دانلود کتاب مهندسی معکوس کد با IDA Pro

Sooner or later you will want to know absolutely everything about an executable fi le. You may want to know, for instance: ■ The exact memory address that it is calling ■ The exact region of memory that it is writing to ■ What region it’s reading from ■ Which registers it’s making use of Debuggers will aid you in reverse-engineering a fi le for which you don’t have the source code, by disassembling the fi le in question. This comes in handy when you’re analyzing malware, as you almost never have access to the executable’s original source code. The goal of this section is not to coach you in depth on how to use these debuggers, but simply to show you that they are out there and available for you to use. Debuggers are very powerful tools that take a long time to learn to use to their fullest extent. The “cream of the crop” in debuggers and the focus of this book is Interactive Disassembler Pro (IDA Pro), available from DataRescue. IDA Pro should be your fi rst choice of debuggers for an enterprise environment. It isn’t really expensive, and is well worth the nominal outlay for the features it offers.