IDA Pro 4.9 - unpacking plug-in tutorial

Remote debugging with IDA Pro. © DataRescue 2005Since version 4.8, IDA Pro supports remote debugging of x86/AMD64 Windows PE applications and Linux ELF applications over TCP/IP networks. Remote debugging is the process of de bugging c ode runni ng on one ne tworked c omputer from another ne tworked c omputer: • The computer runni ng t he ID A Pro i nterface will be called the "de bugger client".• The computer runni ng t he application t o de bug w ill be called the "de bugger server". Remote de bugging w ill be pa rticularly us eful in the fol lowing c ases: • To debug virus/trojans/malwares : in this way, the debugger client will be as isolated as possible from the compromised c omputer.• To debug applications encountering a problem on one computer which is not duplicated on ot her computers.• To de bug di stributed a pplications. • To always debug from your main workstation, so you won't have to duplicate IDA configuration, doc umentation a nd va rious de bugging re lated re sources everywhere. • In t he fut ure, to de bug a pplications on m ore ope rating s ystems and a rchitectures. This small tutorial will pre sent how to s etup a nd us e remote de bugging i n pra ctice. The remote IDA debugger server.In order to allow the IDA client to communicate with the debugger server over the network, we must first start a small server which will handle all low-level execution and debugger operations. The IDA distribution ships with a Windows debugger server ...