This problem has not escaped analysts, and there are various attempted solutions to it already floating out there on the internet. The Remote WinDbg Solution (But First, a Word about Labeless) Reverse engineering is difficult enough already without all this additional overhead. At best, you are constantly switching attention back and forth from your clean environment to your infected environment, transferring information manually from here to there and back again using this-or-that workaround. Debugging without all your hard-earned labels feels like a waste, and conversely, the realizations you reach while debugging don’t magically record themselves in your disassembly database it’s up to you to take care of that. The malware, and the debugger, therefore go in a Virtual Machine or some such. Debugging malware also involves running malware, and it is not a good idea to run malware on a machine that you actually use for anything else (including malware analysis). In both cases, you have little choice but to sigh and fire up the debugger.īut then you run into one final annoying trade-off. You are interested in a certain execution artifact execution might not reach the relevant branch, or the sandbox might not see the artifact as important enough to record. One way of tackling them is throwing the malware in a sandbox (such as Cuckoo Sandbox) and seeing what comes out the other side, but a sandbox analysis is typically a blunt instrument. But if you’re like me, and you like your disassembler features, Breakpoint-Hard problems are a special kind of frustrating. If the debugger is your tool of choice already, these problems shouldn’t bother you too much. I like to call these problems “Breakpoint-Hard” (in the same vein as NP-hard). That’s just one example - there are many questions about code that, in practice, can only be answered by running the code. Disassemblers offer a graph view, type propagation, decompilation engines and definitive answers debuggers don’t, but they are the sane way to tackle questions like “which std::String method am I looking at”. It’s a skill built on intuition, a healthy workflow and an ability to pick the right tool for the job. There is no royal road to malware analysis. The Problem Statement - Dynamic, Granular, Safe: Pick Two If you’ve never used IDA, you don’t have much to gain from this article unless you are absolutely sure that you really must have this feature to get started.

Familiarity with IDA Pro: This article explains how to add a very specific feature to IDA pro.

The most technically involved it gets is setting up a working SSH server on one of the VMs that you can access from another machine.

Basic experience with virtual machines, i.e.

Scriptable Remote Debugging with Windbg and IDA Pro

Ida hide debugger