까보면 다나와~
툴 정보 및 사용법 (62)

유니코드 한글 확인하기

python으로 unicode string이 한글이 포함되어 있는지 여부 확인하기

(일반적으로  AC00–D7AF를 확인하는데 그외에도 많이 있군요.)

    def isKoreanIncluded(word):

        for i in word:

            if ord(i) > int('0x1100',16) and ord(i) < int('0x11ff',16) :

                return True

            if ord(i) > int('0x3131',16) and ord(i) < int('0x318e',16) :

                return True

            if ord(i) > int('0xa960',16) and ord(i) < int('0xa97c',16) :

                return True

            if ord(i) > int('0xac00',16) and ord(i) < int('0xd7a3',16) :

                return True

            if ord(i) > int('0xd7b0',16) and ord(i) < int('0xd7fb',16) :

                return True

        return False


  Comments,   0  Trackbacks
댓글 쓰기

ccleaner 64bit IDA 분석하기

IDA에서 Graph로 올바르게 표시되지 않는 jmp 코드에 관한 내용

pdata 영역의 address 값 수정하는 방법으로 수정 가능

tag CCleaner 64bit stage 2 __security_init_cookie() 

  Comments,   0  Trackbacks
댓글 쓰기

링크)windbg를 이용한 언패킹

windbg를 이용한 언패킹 

RWE 메모리만 찾아 덤프하는 방법 괜찮은 듯.

심볼 파일 만드는 스크립트도 유용하겠네요

'툴 정보 및 사용법 > WinDBG' 카테고리의 다른 글

링크)windbg를 이용한 언패킹  (0) 2017.08.16
Symbol 안맞아서 볼 수 없을때  (0) 2014.07.18
windbg IAT 목록 가져오기  (0) 2014.06.09
bp gethostbyname  (0) 2013.07.15
windbg (호스트 win7) xp 명령어 안될때  (0) 2013.07.05
명령줄에서 심볼로드  (0) 2012.10.24
  Comments,   0  Trackbacks
댓글 쓰기

Python 2.7 Unicode 관련

>>> import sys

#터미널 인코딩 확인

>>> sys.stdin.encoding


>>> han = '한글'

>>> uhan = u'한글'

>>> type(han)

<type 'str'>

>>> type(uhan)

<type 'unicode'>

#utf-8 일때, cp949는 다른 결과값이 나옴

>>> han


>>> uhan


#터미널이 'cp949'인 경우 han.decode('utf-8')시 에러

#터미널이 'utf-8'인 경우 han.decode('cp949')시 에러

>>> han.decode('utf-8')


>>> uhan.encode('utf-8')


  Comments,   0  Trackbacks
댓글 쓰기

x64dbg에 그래프 기능이 추가되었군요.

IDA 연동 플러그인도 괜찮은거 같고...

좋은거 같네요.ㅋ

  Comments,   0  Trackbacks
댓글 쓰기

리버싱툴 모음




Review of reverse engineering (i.e. software reversing) tools. Advantages and disadvantages, alternative solutions.

Reverse engineering or software reversing, is a set of techniques use to analyze closed source software in order to extract seemingly unavailable information, e.g. algorithms, hidden access passwords (e.g. to databases), information on how certain files are encrypted, and so on.

Reverse engineering is used for example in the fields of software analysis for potential security vulnerabilites (exploitation), malware analysis (antivirus developers) or software and games localization.

Advanced software analysis requires the knowledge of examined files structure, so most often a knowledge of executable files formats is required, Portable Executablefor Windows system or ELF format for Linux type systems. It is also required to know basis of assembler for 32 and 64 bit platforms, in order to understand properly compiled code in closed-source software, its structure and widely used conceptions and software constructions transformed into binary data.

Even having appropriate knowledge we will not be able to use it without proper tools. In this article I'd like to present dedicated tools, used in reverse engineering, divided into categories. Majority of dedicated tool, divided into categories, that are presented here, qualify as a material for separate article, however it was my idea to present as many types of software as possible, to show a variety of uses.

Complicated character of reverse engineering software as well as the process of its creation is often connected with the fact that those programs are also expensive, but I tried to present alternative solutions and free equivalents of presented examples.


There is a wide variety of both programming languages and compilers. Apart from applications created in script languages, we can differentiate applications compiled to processor's native code. Apart from that there is a number of methods of protecting applications and their resources and all of that affects the final result of binary file image on disk.

