ASM - Reverse Engineering

[spootnack]

Hello.

I need help please.

I don't find the correspondence in IDA of that it's called "Memory map" in OllyDbg.

This is in Olly.

Thanks for the help.

++

[tonyblair]

Hi Spootnack,

In IDA, it is called the segments :

Shown by a window like this :

and you get it by clicking View - then Open subviews - then Segments :

[spootnack]

Thank you very much tony !

++

[tonyblair]

I am happy to know that you are using IDA. It is so powerful. The only weakness is there are few, very few tutorials or eBooks about IDA.

Even how to use its menu and options. It took me years to master it.

[spootnack]

It seems to be very powerful and I like its interface and its "graph view".

PS: I have a little problem.

I would do a "trick".

In Olly, you can pause the debugged process, click on a button in your soft and olly breaks but with IDA when I pause the debugger, it doesn't let me to use the program... Why ?

Thank you in advance.

++

[tonyblair]

In Olly, you can pause the debugged process, click on a button in your soft and olly breaks but with IDA when I pause the debugger, it doesn't let me to use the program... Why ?

Only one process has the upper hand. I mean there only two situations :

1- The program is running and IDA is (half) sleeping (idle)

2- IDA is running and the program is stopped (wait status) under the control of the debugger for step by step instructions execution.

So we cannot pause the debugged process (Idle or halt) and in the mean time the program still active (running) to accept a "click on a button"

The way to get that is as follow:

1- You put a break in an address (you should know where) in the path of the executed code by the "clicked button"

2- You run the program (under IDA)

3- you "click on a button in your soft"

4- IDA should break

If you pause the program in IDA you will surely break in the OS kernell and not in the code of the program.

[spootnack]

Thank you for your answer but :

I forgot to say that in the tutorial she uses ALT + F9 (Till Execute User Code)(always in Olly and she doesn't use breakpoint I think).

I don't find this command in IDA.

It's the tuto 4 by Lena151 (Great tuts ! I'm happy with them)

A guy who has a problem with it

Another one

How would you do in IDA ?

Thanks.

++

[shajt]

I would suggest to you that you start first with Olly and after a cpl of apps cracked only then you can take a look at IDA if you like it that much (I guess reason for that is beacuse tony is using it :) )

I can say for myself that I'm master for Olly and I've tried to work with IDA but have exactly the same problems like you right now.

I asked tony about same questions you are asking him but I can't remember if he answered.

All I know is I CAN'T do things in IDA which I can in Olly , or maybe there are some similiar things that can be done but it's very confusing and I just can't use this debugger for several reasons.

For me, I don't see what IDA can do which Olly can't , graph view is nice feature and very useful but I find myself working much slower with IDA then Olly.

In Olly I'm a speed machine :D:

Besides, very few people are using IDA and majority of crackers are using Olly.

For starter like you, best thing is Olly for now, after few programs fixed you can then try IDA.

I'm using this modification of Olly and I strongly recommend it for you as well :

Link

[spootnack]

Hello shajt.

Thank you for these informations.

I use IDA (hummm, I try.... :lol: ) because I like the GUI and the graph view is very useful for me ! And it seems that it is a powerful application. Although Olly too.

For the moment I successfully worked with IDA, it took me several hours to discover the interface and I begin to understand a lot of stuff.

Maybe you're right, I must begin to work with Olly and when I'll have done most of the Lena tutorials, I'll redo them with IDA.

I think it's a good idea.

And why not work in the future with the two...

Thank you for your advice shajt. B)

PS: If tony or anyone has the answer to my question, I am interested to know.

Cheers

++

[shajt]

Hello spootnack,

You are right, best way is to go through all Lena tutorials with Olly (because she uses Olly, right :rolleyes: ) and after that you can go with IDA if you wish.

I tried, but like I've said, don't know how to work with IDA, I can do some things but it will not get the job done like in Olly would.

You can use both :)

For me .... it will always be Olly :wub: