PDA

View Full Version : getting started with IDA


lock
October 3rd, 2007, 14:30
A bit of a newb question, but is it possible to graph an entire executable or dll with IDA? I know this might be quite large, but with 20-30 different functions in the app i'm looking at, it might help visualize things.

How does everyone else get started when reversing a piece of malware? Just look for some interesting strings and then go from there?

LLXX
October 3rd, 2007, 22:39
It'll take an extremely large amount of time, and based on the fact that IDA's graphs aren't that easily navigated, I doubt it would make it much clearer anyway. (Also, you need to select *only* code, areas of data tend to make it divide by zero...)

I start at the entry point, obviously.

dELTA
October 4th, 2007, 02:47
Some good starting points are often:

1. Strings.

2. Imports.

3. Exports.

4. The entrypoint of the executable.