72 Chapt er 5 Figure 5-8: Example of undetected string data The result is that the string at location .rdata:0040C19C (“Please guess a num- ber between 1 and %d.”) remains undetected. The moral here is to make sure that you are looking for all of the types of strings you expect to encounter in all of the places you might find them. The Names Window The Names window, shown in Figure 5-9, provides a summary listing of all of the global names within a binary. A name is nothing more than a symbolic description given to a program virtual address. IDA initially derives the list of names from symbol-table and signature analysis during the initial loading of a file. Names can be sorted alphabetically or in virtual address order (either ascending or descending). The Names window is useful for rapidly navigating to known locations within a program listing. Double-clicking any Names window entry will immediately jump the disassembly view to display the selected name. Figure 5-9: The Names window I DA Dat a Di spl ays 73 Displayed names are both color and letter coded. The coding scheme is summarized below: As you browse through disassemblies, you will notice that there are many named locations for which no name is listed in the Names window. In the process of disassembling a program, IDA generates names for all locations that are referenced directly either as code (a branch or call target) or as data (read, written, or address taken). If a location is named in the program’s symbol table, IDA adopts the name from the symbol table. If no symbol table entry is available for a given program location, IDA generates a default name for use in the disassembly. When IDA chooses to name a location, the virtual address of the location is combined with a prefix that indicates what type of location is being named. Incorporating the virtual address into a generated name ensures that all generated names will be unique, as no two locations can share the same virtual address. Autogenerated names of this type are not displayed in the Names window. Some of the more common prefixes used for autogenerated names include these: F A regular function. These are functions that IDA does not recog- nize as library functions. L A library function. IDA recognizes library functions through the use of signature-matching algorithms. If a signature does not exist for a given library function, the function will be labeled as a regu- lar function instead. I An imported name, most commonly a function name imported from a shared library. The difference between this and a library function is that no code is present for an imported name, while the body of a library function will be present in the disassembly. C Named code. These are named program instruction locations that IDA does not consider to be part of any function. This is pos- sible when IDA finds a name in a program’s symbol table but never sees a call to the corresponding program location. D Data. Named data locations typically represent global variables. A String data. This is a referenced data location containing a se- quence of characters that conform to one of IDA’s known string data types, such as a null-terminated ASCII C string. sub_xxxxxx A subroutine at address xxxxxx loc_xxxxxx An instruction location at address xxxxxx byte_xxxxxx 8-bit data at location xxxxxx word_xxxxxx 16-bit data at location xxxxxx dword_xxxxxx 32-bit data at location xxxxxx unk_xxxxxx Data of unknown size at location xxxxxx 74 Chapt er 5 Throughout the course of the book we will show additional algorithms that IDA applies in choosing names for program data locations. The Segments Window The Segments window displays a summary listing of the segments present in the binary file. Note that what IDA terms segments are most often called sections when discussing the structure of binary files. Do not confuse the use of the term segments in this manner with the memory segments associated with CPUs that implement a segmented memory architecture. Information presented in the window includes the segment name, start and end addresses, and permission flags. The start and end addresses represent the virtual address range to which the program sections will be mapped at runtime. The following listing is an example of Segments window content from a Windows binary: Name Start End R W X D L Align Base Type Class AD es ss ds fs gs UPX0 00401000 00407000 R W X . L para 0001 public CODE 32 0000 0000 0001 FFFFFFFF FFFFFFFF UPX1 00407000 00408000 R W X . L para 0002 public CODE 32 0000 0000 0001 FFFFFFFF FFFFFFFF UPX2 00408000 0040803C R W . . L para 0003 public DATA 32 0000 0000 0001 FFFFFFFF FFFFFFFF .idata 0040803C 00408050 R W . . L para 0003 public XTRN 32 0000 0000 0001 FFFFFFFF FFFFFFFF UPX2 00408050 00409000 R W . . L para 0003 public DATA 32 0000 0000 0001 FFFFFFFF FFFFFFFF In this case, we might quickly suspect that something is funny with this particular binary since it uses nonstandard segment names and has two exe- cutable segments that are writable, thus indicating the possibility of self- modifying code (more on this in Chapter 21). The fact that IDA knows the size of a segment does not indicate that IDA knows the contents of the seg- ment. For a variety of reasons, segments often occupy less space on disk than they do in memory. In such cases, IDA displays values for the portions of the segment that IDA has determined it could fill from the disk file. For the remainder of the segment, IDA displays question marks. Double-clicking any entry in the window jumps the disassembly view to the start of the selected segment. Right-clicking an entry provides a context menu from which you can add new segments, delete existing segments, or edit the properties