2

When using IDA Pro, there are a number of features that can be used to make reading the disassembled code far easier - renaming variables, defining data structures, colouring blocks of code, moving blocks of code about (in addition to the graph, which is very useful).

If you use a conventional disassembler, this isn't available.

Traditionally, I would use a combination of printed out code and pencil along with annotated text files to analyse the disassembly, but I feel this is a long way from what IDA Pro provides.

Are there any tools to make this job easier? I am not looking for alternative graphical disassemblers to IDA as there will always be times when you are limited to the output from tools such as objdump or proprietary command line utilities.

Cybergibbons
  • 1,762
  • 2
  • 17
  • 26
  • "there will always be times when you are limited to text listings" -- I'm not sure I agree with this. Aside from people posting short snippets of assembly code on forums such as this one from time to time, I find I'm never "limited to text listings." Can you provide more context regarding the situations in which you find yourself? – Jason Geffner Jun 29 '13 at 14:01
  • Are you trying to find improved ways to document your work ? Please clarify. – PSS Jun 29 '13 at 14:39
  • PSS, I'm looking for tools to help read, annotate, describe and work with disassembled code. – Cybergibbons Jun 29 '13 at 20:47
  • Jason Geffner, if I objdump some code from a hex file, all I am left with is a text listing of disassembly. – Cybergibbons Jun 29 '13 at 20:48
  • @Cybergibbons - If you want to annotate a disassembly then you should be using IDA, not objdump. A big part of reverse engineering is using the right tool for the right job. – Jason Geffner Jun 29 '13 at 22:45
  • Jason - how do you use IDA for unsupported processors? – Cybergibbons Jun 30 '13 at 04:49

1 Answers1

5

I agree with comments above. IDA Pro does offer everything one might need to annotate your work and keep it organized. IDA Pro offers four types of comments:

  1. Regular Comments. Regular comments are placed at the end of each assembly line and pretty straight forward to use. In order to insert regular comment you could just right-click in the right margin of the assembly or press colon (:) hot key.
  2. Repeatable Comments. Repeatable comment is a comment which automatically appears in multiple locations. It behaves in cross-reference like manner. For example, repeatable comment put on je short 121212 would not only show next to the instruction, but will also propagate to 121212 address. Basically, original comment gets echoed to the referenced location. One can place repeatable comment by pressing semicolon (;) hotkey.
  3. Anterior and Posterior Lines. Anterior and posterior lines are full-line comments, which one can place before or after disassembly line. These type of comments is not prefixed with semicolon character.
  4. Function Comment. Function comments are comments grouped on the top or the bottom of the function. Those are very useful to create notes on function prototypes. Function comments are created by highlighting function name and creating regular comment or repeatable comment. Please note, in case you create repeatable comment, it will get echoed to every location the function is called from.

It almost feels like you are trying to find ways to improve your workflow. What makes the most sense to me is to have your workflow organized in certain predetermined and structured way, get consistent with it, and constantly improve on it.

Several things might help you organize your workflow:

  • Create predefined sub-directory for each project you work with. You can create an empty template sub-directory structure, which you can copy to new project. It will stay consistent through out different projects and will make it very easy to store, navigate and search for stuff. Think of what makes sense to you. Ultimately, it needs to make sense to you and work for you.
  • Create report template. Again, you can have it anyway you like it. The important thing is to have a template. You can build and improve on it as you go. As an example, I have my working version of a report divided into two main sub-sections: static analysis and execution. I describe everything 'stationary' about a binary in my static analysis. In addition, I use 'execution' section to describe what happens whenever binary runs.
  • Maintain notes in organized manner. You can run a file where you maintain your notes in a structured way. Again, it is very much arbitrary thing. Whatever works for you. I prefer not to clutter IDA with excessive comments. For example, I like to create C-style representation of stuff. I usually keep it at the end of the 'notes' file. Other comments go in front.

Eventually, we are users, who 'drive' tools. Remember, at times a great tool is as good as one who uses it ;)

PSS
  • 3,088
  • 1
  • 21
  • 35
  • Thanks, this is a great answer. Can you load arbitrary disassembly into IDA? All three microcontrollers I am working with at the moment aren't supported, and writing a new processor module seems very time consuming. – Cybergibbons Jun 30 '13 at 05:57
  • I am not sure. I never had to deal with anything that IDA doesn't support in my line of work. It is a great question to ask next though :) – PSS Jun 30 '13 at 06:24
  • 1
    "writing a new processor module seems very time consuming" - You may want to take a look at http://www.hexblog.com/?p=116 - still time consuming, but hopefully less so. – Jason Geffner Jun 30 '13 at 14:46
  • @cybergibbons You should consider opening another question and provide specifics on what microcontroller you are working with. – PSS Jul 01 '13 at 02:26