IDA Pro使用
当我们的光标在某个函数处时,按回车键就可以跳到这个函数所在的位置:
按回车,跳到这里:
再按回车,跳到导入表:
我们再连续按ESC键就可以返回到刚才进入的地方:
使用快捷键N可以进行重命名:
在数字上按下H键或者右键进行选择,可以将数字转化为十进制:
在按一下相同的键就变回来了。按下B键转换为二进制也是同理。
按下空格键可以使IDA在图形视图和文本视图之间切换:
- 常用默认快捷键
"JumpAsk" = 'g'
"JumpName" = "Ctrl-L"
"JumpSegment" = "Ctrl-S"
"JumpSegmentRegister" = "Ctrl-G"
"JumpQ" = "Ctrl-Q"
"JumpPosition" = "Ctrl-M"
"JumpXref" = "Ctrl-X"
"JumpXrefFrom" = "Ctrl-J"
"JumpOpXref" = "X"
"JumpFunction" = "Ctrl-P"
"JumpEntryPoint" = "Ctrl-E"
"JumpError" = "Ctrl-F"
"JumpEnter" = "Enter" // jump to address under cursor
"JumpEnterNew" = "Alt-Enter" // jump to address under cursor
// in a new window
"Return" = "Esc"
"UndoReturn" = "Ctrl-Enter" // undo the last Esc
"MarkPosition" = "Alt-M"
"JumpSuspicious" = "Ctrl-V"
"JumpCode" = "Alt-C"
"JumpData" = "Ctrl-D"
"JumpUnknown" = "Ctrl-U"
"JumpExplored" = "Ctrl-A"
"AskNextImmediate" = "Alt-I"
"JumpImmediate" = "Ctrl-I"
"AskNextText" = "Alt-T"
"JumpText" = "Ctrl-T"
"AskBinaryText" = "Alt-B"
"JumpBinaryText" = "Ctrl-B"
"MakeAlignment" = 'L'
"ManualInstruction" = "Alt-F2"
"MakeCode" = 'C'
"MakeData" = 'D'
"MakeAscii" = 'A'
"MakeArray" = "Numpad*"
"MakeUnknown" = 'U'
"MakeName" = 'N'
"ManualOperand" = "Alt-F1"
"MakeFunction" = 'P'
"EditFunction" = "Alt-P"
"FunctionEnd" = 'E'
"OpenStackVariables" = "Ctrl-K" // open stack variables window
"ChangeStackPointer" = "Alt-K" // change value of SP
"RenameRegister" = 'V'
"SetType" = 'Y'
"MakeComment" = ':'
"MakeRptCmt" = ';'
"OpNumber" = '#'
"OpHex" = 'Q'
"OpDecimal" = 'H'
"OpBinary" = 'B'
"OpChar" = 'R'
"OpSegment" = 'S'
"OpOffset" = 'O'
"OpOffsetCs" = "Ctrl-O"
"OpAnyOffset" = "Alt-R"
"OpUserOffset" = "Ctrl-R"
"OpStructOffset" = 'T'
"OpStackVariable" = 'K'
"OpEnum" = 'M'
"EditSegment" = "Alt-S"
"SetSegmentRegister" = "Alt-G"
"ShowRegisters" = "Ctrl-Space"
"OpenFunctions" = "Shift-F3" // open functions window
"OpenNames" = "Shift-F4"
"OpenSignatures" = "Shift-F5" // open signatures window
"OpenSegments" = "Shift-F7"
"OpenSegmentRegisters" = "Shift-F8"
"OpenStructures" = "Shift-F9" // open structures window
"OpenEnums" = "Shift-F10" // open enums window
"OpenTypeLibraries" = "Shift-F11"
"GraphFunc" = "F12" // display function flow-chart
"CallFlow" = "Ctrl-F12" // display function call graph
"OpenStrings" = "Shift-F12"
"OpenLocalTypes" = "Shift-F1"
"SetAsciiStyle" = "Alt-A" // set ascii strings style
"ShowFlags" = 'F'
"Hide" = "Numpad-"
"Unhide" = "Numpad+"
"ExternalHelp" = "Ctrl-F1"
"WindowsListNext" = "Ctrl-Tab"
"WindowsListPrev" = "Ctrl-Shift-Tab"
"NextWindow" = "F6"
"PrevWindow" = "Shift-F6"
"CloseWindow" = "Alt-F3"
IDA Pro使用的更多相关文章
- 安卓动态调试七种武器之孔雀翎 – Ida Pro
安卓动态调试七种武器之孔雀翎 – Ida Pro 作者:蒸米@阿里聚安全 0x00 序 随着移动安全越来越火,各种调试工具也都层出不穷,但因为环境和需求的不同,并没有工具是万能的.另外工具是死的,人是 ...
- 计算机病毒实践汇总六:IDA Pro基础
在尝试学习分析的过程中,判断结论不一定准确,只是一些我自己的思考和探索.敬请批评指正! 1. IDA使用 (1)搜索.下载并执行IDA Pro,对可执行程序lab05-01.dll进行装载,分别以图形 ...
- Ubuntu下安装IDA pro
预备 由于IDA pro只能装在32位环境下,如果是64位Ubuntu,需要运行如下命令安装32位的必备库. sudo dpkg --add-architecture i386 sudo apt-ge ...
- How to create an anonymous IDA PRO database (.IDB)
Source: http://www.0xebfe.net/blog/2013/01/13/how-to-create-an-anonymous-ida-pro-database-dot-idb/ P ...
- android调试系列--使用ida pro调试so
1.工具介绍 IDA pro: 反汇编神器,可静态分析和动态调试. 模拟机或者真机:运行要调试的程序. 样本:阿里安全挑战赛第二题:http://pan.baidu.com/s/1eS9EXIM 2. ...
- android调试系列--使用ida pro调试原生程序
1.工具介绍 IDA pro: 反汇编神器,可静态分析和动态调试. 模拟机或者真机:运行要调试的程序. 样本:自己编写NDK demo程序进行调试 2.前期准备 2.1 准备样本程序(假设已经配置好 ...
- [转]How to create an anonymous IDA PRO database (.IDB)
Source: http://www.0xebfe.net/blog/2013/01/13/how-to-create-an-anonymous-ida-pro-database-dot-idb/ P ...
- IDA Pro使用技巧
DA Pro基本简介 IDA加载完程序后,3个立即可见的窗口分别为IDA-View,Named,和消息输出窗口(output Window). IDA图形视图会有执行流,Yes箭头默认为绿色,No箭头 ...
- IDA Pro使用(静态分析+动态调试)
链接:http://skysider.com/?p=458 IDA Pro使用(静态分析+动态调试) 1.静态分析 IDA FLIRT Signature Database —— 用于识别静态编译的可 ...
- IDA Pro Disassembler 6.8.15.413 (Windows, Linux, Mac)
IDA: What's new in 6.8 Highlights This is mainly a maintenance release, so our focus was on fixing b ...
随机推荐
- JAVA 代码开发规范
一.开发工具规范: 1. 开发工具经项目负责人调试后统一确定. 2. 开发工具一经确定不允许集成任何非统一插件,若有需要,经项目负责人同意后统一为 项目组成员添加. 3. 开发工具的编码格式不允许修改 ...
- jQuery 怎么实现文字显示2s,消失0.5s,再显示2s,再消失0.5s,以此循环
<div style="display: none;" id='divTestDisplay'>我要显示的文字</div> window.onload = ...
- 第一百三十二节,JavaScript,封装库--下拉菜单
JavaScript,封装库--下拉菜单 封装库,增加了3个方法 shu_biao_yi_ru_yi_chu()方法,给元素设置鼠标移入移出事件,接收两个参数,参数是移入和移出时的执行函数(包含代码) ...
- solr最佳实践
管理页面 页面地址:http://{ip}:{port}/solr/#/ 管理页面的data-import页可以手动重建索引,configuration指定了数据源,重建索引也可以通过http请求触发 ...
- BitMap - leetcode [位运算]
136. Single Number 因为A XOR A = 0,且XOR运算是可交换的,于是,对于实例{2,1,4,5,2,4,1}就会有这样的结果: (2^1^4^5^2^4^1) => ( ...
- JS 获取网页的宽高
网页可见区域宽: document.body.clientWidth网页可见区域高: document.body.clientHeight网页可见区域宽: document.body.offsetWi ...
- [Android]Android SDk Manager中创建模拟器无法选择CPU问题解析
方法一.正常下载所需sdk包 启动 Android SDK Manager ,打开主界面,依次选择「Tools」.「Options...」,弹出『Android SDK Manager - Setti ...
- 记录下 js各种证件的正则验证
身份证 /(^\d{15}$)|(^\d{17}([0-9]|X)$)/ 护照 /^[a-zA-Z0-9]{3,21}$/ /^(P\d{7})|(G\d{8})$/ 军官证或士兵证 ...
- springmvc基础篇—掌握三种处理器
随着springmvc的广泛使用,关于它的很多实用有效的功能应该更多的被大家所熟知,下面就介绍一下springmvc的三种处理器: 一.BeanName处理器(默认) <?xml version ...
- Python学习笔记——基础篇【第五周】——random & time & datetime模块
random模块 随机数 mport random print random.random() print random.randint(1,2) print random.randrange(1,1 ...