of existing segments. These features are particularly useful when reverse engineering files with nonstandard formats, as the binary’s segment structure may not have been detected by the IDA loader. Command-line counterparts to the Segments window include objdump ( -h ), readelf ( -S ), and dumpbin ( /HEADERS ). The Signatures Window IDA makes use of an extensive library of signatures for identifying known blocks of code. Signatures are used to identify common compiler-generated startup sequences in an attempt to determine the compiler that may have been used to build a given binary. Signatures are also used to categorize functions as known library functions inserted by a compiler or as functions added to the binary as a result of static linking. When IDA identifies library I DA Dat a Di spl ays 75 functions for you, you can focus more of your effort on the code that IDA did not recognize (which is probably far more interesting to you than reverse engineering the inner workings of printf ). The Signatures window is used to list the signatures that IDA has already matched against the open binary file. An example from a Windows PE file is shown here: File State #func Library name vc32rtf Applied 501 Microsoft VisualC 2-8/net runtime This example indicates that IDA has applied the vc32rtf signatures (from <IDADIR>/sigs) against the binary and, in doing so, has been able to recognize 501 functions as library functions. That’s 501 functions that you will not need to reverse engineer! In at least two cases, you will want to know how to apply additional sig- natures against your binaries. In the first case, IDA may fail to recognize the compiler that was used to build a binary, with a resulting inability to select appropriate signatures to apply. In this case, you may wish to force IDA to apply one or more signatures that your preliminary analysis has led you to believe IDA should try. The second situation involves creating your own sig- natures for libraries that may not have existing signatures included with IDA. An example might be the creation of signatures for the static version of the OpenSSL libraries that ship with FreeBSD 8.0. DataRescue makes a toolkit available for generating custom signatures that can be used by IDA’s signa- ture-matching engine. We’ll cover the generation of custom signatures in Chapter 12. Regardless of why you want to apply new signatures, either press- ing the INSERT key or right-clicking the Signatures window will offer you the Apply new signature option, at which time you can choose from a list of all signatures known to your installation of IDA. The Type Libraries Window Similar in concept to the Signatures window is the Type Libraries window. Type libraries represent IDA’s accumulated knowledge of predefined datatypes and function prototypes gleaned from header files included with most pop- ular compilers. By processing header files, IDA understands the datatypes that are expected by common library functions and can annotate your disas- semblies accordingly. Similarly, from these header files IDA understands both the size and layout of complex data structures. All of this type informa- tion is collected into TIL files (<IDADIR>/til) and applied any time a binary is analyzed. As with signatures, IDA must first be able to deduce the libraries that a program uses before it can select an appropriate set of TIL files to load. You can request that IDA load additional type libraries by pressing the INSERT key or by right-clicking within the Type Libraries window and choosing Load type library. Type libraries are covered in more detail in Chapter 13. 76 Chapt er 5 The Function Calls Window In any program, a function can both call and be called by other functions. In fact, it is a fairly simple task to construct a graph that displays the relation- ships between callers and callees. Such a graph is called a function call graph or function call tree (we will demonstrate how to have IDA generate such graphs in Chapter 9). On occasion, we may not be interested in seeing the entire call graph of a program; instead, we may be interested only in knowing the immediate neighbors of a given function. For our purposes, we will call Y a neighbor of X if Y directly calls X or X directly calls Y. The Function Calls window provides the answer to this neighbor question. When you open the Function Calls window, IDA determines the neighbors of the function in which the cursor is positioned and generates a display such as that shown in Figure 5-10. Figure 5-10: The Function Calls window In this example, we see that the function named sub_40182C is called from six different locations in _main and _main in turn makes 15 other function calls. Double-clicking any line within the Function Calls window immediately jumps the disassembly window to the selected calling or called function (or caller and callee). IDA cross-references (xrefs) are the mechanisms that underlie the generation of the Function Calls windows. Xrefs will be covered in more detail in Chapter 9. The Problems Window The Problems window is IDA’s way of informing you of any difficulties that it has encountered in disassembling a binary and how it has chosen to deal with those difficulties. In some instances, you may be able to manipulate the disassembly to help IDA overcome a problem, and in other instances you may not. You can expect to encounter problems in even the simplest of I DA Dat a Di spl ays 77 binaries. In many cases, simply choosing to ignore the problems is not a bad strategy. In order to correct many of the problems, you need to have a better understanding of the binary than IDA has, which for most of us is probably not going to happen. A sample set of