IDA Reverse Engineering - Module 2

Module 2, Part 1 of our IDA reverse engineering series. A step by step guide to marking up Windows PE binaries using IDA. In this tutorial we begin our analysis of the extracted Stage 2. binary. We focus on the entry point of an EXE file, and the CRT main "boilerplate" code.

This is a very basic tutorial that introduces the concept of Structs, Arrays, custom Enums, and nested data structures.

Sample

7b5b060d9013725413f3f77719d0881035246b281e18005c0040e78a32e1c6cc

References

• pebase.h

• Understanding PE Parsing Tutorial Series

• IDA Enums

• IDA Arrays

• IDA Unions