1

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and see what data is loaded into memory and what pseudocode is used.

1 Answer 1

0

I would recommend not running the program from IDA or Ghidra directly but use a much more powerful debugger like x64dbg. It is a bit annoying to translate between the memory within your debugger and the memory within Ghidra but imho that's well worth it.

If you are still committed on doing it all within IDA/Ghidra, expect some extra work:

  1. Ghidra starting in version 10.3 ships with an emulator (see https://medium.com/@cy1337/first-look-ghidras-10-3-emulator-7f74dd55e12d for example). I personally have never used it but it might be worth a shot.
  2. IDA has a remote debugger that I've successfully used in the past (see https://www.hex-rays.com/products/ida/support/idadoc/1463.shtml for example). It basically runs the target executable in a VM for example and your IDA then communicates with it through a network interface (I recommend this setup to not expose your IDA to the malware, in particular if you are debugging with an enable internet connection in your VM).
  3. There are some tools syncing Ghidra/IDA with x64dbg, it is not sustainable to recommend a particular one because they come and go like feathers in the wind. Google is your friend.
3
  • 1
    Could you explain the rationale to recommend against using the debugger in either. There are also emulation frameworks which work with IDA, btw. And it allows you to communicate with a remote using the gdbserver protocol.
    – 0xC0000022L
    Nov 16, 2023 at 13:09
  • Those debuggers are just not the focal point of IDA/Ghidra. While they fundamentally do their job, x64dbg is just far more powerful. That's why I suggest OP familiarizes themselv with it.
    – born
    Nov 17, 2023 at 18:28
  • 1
    Undoubtedly x64dbg specializes in debugging much more than either of the other two tools. But when it comes to the other aspects of RCE, Ghidra and IDA excel and they are able to show pseudocode as was asked. It's that aspect that is lacking from your answer, IMO. I'm not aware that x64dbg would be able to do that. Am I missing something here? Also, those tools to sync across the main RCE tools are indeed nothing to rely on - not just because they often replace each other.
    – 0xC0000022L
    Nov 17, 2023 at 21:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.