Username/Email:  Password: 
TwitterFacebookFlickrRSS
Home ›

Reverse Engineering Malware on Linux with IDA Pro

Jul 31, 2008  By Kristian Erik H...

The brief method. If I get good response to this post, I will put up a more detailed and in-depth look at malware reversing on Linux.

Steps:
* Download IDA Pro (freeware)
* Install wine
* Install IDA Pro
* Start reversing

Download IDA Pro (freeware):
$ cd /tmp
$ wget http://85.17.201.4/files/idafree49.exe

Install wine:
$ sudo aptitude install wine

Install IDA Pro:
$ wine /tmp/idafree49.exe

Start reversing:
$ wine "~/.wine/drive_c/Program Files/IDA Free/idag.exe"
-> Now open the malware binary and select the option for ELF executables

This post is a stub for a future longer version if anyone shows interest. I don't even know how many Linux Journal readers actually reverse malware on Linux...

______________________

Kristian Erik Hermansen is a Linux Journal Reader Advisory Panelist. Track Me.

  • del.icio.us
  • Digg
  • Facebook
  • Reddit
  • SlashDot
  • StumbleUpon
  • Post to Twitter

Comments

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

+1

slowpoison's picture
Submitted by slowpoison (not verified) on Sat, 08/09/2008 - 02:53.

I need to see more!

I need it too!

Kamal Wickramanayake's picture
Submitted by Kamal Wickramanayake (not verified) on Thu, 08/07/2008 - 19:19.

Count me in.

I want to see a more

Gullit's picture
Submitted by Gullit (not verified) on Thu, 07/31/2008 - 12:04.

I want to see a more detailed and in-depth look at malware reversing on Linux too!

Thanks in advance!

Count me in(terested)

EdT.'s picture
Submitted by EdT. (not verified) on Thu, 07/31/2008 - 03:29.

I am definitely interested in the in-depth version!

~EdT.

the linux part is irrelevant

b0ne's picture
Submitted by b0ne (not verified) on Thu, 07/31/2008 - 08:04.

Reverse engineering malware with IDA is the same regardless of which platform you use, especially if you are using WINE and IDA v4.9 free. There is a linux native version of IDA, except that it is commercial only.

Either way, you are still going to need a virtualbox/vmware/etc virtualization image of Windows XP SP2 or newer in order to effectively unpack most malware using a debugger.

I dont see why you think a

Kristian Erik Hermansen's picture
Submitted by Kristian Erik H... on Thu, 07/31/2008 - 18:59.

I dont see why you think a windows installation is necessary to unpack linux ELF obfuscated binaries :-)

Kristian Erik Hermansen is a Linux Journal Reader Advisory Panelist. Track Me.