problems follows: Address Type Instruction .text:0040104C BOUNDS call eax .text:004010B0 BOUNDS call eax .text:00401108 BOUNDS call eax .text:00401350 BOUNDS call dword ptr [eax] .text:004012A0 DECISION push ebp .text:004012D0 DECISION push ebp .text:00401560 DECISION jmp ds:__set_app_type .text:004015F8 DECISION dd 0FFFFFFFFh .text:004015FC DECISION dd 0 Each problem is characterized by (1) the address at which the problem occurs, (2) the type of problem encountered, and (3) the instruction present at the problem location. In this example, we see a BOUNDS problem and a DECISION problem. A BOUNDS problem occurs when the destination of a call or jump either can’t be determined (as in this example, since the value of eax is unknown to IDA) or appears to lie outside the range of virtual addresses in a program. A DECISION problem is most often not a problem at all. A DECISION usually represents an address at which IDA has chosen to disassemble bytes as instructions rather than data even though the address has never been referenced during the recursive descent instruction traversal (see Chapter 1). A complete list of problem types and suggestions for how to deal with them is available in the built-in IDA help file (see topic Problems List). Summary At first glance, the number of displays that IDA offers can seem overwhelm- ing. You may find it easiest to stick with the primary displays until you are comfortable enough to begin exploring the additional display offerings. In any case, you should certainly not feel obligated to use everything that IDA throws at you. Not every window will be useful in every reverse engineering scenario. In addition to the windows covered in this chapter, you will be confronted by a tremendous number of dialogs as you endeavor to master IDA. We will introduce key dialogs as they become relevant in the remainder of the book. Finally, other than the default disassembly view graph, we have elected not to cover graphs in this chapter. The IDA menu system distinguishes graphs as a separate category of display from the subviews discussed in this chapter. We will cover the reasons behind this in Chapter 9, which deals exclusively with graphs. At this point, you should be starting to get comfortable with the IDA user interface. In the next chapter, we begin to focus on the many ways that you can manipulate a disassembly to enhance your understanding of its behavior and to generally make your life easier with IDA. JMP EBP SUB DI SASSE MBL Y NAVI GAT I ON In this and the following chapter we cover the heart of what puts the Interactive in IDA Pro, which is, in a nutshell, ease of navi- gation and ease of manipulation. The focus of this chapter is navigation; specifically, we show how IDA facilitates moving around a disassembly in a logical manner. So far, we have shown that at a basic level IDA simply combines the features of many common reverse engineering tools into an integrated disassembly display. Navigating around the display is one of the essential skills required in order to master IDA. Static disassembly listings offer no inherent navigational capability other than scrolling up and down the listing. Even with the best text editors, such dead listings are very difficult to navigate, as the best they have to offer is generally nothing more than an integrated, grep -style search. As you shall see, IDA’s database underpinnings provide for exceptional navigational features. 80 Chapt er 6 Basic IDA Navigation In your initial experience with IDA, you may be happy to make use of nothing more than the navigational features that IDA has to offer. In addition to offering fairly standard search features that you are accustomed to from your use of text editors or word processors, IDA develops and displays a comprehen- sive list of cross-references that behave in a manner similar to hyperlinks on a web page. The end result is that, in most cases, navigating to locations of interest requires nothing more than a double-click. Double-Click Navigation When a program is disassembled, every location in the program is assigned a virtual address. As a result, we can navigate anywhere within a program by providing the virtual address of the location we are interested in visiting. Unfortunately for us, maintaining a catalog of addresses in our head is not a trivial task. This fact motivated early programmers to assign symbolic names to program locations that they wished to reference, making things a whole lot easier on themselves. The assignment of symbolic names to program addresses was not unlike the assignment of mnemonic instruction names to program opcodes; programs became easier to read and write by making them easier to remember. As we discussed previously, IDA generates symbolic names during the analysis phase by examining a binary’s symbol table or by automatically gen- erating a name based on how a location is referenced within the binary. In addition to its symbolic purpose, any name displayed in the disassembly window is a potential navigation target similar to a hyperlink on a web page. The two differences between these names and standard hyperlinks are (1) that the names are never highlighted in any way to indicate that they can be followed and (2) that IDA requires a double-click to follow rather than the sin- gle-click required by a hyperlink. We have already seen the use of names in various subwindows such as the Functions, Imports, and Exports windows. Recall that for each of these windows, double-clicking a name caused the dis- assembly view to jump to the referenced location. This is one example of the double-click navigation at work. In the following listing, each of the symbols labeled X represents a named