If we are not sure what the software that we are looking at was created with, as we have no expertise in distinguishing characteristic features in compiled files (section names, imported libraries, etc.), using identification (or detectors), tools that have signature base of popular compilers, program and cryptographic libraries or application security systems, is worth trying. Quick analysis will let us decide what our next step should be (e.g. unpacking the application)

Detect It Easy

DIE detector has a database of most popular security systems, including exe-packersexe-protectors as well as signatures of popular compilers and linkers. Additionally it has a simple built-in script language, that allows us to add new signature definitions quickly. A PE executable file structure viewer is also available.

File detector Detect It Easy
Image 1.File detector Detect It Easy
  • Built-in script language
  • PE file structure viewer
  • Plug-ins system
  • Updated regularly
  • Plug-ins for HIEW i CFF Explorer editors
  • Windows, Mac OS X and Linux versions
  • Small signature base


Detector ProtectionID was created to detect games security systems, it has a vast base of signatures from all possible security systems, compilers and linkers. Despite the fact that user interface my not be the best looking, it does the job perfectly and is updated very often.

ProtectionID file detector
Image 2.ProtectionID file detector
  • Large signature base
  • Updated very often
  • Hardly intuitive interface

Disassemblers and decompilers

With knowledge about what we are dealing with or, to be precise, what programming language and compiler this application was created with, we begin analysis in disassembler or decompiler. It is their task to analyze compiled, binary file and display its code and structure in a way easy for a human to understand.

Thanks to the process of disassembling and decompiling we will know all the functions of application, what text strings are inside and what fragments of code references to them, what outside functions of operating system are used by application or which functions are exported (e.g. in the case of DLL dynamic libraries).

Disassemblers job is to depict application's code in the for of low-level assembler, so if analyzed software was written in C++, Delphi, Visual Basic or any other high level language compiled to native code, disassembler will show us its object code in the form of x86 or x64 assembler code.

Decompilers are able or try really hard to recreate original high level code from the code of compiled applications. As you can guess, recreating a high level language code, e.g. C++ with recognition of data structures, types and construction of programming language from compiled code of assembler is a very complicated process, so the amount of tools that allow such action is very small and if they are good, they are in the same time very expensive.

Decompilers can be divided basing on categories of software that they are able to analyze. Compilers of languages like e.g. C# (.NET Framework family), Visual Basic, Java generate object code in the intermediate form, meaning that this code is not directly executed by processor like x86 code, it is a pseudo code (so called P-Code), that is executed by a virtual machine of those programming systems (to run we need e.g. .NET Framework or JVM installed).

Such output code, because of its simplicity and most information stored in the form of pseudo instructions and metadata, resulted in the fact that decompiling in such cases is much more simple than decompiling x86 or x64 code. This caused creation of many dedicated decompilers, that became a nightmare of programmers writing in those languages, as it was very easy for anyone to take a peek at unprotected software, practically it's the version with source code wide open.

That was short introduction, now it is time for a list of most popular disassemblers and decompilers and their usage examples.

IDA and Hex-Rays

IDA that is Interactive DisAssembler in an undpisupted king among tools used in reverse engineering. IDA is a disassembler and debugger with built-in code analysis for over 60 types of processors. It has its own script language, large base of signatures of the most popular programming libraries as well as support for plug-ins that additionally enhance functionality e.g. by support for Python scripts.

IDA's disassembler and decompiler's window
Image 3.IDA's disassembler and decompiler's window

The most known and valued plugin for IDA is Hex-Rays decompiler, that supports decompilation of x86, x64 and ARM codes, which is invaluable analysis tool.

IDA also has built-in debuggers for many hardware platforms, which makes this a perfect multitool for analysis of various executable files.

LicenceCommercial from 449 EUR and free demo version.
  • Supports large numbers of processor types
  • Built-in signatures of popular programming libraries
  • Large configuration possibilities
  • Built-in debuggers
  • Plugins system
  • Script language
  • Windows, Mac OS X and Linux versions
  • Price
  • Lack of good, free alternative solutions

.NET Reflector

When you must face analysis of software created in programming language based on .NET Framework, e.g. C# or VB#, .NET Reflector decompiler will prove invaluable help. With its help you will be able to quickly and efficiently take a peek at application's structure and code.

Reflector's big advantage is the fact that it has a small, but very useful plugin base, with available for example a plugin that allows recreating of whole project for Visual Studio, from decompiled application. In addition, integration with Microsoft Visual Studio allows for simultaneous debugging of own code and code of closed libraries.

