How to create an anonymous IDA PRO database (.IDB)

Source: http://www.0xebfe.net/blog/2013/01/13/how-to-create-an-anonymous-ida-pro-database-dot-idb/

Probably it’s not secret for you that every .IDB files contains header with your license information.

There are two “netnodes” in every .IDB file that reveals your identity. Basically “netnode” is block with some data, check: idasdk\include\netnode.hpp for more info.

So there are two netnodes:

”$ user1” - contains plaint text info about your license.
”$ original user” - contains encrypted info about your license.

Actually you can freely delete “$ user1” netnode without any consequences, because IDA doesn’t check it at all. But “$ original user” netnode has strategic meaning for IDA PRO. This netnode contains RSA-1024 encrypted license information, same info that you have in “ida.key” file. When you open .IDB database IDA reads “$ original user” value, decrypts it with public RSA-1024 key and checks your license against MD5 hashes of blacklisted “pirated” licenses.

So what we can do? We can’t delete it, because IDA checks this netnode on every opening. We can’t generate own value, because we don’t have private RSA key. But we can copy this value from another .IDB file :)

I googled and found this .IDB file from Trustwave: here

So let’s dump “$ original user” netnode in source .IDB file with following python script:

netnode_dumper.py
import idaapi
import binascii
print(binascii.hexlify(idaapi.netnode(‘$ original user‘, 0, False).supval(0)))

After that insert dumped value into this script and run it in IDA in destination .IDB:

netnode_updater.py
import idaapi
import binascii
dumped_netnode_value =‘111insert_your_hex_value_here111‘
idaapi.netnode(‘$ user1‘, 0, False).kill() # deleting netnode with plain text info
idaapi.netnode(‘$ original user‘, 0, False).supset(0, binascii.unhexlify(dumped_netnode_value))

Save, re-open database. Let’s check:

Yep, we have .IDB file from Trustwave now :)

And when IDA shows you this message:

or “Sorry, this database has been created by a pirate version of IDA”.

This means that “$ original user” netnode contains banned license info. But you still can copy this value from legit .IDB with hex editor.

时间: 2024-10-22 02:26:30

How to create an anonymous IDA PRO database (.IDB)的相关文章

[转]How to create an anonymous IDA PRO database (.IDB)

Source:?http://www.0xebfe.net/blog/2013/01/13/how-to-create-an-anonymous-ida-pro-database-dot-idb/ Probably it's not secret for you that every .IDB files contains header with your license information. There are two "netnodes" in every .IDB file

IDA Pro使用技巧

DA Pro基本简介 IDA加载完程序后,3个立即可见的窗口分别为IDA-View,Named,和消息输出窗口(output Window). IDA图形视图会有执行流,Yes箭头默认为绿色,No箭头默认为红色,蓝色表示默认下一个执行块. 在寄存器窗口中显示着每个寄存器当前的值和对应在反汇编窗口中的内存地址.函数在进入时都会保存堆栈地址EBP和ESP,退出函数时恢复. 选择菜单Debugger下的Start process(也可以按F9键)来开始调试.调试会让程序在电脑中执行,所以IDA会提示注

IDA Pro Disassembler 6.8.15.413 (Windows, Linux, Mac)

IDA: What's new in 6.8 Highlights This is mainly a maintenance release, so our focus was on fixing bugs. However, there are some improvements too: Support for long names. In previous versions of IDA names were limited to 511 bytes. This was causing p

IDA.Pro权威指南 读书笔记

http://www.pediy.com/kssd/pediy12/142766.html 标 题:IDA.Pro权威指南 读书笔记[Made By C_lemon] 作 者:Dstlemoner 时 间:2011-11-14 11:56:17 链 接:http://bbs.pediy.com/showthread.php?t=142766    IDA为反汇编 和逆向破解的 静态分析利器 ! 虽然是利器,但是你不会用的话~那就另当别论了. →     唉.对于刚入门的新手来说,看前人走过的路程

最强反编译工具 ida pro 6.6 x86 arm x64 f5全插件原始安装文件泄露版 + sdk_utils

最强反编译工具 ida pro 6.6 x86 arm x64 f5全插件原始安装文件泄露版 + sdk_utils 完整安装包+6.6最新sdk工具包 国内某团购群泄露的的版本 x86 arm x64 f5插件为2.0的版本 正版价值人民币3-5万 6.6更新的内容 IDA: What's new in 6.6 x64 Decompiler It was tough and it required even more research than was planned but finally

IDA Pro使用(静态分析+动态调试)

链接:http://skysider.com/?p=458 IDA Pro使用(静态分析+动态调试) 1.静态分析 IDA FLIRT Signature Database -- 用于识别静态编译的可执行文件中的库函数 IDA signsrch -- 寻找二进制文件所使用的加密.压缩算法 IDA scope -- 自动识别windows函数和压缩.加密算法 Ponce -- 污点分析和符号化执行工具 snowman decompiler -- C/C++反汇编插件(F3 进行反汇编) keyst

MAC使用IDA PRO远程调试LINUX程序

1 背景 在学习Linux系统上的一些漏洞知识的时候,往往需要进行“实地测试”,但是在Linux系统上进行调试并不太方便,因为LINUX自带的GDB调试工具真的不太人性化,即使有GDBTUI之类的“伪图形界面调试器”,也跟IDA PRO之类的调试器相差甚远.这里又遇到另一个问题了——LINUX平台的IDA PRO不太好找. 综上,对于初学者而言最佳方案就是使用IDA PRO的远程调试功能! 2 环境配置 本文主要说明在MAC系统上如何通过IDA PRO对linux程序进行远程调试(如果宿主机为W

使用IDA PRO+OllyDbg+PEview 追踪windows API 动态链接库函数的调用过程

http://bbs.pediy.com/showthread.php?p=1354999 标 题: [原创]使用IDA PRO+OllyDbg+PEview 追踪windows API 动态链接库函数的调用过程.作 者: shayi时 间: 2015-02-12,05:19:54链 接: http://bbs.pediy.com/showthread.php?t=197829 使用IDA PRO+OllyDbg+PEview 追踪windows API 动态链接库函数的调用过程. (本文同步更

《IDA Pro 权威指南》学习

在学习0day时,发现ida的知识没有跟上,所以此处进行相关IDA的基础学习. X86汇编语法: AT&T:%前缀,&文字常量前缀 Intel语法:源操作数位于右边,目的操作数位于左边.使用Interl语法. 反汇编: 线性扫描反汇编:GUN,WinDbg,OBJdump 递归下降: 最典型 IDA Pro 1.顺序流指令 2.条件分支指令 3.无条件分支指令 4.函数调用指令 5.返回指令 二 逆向与反汇编工具 摘要工具: nm:声明的函数与全局变量名称 ldd:所需动态库 objdum