navigational target. Double-clicking any of them will cause IDA to relocate the display to the selected location. .text:0040132B loc_40132B: ; CODE XREF: Ysub_4012E4+B^j .text:0040132B cmp edx, 0CDh .text:00401331 jg short Xloc_40134E .text:00401333 jz Xloc_4013BF .text:00401339 sub edx, 0Ah .text:0040133C jz short Xloc_4013A7 .text:0040133E sub edx, 0C1h .text:00401344 jz short Xloc_4013AF .text:00401346 dec edx .text:00401347 jz short Xloc_4013B7 .text:00401349 jmp Xloc_4013DD ; default .text:00401349 ; jumptable 00401300 case 0 Di sassembl y Navi gat i on 81 .text:0040134E ; ---------------------------------------------------------- .text:0040134E .text:0040134E loc_40134E: ; CODE XREF: Ysub_4012E4+4D^j For navigational purposes, IDA treats two additional display entities as nav- igational targets. First, cross-references (shown at Y here) are treated as navigational targets. Cross-references are generally formated as a name and a hex offset. The cross-reference at the right of loc_40134E in the previous listing refers to a location that is 4D 16 or 77 10 bytes beyond the start of sub_4012E4 . Double-clicking the cross-reference text will jump the display to the referen- cing location ( 00401331 in this case). Cross-references are covered in more detail in Chapter 9. The second type of display entity afforded special treatment in a naviga- tional sense is one that uses hexadecimal values. If a displayed hexadecimal value represents a valid virtual address within the binary, then double-clicking the value will reposition the disassembly window to display the selected virtual address. In the listing that follows, double-clicking any of the values indicated by Z will jump the display, because each is a valid virtual address within the given binary, while double-clicking any of the values indicated by [ will have no effect. .data:00409013 db [4 .data:00409014 dd Z4037B0h .data:00409018 db [0 .data:00409019 db [0Ah .data:0040901A dd Z404590h .data:0040901E db [0 .data:0040901F db [0Ah .data:00409020 dd Z404DA8h A final note about double-click navigation concerns the IDA Output window, which is most often used to display informational messages. When a navigational target, as previously described, appears as the first item in a message, double-clicking the message will jump the display to the indicated target. Propagating type information... Function argument information has been propagated The initial autoanalysis has been finished. \ 40134e is an interesting location ] Testing: 40134e \ loc_4013B7 ] Testing: loc_4013B7 In the Output window excerpt just shown, the two messages indicated by\ can be used to navigate to the addresses indicated at the start of the respective messages. Double-clicking any of the other messages, including those at ], will result in no action at all. 82 Chapt er 6 Jump to Address Occasionally, you will know exactly what address you would like to navigate to, yet no name will be handy in the disassembly window to offer simple double- click navigation. In such a case, you have a few options. The first, and most primitive, option is to use the disassembly window scroll bar to scroll the display up or down until the desired location comes into view. This is usually feasible only when the location you are navigating to is known by its virtual address, since the disassembly window is organized linearly by virtual address. If all you know is a named location such as a subroutine named foobar , then navigating via the scroll bar becomes something of a needle-in-a-haystack search. At that point, you might choose to sort the Functions window alpha- betically, scroll to the desired name, and double-click the name. A third option is to use one of IDA’s search features available via the Search menu, which typ- ically involves specifying some search criteria before asking IDA to perform a search. In the case of searching for a known location, this is usually overkill. Ultimately, the easiest way to get to a known disassembly location is to make use of the Jump to Address dialog shown in Figure 6-1. Figure 6-1: The Jump to Address dialog The Jump to Address dialog is accessed via JumpJump to Address, or by using the G hotkey while the disassembly window is active. Thinking of this dialog as the Go dialog may help you remember the associated hotkey. Navigating to any location in the binary is as simple as specifying the address (a name or hex value will do) and clicking OK, which will immediately jump the display to the desired location. Values entered into the dialog are remem- bered and made available on subsequent use via a drop-down list. This history feature makes returning to previously requested locations somewhat easier. Navigation History If we compare IDA’s document-navigation functions to those of a web browser, we might equate names and addresses to hyperlinks, as each can be followed relatively easily to view a new location. Another feature IDA shares with tradi- tional web browsers is the concept of forward and backward navigation based on the order in which you navigate the disassembly. Each time you navigate to a new location within a disassembly, your current location is appended to a history list. Two menu operations are available for traversing this list. First, Jump Jump to Previous Position repositions the disassembly to the most recent entry in the history list. The behavior is conceptually identical to a web browser’s back button. The associated hotkey is ESC , and it is one of the most useful hotkeys that you can commit to memory. Be forewarned, how- ever, that using ESC when any window other than the disassembly window is Di sassembl y Navi gat i on 83 active causes the active window to be closed. (You