An IDA user very kindly sent us the following link

http://www.avertlabs.com/research/blog/index.php/2010/01/18/an-insight-into-the-aurora-communication-protocol/

How Appcall works

1. Save the current thread context
2. Serialize the parameters (we do not allocate memory for the parameters, we use the debuggee's stack)
3. Modify the input registers in question
4. Set the instruction pointer to the beginning of the function to be called
5. Adjust the return address so it points to a special area where we have a breakpoint (we refer to it as control breakpoint)
6. Resume the program and wait until we get an exception or the control breakpoint (inserted in the previous step)
7. Deserialize back the input (only for parameters passed by reference) and save the return value

Before diving in, please keep in mind that this blog entry is a short version of the full Appcall reference found here.

IDA Pro 5.6 has a new feature: automatic running of the QEMU emulator. It can be used to debug small code snippets directly from the database. In this tutorial we will show how to dynamically run code that can be difficult to analyze statically.

Target

As an example we will use shellcode from the article "Alphanumeric RISC ARM Shellcode" in Phrack 66. It is self-modifying and because of alphanumeric limitation can be quite hard to undestand. So we will use the debugging feature to decode it.

http://www.hex-rays.com/contest.shtml

Or you may directly go to the contest results and check out some cool plugins:

http://www.hex-rays.com/contest2009

It was our first contest, but we are happy with the results and will repeat it in the near future.
Have fun!

Requirements:

* strong knowledge of C/C++
* experience with Qt and GUI development is a big PLUS
* knowledge of x86 assembler and unwillingness to use it in development
* cross platform development (Windows/Linux/Mac) is a plus
* knowing the graph theory and how compilers work is a plus
* ability and willingness to write secure yet fast code
* good problem solving and communication skills

To apply, please send your resume to info@hex-rays.com
Code samples and links to implemented projects are welcome.

Recently, we added graphing support into IDAPython and now Python scripts can build interactive graphs.
To demonstrate this new addition, we will write a small script that graphs the structured exception handlers of a given process.

]]> http://hexblog.com/2009/10/seh_graph.html http://hexblog.com/2009/10/seh_graph.html IDA Pro Mon, 05 Oct 2009 17:08:45 +0100

• Text search: Used to search the listing for text patterns (regular expressions are allowed). One can write a regular expression to find any assignment to the eax register (with the mov instruction)
  
  
• Binary search: Allows you to search for binary patterns with wildcard support. It is also possible to search for strings alongside with the binary patterns.
  
  
• Immediate search: Very useful to find constants and magic numbers used in the program.
• Please refer to the search menu for other search facilities

assemble,               // Assemble an instruction
                        // (display a warning if an error is found)
                        // args:
                        //  ea_t ea -  linear address of instruction
                        //  ea_t cs -  cs of instruction
                        //  ea_t ip -  ip of instruction
                        //  bool use32 - is 32bit segment?
                        //  const char *line - line to assemble
                        //  uchar *bin - pointer to output opcode buffer
                        // returns size of the instruction in bytes

find("33 c0;pop ebp;ret")

1. Do some input initial validation
2. Split the patterns
3. Loop:
   1. Determine if the pattern is an assembly instruction or opcode list (using a simple regular expression)
   2. If pattern is an instruction then assemble it
   3. Accumulate the assembled (or converted opcodes) into a single buffer
4. Now that we have one single binary buffer we can search for it with FindBinary()
5. Display the result