Because of simplicity of decompiling programs created for .NET Framework, many security tools were created, of course we are talking here about obfuscators that remove meta data from compiled programs, are able to modify IL code, encrypt text strings etc. If we come across such a program, we should familiarize ourselves with de4dot deobfuscator, that is able to automatically remove protections used by dozens of obfuscator types.

.NET Reflector decompiler window
Image 4..NET Reflector decompiler window
LicenceCommercial from 99 USD and free limited time trial
  • Excellent presentation and navigation over decompiled code
  • Decompiling to many output languages C#, VB#, IL
  • Decompiling and debugging straight from Microsoft Visual Studio
  • Many useful plugins, e.g. Reflexil patcher
  • No support for protected applications (no deobfuscator)
  • Slow start (online licence check)

dnSpy new

A real workhorse for .NET decompilation, with built-in IL code editor and debugger. Above all of that, it's free with intuitive and modern interface design.

dnSpy decompiler and debugger window
Image 25.dnSpy decompiler and debugger window
LicenceGNU GPL v3
  • Excellent work speed
  • Simple IL code editor
  • Built-in debugger
  • Modern look
  • None

Java Decompiler

JD-GUI or Java Decompiler is a decompiler for Java applications, hence its name. It allows for viewing of compiled units code*.class or whole *.jar bundles.

It contains very useful search engine with filters that allow for searching by names, types, constructors, fields, methods and text strings.

Apart from stand alone application there are also plugins for programming environment Eclipse and IntelliJ IDEA, that allow for viewing code of compiled modules.

If you've ever used or you keep using well-known decompiler JAD (that was discontinued in 2001) then it's about time for an update, not only does JD-GUIsupport new elements of Java language, but also navigation over decompiled project is very easy and fun.

It also needs to be mentioned that, just like with .NET applications, that have been protected with obfuscators, Java applications can be protected and then decompiler functioning is limited or even impossible.

Java Decompiler (aka JD-GUI)
Image 5.Java Decompiler (aka JD-GUI)
  • Intuitive navigation over decompiled code
  • Plugins for Eclipse and IntelliJ IDEAenvironment
  • No support for protected application (no deobfuscator)
  • No disassembly to IL in case of finding errors


Free alternative for commercial.NET Reflector developed by Telerik known for UIcomponents. Free doesn't mean worse, it has built-in reference search engine, generating projects from decompiled sources ability as well as support for plugins, including de4dot deobfuscator plugin.

Just Decompile Decompiler
Image 6.Just Decompile Decompilatior
  • Support for own plugins
  • Generating output code in C#, VB# and IL
  • Visual Studio plugin
  • It is a bit robust comparing to .NET Reflector


Decompiler for applications created with database programming environmentVisual FoxPro from Microsoft. This is a very niche solution for equally niche environment, but there are no alternative solutions that would allow for analysis of those application and those that do exist have been discontinued and don't support latest versions of VFP applications. ReFox allows for decompiling of classes, viewing forms and built-in data.

ReFox Decompiler
Image 7.ReFox decompiler

LicenceCommercial from 290 EUR and demo version.
  • Decompiling of classes
  • Form viewer
  • Restoration of Visual FoxPro projects
  • A bit outdated interface
  • Sometimes can't handle decompiling of code

VB Decompiler

Applications created with Visual Basic 5 and 6 are all in the past now, however internal structure of code based on P-Code was a cradle for .NET technology and from the very beginning it's been causing problems with code analyze, as there were no dedicated tool for its analyze. We can say that VB Decompiler was created a bit too late for the market's needs, but is irreplaceable when analyzing Visual Basic applications (EXEDLL as well as OCX controls) compiled to P-Code (Visual Basic also allowed from compiling to x86 code).

VB Decompiler
Image 8.VB Decompiler
LicenceCommercial from 99 EUR, as well as lite version.
  • View on code forms and events
  • Plugins system
  • Disassembly of native code x86
  • Limited navigation for decompiled code


Disassembler and decompiler IDR or Interactive Delphi Reconstructor is a tool meant only for application analysis in popular Delphi environment. It is a very useful tool comparing to e.g. IDA because it can analyze internal structures of Delphi application, has built-in form viewer, that allows for fast and easy finding of events assigned to controls on the form (e.g. button1.OnClick). IDR has vast databases of signatures of standard Delphi environment libraries in all available versions, so in output deadlisting we will see friendly function names.

