Editing IDA pro disassembler and debugger

{{Wikify}}

Many of you might work for a company/university that has access to IDA pro or maybe you just downloaded their free version [http://www.hex-rays.com/idapro/idadown.htm IDA homepage] and need some help getting started.

=Extra tools=

First you should get all the tools you can get to make your life easier.

following tools are recommended

==Essential==
*Plugins
**PPCJT
**SPU - To be able to disassemble SPU code 
*IDC scripts

All this can be found here: 

Main branch
https://github.com/kakaroto/ps3ida  // https://github.com/kakaroto/ps3ida/zipball/master (backup: [http://www.mirrorcreator.com/files/N0WYVWG0/kakaroto-ps3ida-a6e7f17.zip_links kakaroto-ps3ida-a6e7f17.zip (199.91 KB)])<br />

mirror/old: <strike>http://git-hacks.com/ps3free/ps3ida  http://git-hacks.com/~psicoleo/ps3free/psicoleos-ps3ida</strike>

optimized scripts: http://rghost.net/46957385

*PPCJT plugin v0.3:
**- Fixed bug causing crash Ida Pro 6.1 ("oops! internal error 189")
**- Fixed memory leak
**+ Added several new structures for constructing jump tables

Plugin tested on the eboot.bin file from the F.E.A.R.2: found and successfully created 137 jump tables.

Source code and precompiled plugins: 
<strike>http://www.megaupload.com/?d=FC7Z0ZWE</strike>

Mirror: <strike>http://akitel.com/download/ppcjt.rar</strike>
re-upload this?

==Optional==

*anergistic - to debug SPU code // [http://git.fail0verflow.com/?p=anergistic.git Git] - mirrors: http://www.megaupload.com/?d=TCUZ6JNE / http://www.multiupload.com/R8UMSH3DJS
*ppchelper // http://www.hex-rays.com/contest2009/PPCHelper/ppchelper.zip
*ppc2c // http://www.hex-rays.com/contest2009/PPC2C/ppc2c.zip
*xorloser's PS3 Loaders // http://rghost.net/46524423
*xorloser's PPCAltivec plugin // http://xorloser.com/blog/wp-content/uploads/2009/05/ppcaltivec-plugin-for-ida-v52.rar (reup) / <span style="text-decoration: line-through;">http://megaupload.com/?d=MYVWMKUP</span>
*xorloser's ps3.xml (updated lv2syscalls + sysmodules) (down?)<span style="text-decoration: line-through;"> http://paste2.org/p/1437457</span> 
*ida-spu http://code.google.com/p/ida-spu/ // [http://www.multiupload.com/28N7UHCG8J spu_processor_module_1.2.1.zip (114.25 KB)]
*more Exports for fnids.idh (down?)<span style="text-decoration: line-through;">http://paste2.org/p/1802527</span>
*updated syscall_names.idh (reup!) // https://github.com/kakaroto/ps3ida/blob/master/syscall_names.idh

==Compiling the tools==

Many of the tools are opensource, the idc script do not have to be compiled but the plugins must be.

To compile the latest plugins you will need Visual Studio and IDA sdk

The code itself should compile correctly, but there are many options that are specific for you PC ... In Visual Studio, you have to correctly set the paths to where you have the sdk installed and so on.

You will see there are options for 32/64 bits.. debug and release..

For that you can google, the instructions.. compile a "hello world" for ida, and then try to compile this. 

If you want the latest version of the jump table plugin you can use this precompiled http://www.multiupload.com/07RP8RSDF3

=Continuing your or someone else's work in another database=

You might stump with someone's IDA database and you would like to continue his work.
Or you found that there is a new great plugin/script that makes everything easier but you don´t want to loose your work.

==Continuing graf_chokolo's work==

I will take this as an example, the elf that runs in procs 6 (the one that has to do with QA flag, dongleaut, etc)

You might find some "coolstuff" but IDA doesnt find the xrefs and it is partially analyzed. 

===Isolate what you want to copy===

1. Step identify what you want to extract from that database, in this case:
----
*comments
*function names

2. Produce File -> Database to idc
----
Assuming you produced a file named DATABASE.IDC

This file contains all what he has done to his database. We only want his function renames and comments so in linux we do
<pre>
grep "MakeComm" DATABASE.IDC
</pre>

<pre>
grep "MakeName" DATABASE.IDC
</pre>

Copy this lines to another file. as an example COMMANDS.TXT

===Create your own database===
Extract the same elf from lv1.self (the elf we are using as an example is embedded in lv1 (look for matches and extrat that elf with a hex editor)

1. Load the elf you want (the one that runs in proces 6) // With the auto-analysis option disabled

I built a script that makes a good analyze of it and most of the embedded elfs.

analize_lv1_embedded_elf.idc
 
this script works only if you have an elf with all its segment properly named (like the ones embedded in lv1)

2. Run the script

3. Enable auto-analysis

===Merge the databases===

1. Paste the commands you copied in COMMANDS.TXT in the IDC window (or create an IDC script out of it)

2. ???????

3. Profit


= Recommended IDA references =
* [http://www.amazon.com/IDA-Pro-Book-Unofficial-Disassembler/dp/1593271786/ref=sr_1_1?ie=UTF8&qid=1328764116&sr=8-1 The IDA Pro Book - The Unofficial Guide to the World's Most Popular Disassembler - by Chris Eagle] / August 2008, 640 pp. $59.95 / ISBN-10 1-59327-178-6 / ISBN-13 978-1-59327-178-7


{{Reverse engineering}}<noinclude>[[Category:Main]]</noinclude>