can always reopen windows that you closed accidentally via ViewOpen Subviews.) Backward navigation is extremely handy when you have followed a chain of function calls several levels deep and you decide that you want to navigate back to your original position within the disassembly. Jump Jump to Next Position is the counterpart operation that moves the disassembly window forward in the history list in a manner similar to a web browser’s forward button. For the sake of completeness, the associated hotkey for this operation is CTRL - ENTER , though it tends to be less useful than using ESC for backward navigation. Stack Frames Because IDA Pro is such a low-level analysis tool, many of its features and displays expect the user to be somewhat familiar with the low-level details of compiled languages, many of which center on the specifics of generating machine language and managing the memory used by a high-level program. Therefore, from time to time this book covers some of the theory of compiled programs in order to make sense of the related IDA displays. One such low-level concept is that of the stack frame. Stack frames are blocks of memory allocated within a program’s runtime stack and dedicated to a specific invocation of a function. Programmers typically group executable statements into units called functions (also called procedures, subroutines, or methods). In some cases this may be a requirement of the language being used. In most cases it is considered good programming practice to build programs from such functional units. When a function is not executing, it typically requires little to no memory. When a function is called, however, it may require memory for several reasons. First, the caller of a function may wish to pass information into the function in the form of parameters (arguments), and these parameters need to be stored somewhere the function can find them. Second, the function may need temporary storage space while performing its task. This temporary space is often allocated by a programmer through the declaration of local variables, which can be used within the function but cannot be accessed once the function has completed. Compilers utilize stack frames (also called activation records) to make the allocation and deallocation of function parameters and local variables trans- parent to the programmer. A compiler inserts code to place a function’s parameters into the stack frame prior to transferring control to the function itself, at which point the compiler inserts code to allocate enough memory to Finally, two of the more useful toolbar but- tons, shown in Figure 6-2, provide the familiar browser-style forward and backward behavior. Each of the buttons is associated with a drop- down history list that offers you instant access to any location in the navigation history without having to trace your steps through the entire list. Figure 6-2: Forward and backward navi- gation buttons 84 Chapt er 6 hold the function’s local variables. As a consequence of the way stack frames are constructed, the address to which the function should return is also stored within the new stack frame. A pleasant result of the use of stack frames is that recursion becomes possible, as each recursive call to a function is given its own stack frame, neatly segregating each call from its predecessor. The following steps detail the operations that take place when a function is called: 1.The caller places any parameters required by the function being called into locations as dictated by the calling convention (see “Calling Con- ventions” on page 85) employed by the called function. This operation may result in a change to the program stack pointer if parameters are placed on the runtime stack. 2.The caller transfers control to the function being called. This is usually performed with an instruction such as the x86 CALL or the MIPS JAL . A return address is typically saved onto the program stack or in a CPU register. 3.If necessary, the called function takes steps to configure a frame pointer 1 and saves any register values that the caller expects to remain unchanged. 4.The called function allocates space for any local variables that it may require. This is often done by adjusting the program stack pointer to reserve space on the runtime stack. 5.The called function performs its operations, potentially generating a result. In the course of performing its operations, the called function may access the parameters passed to it by the calling function. If the func- tion returns a result, the result is often placed into a specific register or registers that the caller can examine once the function returns. 6.Once the function has completed its operations, any stack space reserved for local variables is released. This is often done by reversing the actions performed in step 4. 7.Any registers whose values were saved (in step 3) on behalf of the caller are restored to their original values. This includes the restoration of the caller’s frame pointer register. 8.The called function returns control to the caller. Typical instructions for this include the x86 RET and the MIPS JR instructions. Depending on the calling convention in use, this operation may also serve to clear one or more parameters from the program stack. 9.Once the caller regains control, it may need to remove parameters from the program stack. In such cases a stack adjustment may be required to restore the program stack pointer to the value that it held prior to step 1. 1. A frame pointer is a register that points to a location inside a stack frame. Variables within the stack frame are typically referenced by their relative distance from the location to which the frame pointer points.