IDA to better disassemble by interacting with IDA. IDA does not automatically solve problems in the program, but it will find suspicious areas according to the user's instructions. The user's job is to tell IDA what to do. For example, manually specify the compiler type, define variable names, structure definitions, arrays, etc. Such interactive capabilities are particularly important when disassembling large software. The multi-processor feature means that IDA supports software products on common processor platforms. IDA supports a wide range of file types. In addition to the common PE format, it also supports file formats for Windows, DOS, UNIX, Mac, Java, .NET and other platforms.

IDA is one of the most popular debugger tools under Windows. IDA Pro is first of all a disassembler that can display binary assembly code (executable file or DLL (Dynamic Link Library), dynamic link library). It provides certain advanced functions that make it easier for us to understand assembly code. Secondly, it is a debugger. Users can debug the instructions in the binary file one by one to determine which instructions are being executed and the order in which they are executed.

----

Commonly used shortcut keys

| Shortcut keys | Function description |

| ------------ | ------------ |

| Enter | Follow the function implementation and view the address corresponding to the label |

| Esc | Return to follow-up |

| A | Interprets the address at the cursor as the first address of a string |

| B | Hexadecimal and binary number conversion |

| C | Interpret the address at the cursor as an instruction |

| D | Interprets the address at the cursor as data, and each press will convert the data length of this address |

| G | Quickly find the corresponding address |

| H | Hexadecimal and decimal number conversion |

| K | Interpret data as stack variables |

|: | Add comment |

| M | interpreted as an enumeration member |

| N | Rename |

| O | Interprets the address as the data segment offset, used for string labels |

| T | Interpret data as a structure member |

| X | Convert the view to cross-reference mode |

| Shift + F9 | Add structure |

| Space | Switch between text view and chart view |

| ALT + M | Add tag |

| CTRL + M | View tags |

| CTRL + S | View segment information |

| colon | general comments |

| Semicolon | Comment, the priority is lower than colon, that is, if there is a colon comment, it will overwrite and display |

| F5 | View pseudocode |

| ALT + T | Search string |

| Ctrl + T | Search next |

| ALT + B | Search Hex |

| X | View cross-references |

| SHIFT + F12 | Open strings window |

| Y | Modify data type |

| N | Modify variable names and parameter names |

| CTRL + F12 | Function call graph |

| F12 | Flowchart |

| Ctrl + F9 | Import c header file |

----

Assembly instructions

Data transfer instructions

• MOV move
• MOVC program memory movement
• MOVX data transfer instructions for external RAM and expansion I/O port and accumulator A
• PUSH puts it on the stack
• POP retrieved from stack
• XCH 8-bit exchange
• XCHD low 4 bit exchange
• SWAP high and low 4-bit exchange

Arithmetic instructions

• ADD Add two numbers

-ADDC Add two numbers and add C

-SUBB Subtract two numbers and then subtract C

• INC plus one command
• DEC minus one command
• MUL (MUL AB multiplication instruction is the only one) multiplication instruction, the lower 8 bits of the resulting 16-bit binary number are stored in the upper 8 bits of accumulator A and stored in B
• DIV (DIV AB division instruction is the only one) division instruction, the resulting quotient …