Identifying Application Versions#
Viewing application versions with the hexadecimal editor HxD
From the above, it can be seen that the application is a 32-bit program, with the word "PE" followed by "PE..L..." If it were a 64-bit program, the word "PE" would be followed by "PE..d+".
The application version can also be viewed through an IDE.
Since it is known that this is a 32-bit program, open it with a 32-bit IDA.
After opening, the IDA: Quick start window will appear.
Click "new" to find the target application and load it. The interface is as follows:
Click "OK" and no settings are needed here. IDA will automatically recognize the architecture of the program.
Views#
After opening, the displayed window is as follows. The disassembly view is opened first after loading the executable program.
Press the space bar to switch between graphical and non-graphical instruction lists.
In Options-General-Disassembly, check "Line prefixes" to display the addresses of instructions in the graphical view.
The initial effect is as follows:
After modification:
IDA has multiple view modes, which can be seen in the view-Open subviews menu.
Recognizing Function Entry Points#
When there are multiple references pointing to the same address at the function entry point, the last repetition can be used as the entry point of the function, which is "push 0" in this case.
Saving Settings#
With this setting, the current configurations can be saved and loaded directly next time.
Character Search#
In the IDA tab that includes lists such as FUNCTIONS, STRINGS, NAMES, etc., you can search by pressing "CTRL+F" and filter based on the entered characters. Opening the menu bar VIEW-OPEN SUBVIEW-STRINGS allows you to search for all strings containing "Lu".
Opening the menu bar VIEW-OPEN SUBVIEW-DISASSEMBLY allows you to open a second disassembly tab that displays different content from the first.
There are three disassembly display views here.
Opening the menu bar VIEW-OPEN SUBVIEW-HEX DUMP allows you to display the hexadecimal view.
Right-clicking allows you to switch to text mode, or you can press the space bar to switch.
The text view is as follows:
Opening view-Open subviews-import allows you to view referenced external functions.
