Bootloader and executable.
We will launch the Ida pro ida freeware, which in this case we will need to run as administrator.
In order to do that, we will right click on it.
Electron after.
Yes.
If you started the Ida Pro the first time, it will briefly display a screen showing your license information
and immediately after that.
Uh, you will were presented with this following screen here.
And we will choose the new.
And we will the file.
Will wish to analyze.
In this case, it's a simple Hello world program.
And after that, if you as you can see, we have a portable executable and binary file.
Ways, and the file that you give to ID A will be loaded in memory and either ideas.
Acts like a Windows loader.
File into the memory.
I determine best possible order from the file header.
Yeah.
File here and it determines the processor type that should be used during the disassemble process after
you select the file.
It shows a dialog here, as you can see here.
So from this it can be seen that EDA determine the appropriate loaders are the port as you can have.
The x six here and appropriate loaders are the portable executable.
You're just a binary file.
And.
The binary file option.
If you are using the demo version, you will not see this option here and its binary file option is
used by the ID to ID or id.
ID A or.
The idea to load the files that it does not recognize.
So you will normally use this option when you are dealing with a shell code and by default it is not.
Uh, resource section assembly and by using the manual load checkup here.
So as you can see, we have manual load load resources entries and if you check this manual load option
and manually specify the base address where the executable has to be loaded and and the ID will.
Whether you want to.
Section the.
Years.
And as you can see, we have an enviable portable executable for 8306.
And after we click okay here, as you can see, we want to change the process.
Type to Athlon now.
We will.
And after clicking.
Okay.
Um.
Ida loads file into frame and.
This assembles machine code.
And as you can see, a lot of the debug information.
Yes.
Get as much information pulled here and.
Click here.
It might.
System properties.
And as you can see, it's registering and that's it.
And here after the disassembly, Ida Per Ida performs an initial analysis.
Identify the compiler function arguments, local variables, library functions and their parameters.
And let's actually.
And that's it.
Here.
And once the executable has been loaded, you will take to the desktop showing the disassembled output
of the program and the Ida desktop integrates the features of many common static analysis tools into
a single interface, and this section will give you an understanding of the Ida desktop and its various
windows.
And this this you can see here the Ida desktop called Stop after Load and you will see that time after
load an executable file.
And the idea the slope means a different multiple tabs like.
Idea of a hex view and so on, and clicking each tab brings up a different window here.
As you can see, we have tabs here, structures and.
Imports exports.
And.
And select one of them.
And we also have the structures here.
Arms imports here.
Now we are.
The structures.
There's a structures.
We also have the enums, imports we are importing.
Find versus.
Exports and after the executable has been loaded, you will present.
So also known as Ida view a window and this is the primary window and displays the disassembled code
and you will mostly be using this window for analyzing binaries.
Here.
And they can go into display mode.
The first is graph view and text view and graph is the default view.
As you can see here and when the assembly view ID view is active, you can switch between the graph
and the text view by pressing the space bar like this here.
And in the graph view menu.
Ida This Ida displays one function at a time in flowchart style graph and the function is coming to
basic blocks here and this mode is useful to quickly recognize branching and looping.
And the in graph V mode.
The color and the direction of the arrows include the path and the variable taken here.
But in this case this is just a simple hello world application and it has only one function and we don't
see any other functions.
And that's why this is the only tab we can see here.
And.
In the graph view of the virtual addresses are not displayed by default, and this is to minimize the
amount of space required to display each basic block and to display the virtual address information.
You can click the options here.
And after that, General, and as you can see here, we have several.
Here and we will go to graph.
And as you can see, you know, instead of going to graph, you can also change it from here, display
disassembly line parts, and we will enable this.
Check this out and we will click on.
Okay.
And as you can see here now, we are seeing this binaries here and hex hex values here and here we are
seeing the disassembly of the main function and in the graph view mode, notice that the conditional
check at the address is starting at the 0401 460.
And for Android 80 here and if the condition we don't have the condition for now but in next lecture
we will use this for checking the conditions as well.
And.
In next lecture, we will also learn how to use the functions of output window and hex view windows
as well.
And I'm waiting you in next lectures.