第一章简介。
以下的内容是供交流学习之用，如果有人用它来做非法的事，概与本人无关。
An overview of code debuggers
(调试器的概述）
Sooner or later you will want to know absolutely everything about an execucutable file.you may want to know.for instance:
1.The exact memory address that it is calling
2.The exact region of memory that it is writing
3.What region it's reading from
4.Which registers it's making use of
Debuggers will aid you in reverse-engineering a file for which you don't have the source code, by dissembling the file in queston.This comes in handy when you're analyzing malware,as you almost never have access to the executable's original source code.The goal of this section is not to coach you in depth on how to use these debbuggers, but simply to show you that they are out there and available for you to use. Debuggers are very powerful tools that take a long time to learn to use to their fullest extent
The " cream of the crop " in debuggers and the focus of this book is Interactive Disassemblers Pro, available from DataRescuse. IDA Pro should be you first choice of a debuggers for an enterprise environment. It isn't really expensive, and is well worth the nominal outlay for the features it offers.
在众多的调试器中,最优秀的当然是IDA PRO,本书也集中讨论它(IDA PRO可以从DataRescuse获得).IDA PRO 应该作为大家的第一选择,它并不是真的很贵,绝对是物超所值.
DataRescue offers a demo version from their Web site at 3feK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3c8S2N6r3q4J5k6i4y4U0N6h3g2Q4x3X3g2U0L8$3#2Q4x3V1k6A6k6r3q4T1j5i4y4W2i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2Z5N6r3#2Q4x3X3f1`. This version can only work with a limited range of file and processor types, is time limited, runs only as a Windows GUI application, and so on.
DataRescue在它的网页(ea8K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3c8S2N6r3q4J5k6i4y4U0N6h3g2Q4x3X3g2U0L8$3#2Q4x3V1k6A6k6r3q4T1j5i4y4W2i4K6u0r3K9h3&6V1k6i4S2Q4x3X3g2Z5N6r3#2Q4x3U0W2Q4c8e0k6Q4z5p5k6Q4z5e0m8Q4c8e0c8Q4b7V1g2Q4z5f1u0Q4c8e0c8Q4b7V1q4Q4z5o6k6u0c8p5p5`. PRO 的演示版供人下载.这个版本有很多限制,它只能在种类相对比较少的处理器下运行,能处理的文件类行也比较少,还有它有时间限制,以WINDOWS GUI 的形式运作,等等......
IDA Pro is much more than a simple debugger. It is a programmable, interactive disassembler and debugger. With IDA Pro you can reverse-engineer just about any type of executable or application file in existence. IDA Pro can handle files from consol machines such as Xbox, Playstation, Nintendo, to Macintosh computer systems, to PDA platforms, Windows, UNIX, and a whole lot more. Figure 1.1 shows the initial load screen wizard when you first start IDA Pro. Notice all the file types and tabs that will help you select the proper analysis for the file type that you wish to disassemble.
IDA PRO 并非只是一个调试器这么简单，它是一个可以编程的，交互性很强的反汇编器和调试器的合体。运用IDA PRO几乎可以逆向现存的所有可执行档或应用程序。IDA PRO可以处理控制台机器的文件，如Xbox, Playstation, Nintendo,也可以处理梅肯套希（Macintosh）系统的文件，甚至连 PDA 平台， Windows, UNIX的文件都可以处理，当然还有很多，这里不列出来了。图表1.1显示了当初次开启IDA PRO时的初始化精灵画面.注意所有的文件类型和标签,它们会帮助你,为你要分析的文件类型选择正确的分析方法.
In Figure 1.2, IDA Pro has loaded and is disassembling a WootBot variant with file name instantmsgrs.exe. Part of what we can see from Figure 1.2 is that instanmsgrs.exe was packed using an executable packer called Molebox. You can also plainly see the memory calls that it's making, and the Windows DLLs that are being called. This type of information can be invaluable when it comes to fighting off a virus or malware outbreak, especially if you need to make a custom cleaner in order to repair your systems.
如图表1.2,用IDA PRO 加载instantmsgrs.exe（它是一个WootBot病毒的变体）并进行反汇编。我们可以从图中看到instanmsgrs.exe加了一个叫Molebox的壳。你也可以清楚的看到这个程序正在进行内存调用，同时Windows DLLs也正在被调用。当我们要阻止一个病毒或者恶意程序发作时，这些资料是很有用的,尤其是在清除有害的程序和修复系统时更能体现出他的重要性。
SUMMARY
总结
IDA is one of the most popular debugging tools for Windows. First, IDA Pro is a disassembler, in that it shows the assembly code of a binary (an executable or a dynamic link library [DLL]). It also comes with advanced features that try to make understanding the assembly code as easy as possible. Second, it is also a debugger, in that it allows the user to
step through the binary file to determine the actual instructions being executed, and the sequence in which the execution occurs. you'll learn about all of these features throughout this book. IDA Pro is widely used for malware analysis and software vulnerability research, among other purposes. IDA Pro can be purchased at cdaK9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4N6%4N6#2)9J5k6h3c8S2N6r3q4J5k6i4y4U0N6h3g2Q4x3X3g2U0L8$3#2Q4x3X3f1`.
