3

I am reversing several modules which are dynamically and statically linked into an executable. I have started learning active analysis by attaching one of my database files to the win32 exe using the local win32 debugger (default settings).

Relocating my idb's annotations to map correctly to the exe seems to be taking longer than it should. I am currently doing static analysis by comparing one idb against a memory snapshot because the relocation time does not seem to be worth the wait. This creates, what I think may be, unnecessary work because I have to manually copy the annotations from the single module idb to the snapshot idb.

I want to find out if I can change how I use IDA to speed up relocation. I have no notion of how long this should take given the database's and exe's size.

idb:  ~133 Mb
exe:  ~650 Mb     Size taken from task manager
relocation time:  ~15+ minutes

This is very open ended. I guess I'm looking for debugger settings, hidden annotation performance hits, etc. If this is normal I will try to adjust my debugging practice to get the most out of a session.

5

If the problem is the time it takes for IDA to rebase the IDB when debugging, then some possible solutions:

  1. Disable ASLR from module, so it keeps loading at the same base address (same base address from the IDB)

    • Pros: Works well for main executable
    • Cons: might be a problem for DLLs (see 3.); alter file.

How to: Remove IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE (0x40) from IMAGE_NT_HEADERS.OptionalHeader.DllCharacteristics.

  1. [Dangerous] Disable ASLR system wide (would be possible in a spare VM).

    • Pros: same as 1.
    • Cons: Same as 1. ; Lower whole system protection

How to: change HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\MoveImages

  1. Rebase all DLLs so they don't collide (apply this with 1.)

    • Pros: all DLLs will have different address base
    • cons: alter files.

How-to:

Simply use different base addresses for all the DLLs (do not apply this on system DLLs).

  1. Use external debugger and synchronize IDB with it.

How-to:

  • use QB-sync: it allows you to debug a binary from a debugger (windbg, ollydbg, gdb, etc.) and synchronize the database with the debugger without rebasing the IDB.

  • Pros: works well, lots of things can be done from debugger

  • Cons: Needs to be confident with an external debugger

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.