Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Using IDAPython to Make Your Life Easier: Part 4

Summary: Unit 42's fourth IDAPython installment shows how reverse engineers can trace which instructions execute at runtime and how often, using RunTo(BeginEA()), GetDebuggerEvent(), and EnableTracing() to step through every address until the process terminates. The script then applies GetColor() and SetColor() with a four-shade blue palette, so lines executed repeatedly appear in darker shades and execution flow becomes visible directly in the IDA Pro graph.

What's compelling: The technique is demonstrated on a simple C program the author wrote for the exercise, so its value is in cutting the time an analyst spends tracing a complex application's code by hand - the darker the shade, the more often that line ran.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related