IDA Pro is used daily by anti-virus, malware and spyware analysts to investigate new virus samplesthreats and to provide timely solutions. IDA Pro has become such a standard in the field of malware analysis that information about new viruses is often exchanged under the form of “IDA Databases”. Given the speed and the complexity of today’s hostile code, a powerful analysis solution is required. For more advanced tasks, the open plugin architecture allows external developers to enhance IDA Pro’s functionalities. It consists of a very powerful macro-like language that can be used to automate simple to medium complexity tasks. IDA Pro is a complete integrated development environment. A built-in programming language and an open plugin architecture pushes interactivity even further.Ī plugin architecture allows a program to call external code at certain points without knowing all the details of that code in advance, therefore adding functionalities to the calling program.

IDA always allows the human analyst to override its decisions or to provide hints. IDA Pro is interactiveīecause no computer can currently beat the human brain when it comes to exploring the unknown, IDA Pro is fully interactive. Some IDA debuggers can also run the application in a virtual environment makinges malware analysis even safer. Remote debuggers are very useful to safely dissect potentially harmful programs. This can be carried out either locally or remotely. IDA Pro runs on Windows, Linux and Mac OS X and can debug a large array of specific platforms (Windows 32/64-bit, Linux 32/64-bit, OS X x86/圆4, iOS, Android, etc.). The debugger in IDA Pro complements the static analysis capabilities (examining the code without executing the program) of the disassembler by allowing users to single step through the code being investigated this way, the debugger often bypasses the obfuscation and helps obtain data that the more powerful static disassembler will be able to process in depth. More powerful tools are thus required to efficiently help analysts. Creators of viruses, worms and trojans often write their code in an obfuscated way, making it extremely hard to read and analyse. Hostile code usually does not cooperate with the analyst. In software analysis – as in real life – things are rarely simple and obvious. A debugger is a computer program that assists in the detection and correction of errors in other computer programs.

Ida pro hex rays decompiler