Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Help needed with: getting the right format into IDA

Topic created on: February 4, 2010 01:41 CST by Metalskin .

I need Help!!!

1. I try to track the input streaming of data from a download via wireshark. these data is store in raw format.

2. I wishes to retrieve this format and put it into IDA for viewing its code. but i just couldn't get the right format.

Any one experience to help mi??

  RabidCicada     February 9, 2010 11:01.13 CST
You need to be MUCH more clear on what you are trying to do.

IDA Pro (Interactive DissAssembler Pro) is intended to dissect and reverse engineer software Code.  This implies that the "data" which you are putting into IDA is actually code and not just some raw data.  IDA must be able to recognize what kind of code it's analyzing and you can overide and provide hints for how IDA should look at the code.

Usually anything you catch via wireshark is simply just data...unless you are watching binary excetuable code being transferred across the network.

In either case both tools work to identify what you are looking at.  IDA will try to auto recognize the file format.
If it doesn't have a "signature" for that file format it will not auto load and analyze.  In that case you will have to manually tell it how to load the file (not trivial...get the IDA Pro Book or surf the web some more, I'm not going to explain)

Wireshark will try to identify protocols it recognizes.  But that will only work for "standard" protocols.  By standard, I mean those protocols implemented enough that someone has written a "dissector" module for it in wireshark.

Note: Registration is required to post to the forums.

Active in Last 5 Minutes
timtoady

There are 21,677 total registered users.


Recently Created Topics
PyEmu error when cal...
Sep/02
Restore Themida/Winl...
Sep/02
Anti-olly technique
Aug/30
RAR Password
Aug/29
Heap protection on W...
Aug/23
Why Inline asm in C+...
Aug/20
Bypassing OllyAdvance
Aug/17
Error in logic for g...
Aug/17
Has anyone seen this...
Aug/17
ARM Executable - Pat...
Aug/16


Recent Forum Posts
reverse engineering ...
raiden56
pydbg, memory breakp...
Researc...
RAR Password
Ineedhelp
RAR Password
cod
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
voila
Heap protection on W...
j00ru
Heap protection on W...
psylocn
Why Inline asm in C+...
ronnie2...


Recent Blog Entries
meshmesh
Sep/01
Is it legal??

waleedassar
Aug/30
Anti-olly technique

QvasiModo
Aug/24
WinAppDbg 1.4 is out!

artemblagodarenko
Aug/18
Dataflow-0.2.0 released. Ne...

grzonu
Aug/17
Bypassing OllyAdvanced

More ...


Recent Blog Comments
tosanjay on:
Sep/02
PyEmu 0.0.2

GynvaelColdwind on:
Sep/01
Is it legal??

PeterFerrie on:
Aug/31
Anti-olly technique

dennis on:
Aug/26
Dr. Gadget IDAPython plugin

halsten on:
Aug/19
Dataflow-0.2.0 released. Ne...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit