Hello, my name is Stephan.
And in this section we will learn how to reverse engineer the malwares and disassemble using Ida.
And content analysis is often used to understand the inner workings of a malicious binary when the source
code is unavailable.
In previous lecture you learned the g drive and you learn the code analysis, skills and techniques
to interpret assembly code and to understand the program's functionality.
And the programs that we use were simple C programs, but we are dealing with a malware.
It can contain thousands of lines of code and hundreds of functions and making it difficult to keep
track of all of the variables and functions.
Code analysis tool offers very, very strict features to simplify the code analysis, and this section
will introduce one of such code analysis tool named Ida Pro, also known as Ida, and you will learn
how to leverage the features of Ida Pro to enhance your assembly.
Before we delve into the features of Ida, let's go over different code analysis tools.
Firstly, and we have the Disassembler here, so.
Disassembler.
Tumblr.
So Disassembler is a program that translates machine code back to assembly code and here.
It's actually close it down.
So we also have a debugger that is a program which also disassembles the code.
Apart from that, it allows you to compile the binary in a controlled manner.
Using the debuggers, you can execute a single instruction or selected functions instead of.
Our program debugger allows you to perform dynamic code analysis and helps you combine the aspects of
the suspect binary while it is running at the compiler.
The program that translates the machine code into the code in a high level language also known as pseudo
code and the compilers can greatly assist you with the reverse engineering process and can simplify
your work.
And now let's use this static code analysis using Ida.
The Ida here.
So hex Rays.
Ida Pro is the most powerful and popular commercial disassembler or the debugger.
And here we can download it from their official website.
Here it is also has the two versions.
The one is the paid version and another is the.
Free version.
And here.
And as you can see, we have the.
Write the hex phrase here.
Race.
And after that, um, we will see something like Hex racer.com and we will download to um, we will
download the that program here right now.
And here we are waiting for the response here.
And here, uh, we will click on the first result here.
And as you can see, we have the versions in this lecture.
We have the Ida version 8.3, and we will go to products here.
And as you can see here, we have several, uh, downloads and products here.
So we have the Ida three three binary code analysis tool to evaluate Ida's basic functionalities.
We have the Ida home, this affordable tool for reverse engineering hobbyists and the Ida Pro, the
state of the art binary code analysis tool, as they say, and Ida team's collaborative reverse engineering
tool.
And we will use the free version for now.
Uh, because, um, some of the students don't want to spend money I don't want either because there's
a free and open source alternatives.
But this is a pretty popular tool.
So I wanted to include this in the section here.
And as you can see here, what's included in the pack so we can analyze the both 32 bit and 64 bit applications.
We have the code based, the compiler, and we can save you, save analysis, results and perpetual
license.
And as you can see here, for minimum system requirements, we need to either Windows Linux or Mac OS.
And here, uh, we can download the idea for, for the Mac and Mac arm.
And in this case, since we are using the windows, we will download on the windows here, we will click
on the first option and also we have the Sha 256 checksums here.
So you can the check that.
Checksums to make sure that the program is correctly downloaded without any manipulation by.
Now, the attackers here and here, as you can see here now.
Uh, the Ida free is downloading.
And also in this section and later sections, we will look at various features of Ida Pro and you will
learn how to use Ida to perform static code analysis also called dissembling.
And it's not possible to cover all the features of Ida, only those features that are relevant to malware
analysis and reverse engineering mainly.
And if you are interested in gaining deeper understanding of Ida Pro, it is recommended to make a play
it, play with it and analyze more files to gain experience.
And if you are using the you can also download the demo version.
Um, but you need to write the mail.
So they will do the demo version here.
And uh, using these versions you will be able to try out almost all the features, um, covered in
this uh, course here.
So if you wish to look at uh, the, at an alternative tool for debugging 32 bit and 64 bit binary,
you can use the X 64 debug or debug here, as you can see here.
And you can also use them.
You know, g dryer with several plugins and which is covered in this section and with an understanding
of different versions of Ida.
Now, after downloading it, we will explore its features and you will understand how it can speed up
your reverse engineering and malware analysis tasks.
And here, as you can see, it's already installed.
We'll open it, not install the downloaded here and we will click on Run.
Yes.
Here.
After reading.
Click on accept the agreement.
Then accept the agreement and click on next here.
This is the installation directory.
Leave it default.
And setup is now ready to begin calling it a freeware 8.3 on your computer.
Now, we will click on next.
And as you can see here, it's installing.
That's it.
Ida Pro is installed in our Windows machine and in the next lecture we will begin to use it.
I'm waiting you in the next lecture.