Disassembler and decompiler for Delphi - IDR
Image 9.Disassembler and decompiler for Delphi - IDR
LicenceFreeware with optional paid current copy (unknown terms and conditions, author couldn't be contacted).
  • Delphi form viewer with controls events browser
  • Export of map with names of functions and variables (e.g. forIDA or debugger)
  • Built-in signatures of all versions of Delphi environment
  • Irregular updates
  • Unclear terms of access to latest versions


Every programmer sooner or later gets to know the functioning of a debugger in his favourite programming environment. Thanks to debugger we are able to track application running in real time, see how instructions affect contents of memory or variables and detect potential errors. However debugging of our own software, when we have access to information about source code and usually debug high-level code, straight from programming environment, is a piece of cake compared to debugging of application without access to source code. This is where dedicated debuggers, with advanced analysis of binary application structures, come in handy, but their use requires knowledge of low-level languages as well as basis of functioning of processor, for which this application was compiled.


This is de facto a standard debugger for Windows in the world of reverse engineering (alongside built-in debugger for IDA disassembler). It has capabilities of application code analysis and allows for interference with almost every aspect of application running.

Other interesting functions include OllyDbg that allows for conditional code tracing, has vast plugins database, including those hiding its presence from anti-debug methods (Phant0m plugin), or plugins that allow for controlling of debugger running from the script level (ODbgScript plugin), while those scripts, most often used for unpacking of unprotected applications, come in hundreds.

Popularity of OllyDbg is obvious with the fact, that no other debugger, including legendary SoftICE system debugger has had so many plugins and modified versions like OllyDbg. It is interesting that a special version OllyDbg was created under the name of Immunity Debugger with built-in Python script support, meant for analyzing malware and creating exploits

There are currently two versions of OllyDbg, old with number 1.10, that has the most extensions and new version 2.01 that is becoming more and more popular. It is good news that a new 64-bit version is being developed because of popularity of 64-bit operating systems.

OllyDbg v1.10 Debugger
Image 10.OllyDbg v1.10 Debugger
The same code in OllyDbg 2.01 debugger
Image 11.The same code in OllyDbg 2.01 debugger
LicenceShareware for free, according to website (upcoming freeware?)
  • Outstanding analysis of application code
  • Many configuration options
  • Vast database of plugins and scripts
  • 64 bit version is still being developed

x64dbg new

x64dbg are basically two debuggers, one dedicated for 64 bit software debugging and second for 32 bit applications. It features modern interface, plenty of configuration options, internal engine based on modern programming libraries likeTitanEngineCapstone EngineKeystone Engine.

Number of supported features is really impressing, plugins, built-in scripting language, Yara signatures scanning, built-in decompiler and many more. And it's development is very active. Taking the fact that 64 bit OllyDbg never left the development stage, x64dbg has become de facto standard debugger for 64 bit applications.

x64dbg debugger
Image 26.Debugger x64dbg
LicenseGNU GPL v3
  • Modern interface
  • Modern programming libraries used
  • Configuration flexibility
  • Plugins
  • Built-in scripting language
  • Build-in decompiler (Snowman)
  • It doesn't have as many plugins as OllyDbg
  • Popular scripting language ODBScript with thousands of scripts is not supported


Debugger for .NET Framework applications. It is quite a robust tool, but sometimes invaluable. It looks a bit like Visual Studio built-in debugger, I'm mentioning it only because it is one of very few debuggers for .NET applications without access to source codes, there are also plugins for .NET Reflector for the purpose of debugging (Deblector plugin).

.NET – DILE application debugger
Image 12. .NET – DILE application debugger.
LicenceGNU GPL
  • It exists
  • Lots of it
  • Complicated user interface

Hex editors

If you have analyzed your application in disassembler, traced its running in debugger, there may be a need to interfere with program code in order to input corrections or to change some text strings, fix values or other information included in application's binary file.

For that purpose hex editors are used. At times when I used to read games magazine Top Secret, I associated hex editors only with save games modification, as readers were sending numerous offsets (addresses in a file) as well as values that needed to be changed in save files, e.g. to get certain amount of cash or other resources in the game.

There are many hex editors on the market, with numerous different functions and applications, like e.g. built-in view over data structure (meaning that this hex editor is able to visually display for example bitmap elements or internal structure of exe file). An example of such an editor is e.g. well known WinHex, that is used in data retrieval (it contains built-in support for many system files), however in my opinion it is not very good for works connected with 'digging' in application's binary files, despite the fact that it has appropriate functions.


