📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Understanding syntax generated by IDA Pro

Topic created on: January 13, 2010 14:46 CST by DrWho .

Hello to all, I am a newbie to reverse engineering and I have downloaded the latest trial version of IDA Pro for disassembly and debugging. I disassembled an EXE file written for use on Win 7 64 bit but there are items in the syntax that I have never seen before. The following is a couple of samples and I am hoping someone can provide some help.

Item 1. mov     rax, cs:qword_14003A358
    I follow the mov command and that qword is a quad word but I don't understand cs:qword_14003A358 as a whole.

Item 2. .data:000000014003A358 qword_14003A358 dq 2B992DDFA232h        ; DATA XREF: sub_140002960+1Fr
    In this line the character  is actually an upward pointing arrow in the IDA Pro text. Even though it is in the Comments section of the line, can someone tell me what the upward arrow means, never seen that before.

all help is greatly appreciated

  phn1x     January 14, 2010 11:30.25 CST
Item 1:
This is a segment register, specifically the code segment register. These are provided by Intel to reduce code complexity and address translation time. It's not an IDA syntax.
Take a moment and read Volume 3A, Chapter 3 of the Intel System Programming Guide
http://www.intel.com/Assets/PDF/manual/253668.pdf

Item 2:
The upward arrow indicates where in the IDA database the selection is referenced.

The item in question is in the data segment and is referenced at an offset 0x1F into the function sub_140002960, whose location in the database (and the file really) is above (.text section) your current location.

  RabidCicada     January 18, 2010 10:36.35 CST
The Intel Doc's as they are lovingly referred to will be a good friend while you are REing on a n x86 or x64 platform:).  They provide all the information for the processor hardware you are reversing on.

Intel Docs are located here

There is a tremendous amount to read and understand.  Pay particular attention to the details present in the text.  They say exactly what they mean and do not really call out very important facts.  ALL of the facts are important.

A good book to understand IDA itself better is "The Ida Pro Book" by Chris Eagle.  It explains everything about IDA.

If you are going to be REing applications only then you should be pretty familiar with the windows api's.

If you are going to be reversing at a lower level then you should read up on on address translation,segmentation, paging, and how to get your own OS running in order to better understand all of the mechanisms as work.  The Intel Docs cover much of this.  You will also need to read up on undocumented apis etc of windows if you will be reversing from within windows.

Big world out there.  It's gonna hurt getting into REing:).

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit