If I were to disassemble a malware sample in IDA without being in a VM, is there any way I can infect my machine?

  • Will reading a text on how to mix acid and zinc sulfide stink up your house? – Jongware Aug 29 '15 at 9:48
  • 3
    @Jongware: Your brain doesn't contain buffer overflow vulnerabilities and integer wrap vulnerabilities that could allow the act of reading text to execute arbitrary code in the context of your brain. The same guarantees cannot be made for IDA Pro. – Jason Geffner Aug 29 '15 at 15:40

The recommended workflow is to make the initial database (idb) by running IDA within a VM. That way you are safe even in case of a possible zero day.

The idb file can then be taken out of the VM and analyzed elsewhere. The idb does not contain runnable machine code, so you are safe.

If you want to perform any dynamic analysis on the malware, you need to use a VM.

  • 2
    You could also ask [eset]( habrahabr.ru/post/124054 ) about this ;) – jvoisin Aug 29 '15 at 13:09
  • Cool. I have a Windows XP VM (VirtualBox) so I should just be able to generate it, put it in a shared folder and remove the shared folder. Thanks! – Matt Y Aug 30 '15 at 1:09
  • as Viktor notes, VM escape is possible, too, so we cannot say "you are safe", only "less vulnerable". – peter ferrie Aug 31 '15 at 22:33

It's not dangerous as long as you're disassembling and not debugging. However, I strongly recommend you to use a VM

  • that's not entirely true - there have been bugs in IDA that can result in crashes just by opening the file. It is entirely possible that some of them could have resulted in code-execution, in the right situation. – peter ferrie Aug 31 '15 at 22:25
  • There have been VM escalation bugs. If this file is so extensive that it can run as an executable and exploit Ida... Maybe a VM won't help either. – Viktor Aug 31 '15 at 22:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.