This is my number one for hex editors, I cannot imagine my work without it. It is seemingly an old console application, but in reality it is a true beast. HIEW (byHacker’s View) is a hexeditor, disassembler that supports architecture of x86, x64, ARM V6 processors, it also supports NELEPE/PE32+ELF/ELF64 files. This program has vast user database has been developed since 1991 and updates are regular.

Thanks to HIEW we are able not only to edit binary file data, but if that is an application, also its code. Built-in disassembler allows for navigation over the code and its functions as well as to easily modify existing instructions with the help of built-in assembler, which means that you don't have to know hex codes by heart, instead it is enough to write e.g. mov eax,edx and HIEW will automatically compile that instruction and insert it into binary file.

HIEW is also able to repeatedly replace tools like IDA, if we have a simple task to do, its greatest advantages are its ability to operate very fast and built-in code analysis and direct modification options.

HIEW hex editor and disassembler
Image 13.HIEW hex editor and disassembler
LicenceCommercial from 19 USD and demo version.
  • Built-in disassembler and assembler for many types of processor architectures
  • Support for many formats of exe files
  • Plugins system
  • No overlaps

Hex Workshop

Windows hex editor with many useful options, file comparison, bit operations on code blocks, generating checksums, contains structure view for the most popular types of files.

Hex Workshop hex editor
Image 14.Hex Workshop hex editor
LicenceCommercial from 89.95 USD and time-limited version.
  • Advanced bit operations on data blocks
  • Possibility of disc editing
  • Built-in checksum and cryptographic shortcut calculator
  • Automatic search for all text strings
  • Messed up graphic interface
  • Expensive, compared to alternatives


Free hex editor with basic functions and options like edition, search, file comparison. It allows for simultaneous work with multiple files, it is also possible to open memory of different processes and to gain direct access to discs.

HxD Hex editor
Image 15.HxD Hex editor
  • Simplicity
  • Simultaneous editing of multiple files
  • Ability to edit memory processes and disk data
  • Data export to format of programming files
  • Built-in checksum and cryptographic shortcut calculator
  • No advanced modification options (like e.g. XOR operations on data blocks)
  • Minimalistic interface

Resource editors

Characteristic feature of Windows applications is the fact all resources like icons, images, forms, localized texts, as well as other information, can be saved in PE file structure, within special area called resources. Those data are saved when linking. As all application files are saved in one EXE or DLL output file, if there is a need to change those information and if their size is unchanged, we will be able to modify them using hex editor, however if we need to add new data or set different that have larger size (e.g. longer text or another image), because of structure of those data we will have to use proper resource editor.

Apart from modifications in application's resources, resource editors are also used just for taking a peek what additional data are stored in application's file.

Resource Hacker FX

Resource Hacker used to be one of the most popular resource editor, but it has been discontinued for a long time, despite that fact of its popularity, new patches have been created that gave this editor a new life.

Resource Hacker FX resource editor
Image 15.Resource Hacker FX resource editor
  • Processing speed
  • Ability to manipulate data on script language resource level.
  • Patches don't change outdated functions
  • No preview of Delphi forms
  • No coloring syntax for XML elements (like e.g. manifests)

Resource Tuner

Excellent resource editor from the creators of PE Explorer. It contains built-in unpackers, e.g. for UPX or FSG compressor, resource edition can be also done with use of friendly wizards. Resource Tuner has also built-in scanner that allows for scanning of any given catalogue for resources of a specific type.

Resource Tuner resource editor
Image 16.Resource Tuner resource editor
LicenceCommercial from 49.95 USD and 30 days trial version.
  • Friendly user interface
  • Support in the form of wizards
  • Built-in unpacker
  • No low-level structure resources (script) edition

Editors and support tools

Reverse engineering requires specialized tools for specific purposes, other than standard ones like disassemblers, decompilers and debuggers – there are many dedicated tools that help in analysis of applications as well as editors, some of them you will find below.


Excellent browser and file structure editor, with built-in simple disassembler, PE file compare basing on values from all structures (solution that is unique on a world scale), detection of popular exe-packers / exe-protectors, hex editor and graphic visualization of section structure.

Tool created by a Polish programmer (yes, you got it right) is perfect for low-level analysis of PE/PE32+ files, created mostly for the purpose of malware analysis.

PE-Bear editor
Image 18.PE-Bear editor
  • Unique functions
  • Simple edition of PE/PE32+ file structure
  • Detection of popular exe-packers and exe-protectors based on signatures
  • Windows and Linux versions
  • Simple disassembler (too simple)
  • No configuration options


An interesting tool that apart from displaying basic information about exe file, has also a set of rules that can detect incorrect elements in the structure of exe file (all sorts of anomalies) as well as elements that can potentially indicate that the file has been infected. Very useful tool for those who work with PE files every day.

