Advanced Reverse Engineering with IDA (2 days)

This course is intended for experienced IDA users who want to take advantage of its open architecture by extending and improving it. They will learn how write modules to modify the listing, react to events, decrypt data right in the database, and many other things. After the course you will have solid understanding of IDA concepts, classes, and programming interface.

We will implement several useful plugins. Be prepared to program a lot in this training!

Requirements

C/C++ programming skills as well as solid reverse engineering experience are required.
The training will end with a free section devoted to your questions.

Course Outline:

IDA architecture overview

• Modules
• Memory representation
• Database organization

SDK

• Setting up
• Processor module framework
• Loader framework
• Plugin framework
• How to debug custom modules

IDA subsystems

• Utils: i/o, custom stl, regex, misc
• Database: netnodes and flags
• Foundations: bytes, names, offsets, etc
• Address range class: segments and functions
• Accessing and using IDC
• Cross-references
• Functions
• Events
• Type information
• Structures and enums
• Debugger
• User interface
• Graphing
• Decompiler Framework

Plugin programming

• General guidelines
• Plugin samples/exercises
• Colorizer
• Object extractor
• Debugger helper
• Type information
• Graph plugin
• Processor extension
• Reaction to events