PeStudio executable files analyzer
Image 19.PeStudio executable files analyzer
LicenceFree for non-commercial use.
  • Detection of anomalies in exe files
  • Convenient PE file structure viewer
  • Some rules are too strict


Advanced editor for compiled Java files. Unique tool, developed by Polish author, for code modifying, with built-in disassembler and assembler, this editor allows also for modifying all structures within compiled *.class files. dirtyJOE is useful when we want to modify protected files (after using obfuscator for Java), when traditional methods of decompilation, modification and recompilation fail, dirtyJOE proves irreplacable.

dirtyJOE - Java files editor
Image 20.dirtyJOE Java files editor
LicenceFree for non-commercial use.
  • Instructions disassembler and assemblerJVM
  • Adding and editing fields like e.g. text strings
  • 32 and 64 bit versions
  • Plugin for Total Commander
  • Raw interface
  • Uncomfortable code editor

Extractors and rippers

Application files, just like application bundles can contain additional information, like e.g. hidden icons, sound files, libraries, etc. If we want to have a quick check of what's inside the application or e.g. inside the whole installation package of a software, we must use appropriate extractor or ripper.

Universal Extractor

This software allows for extraction of files from archives, self unpacking archives and installers. This is very useful when we want to learn what's inside the installer package, where often we can find some additional installation scripts or auxiliary libraries, without actually running the installation process.

Universal Extractor
Image 21.Universal Extractor
  • Support for archives (including unpacking)
  • File extraction from popular installing systems
  • Haven't been updated for a long time
  • Sometimes alternative solutions are needed for newer versions of installing systems


Extractor of all kinds of multimedia files, like graphic files, icons, sound files, movies, 3D models, Flash animations. Dynamic data unpacking from processes memory and simple viewer make this software a very interesting tool, when we want to take a quick peek what's inside application files.

Image 22.MultiExtractor
LicenceCommercial from 19 USD and demo version.
  • Extraction of numerous graphic file formats
  • Extraction from processes' memory
  • Recognising popular file formats
  • No new file formats added for quite a long time
  • Can sometimes freeze, especially with large number of files.

  Comments,   0  Trackbacks
댓글 쓰기

IDA Plugin list

  Comments,   0  Trackbacks
댓글 쓰기

Plugin contest 정보

사실 이런게 있는 지 처음 알게 되었네요...

날 잡아서 하나씩 체험해봐얄 듯 ㅋ

  Comments,   0  Trackbacks
댓글 쓰기

IDA를 판매하는 회사는 어떻게 생겼을까

IDA를 사용하면서 참 대단하다.. 생각은 많이 했지만

회사가 궁금한적은 없었는데 불현듯 궁굼해져 검색을 해보았다.


굉장히 큰 회사일 거라 생각하고 구글링해보자

자료가 그다지 많지 않았다.


위키에 따르면 다음과 같이 설명되어 있다.

Created as a shareware application by Ilfak Guilfanov, IDA was later sold as a commercial product by DataRescue, a Belgian company, who improved it and sold it under the name IDA Pro. In 2005, Guilfanov founded Hex-Rays to pursue the development of the Hex-Rays Decompiler IDA extension. In January 2008, Hex-Rays assumed the development and support of DataRescue's IDA Pro.


최초 Guilfanov에 의해 쉐어웨어로 만들어졌고 이후 벨기에 DataRescue라는 회사에서 판매하였다.

2005년에 Guilfanov는 Hex-Rays를 설립했고 2008년 1월, Hex-Rays는 IDA 개발과 지원을 인수하였다.


결론은 DataRescue라는 회사에서 Guilfanov씨의 IDA를 판매(만?)하다가 Guilfanov씨가 Hex-Rays회사를 직접 만들어 현재 판매하고 있는거 같네요.


회사는 작은듯...(프로필 이미지가 작음)


참고로 이 회사 들어가고 싶으면 이 정도 스펙이 요구 된다. (2009년도 기준, CEO님께서 올리셨네 ㅎ)




  Comments,   0  Trackbacks
댓글 쓰기

ida XREF, cross reference reconfiguration

See this.

So, I checked XREFS (Shift + R).

And than deleted problemXREF. (Delete function key)

Add again.



(I'm not guarantee this post. Some cases I couldn't reconfigure in the same way.)

  Comments,   0  Trackbacks
댓글 쓰기