IDA is the disassembler I use for several years now.
Why this one and not another ?
- a lot of processors supported
- renaming functions/vars is a timer saver
- ability to create my own loader/script/custom function
Unfortunaly, it also comes with a lot of cons
- basic license is 1000$ (!!)
- API is a pain to understand...when you finally find a doc !
- API changes every version
- born as a DOS software, so it still uses DOS hotkeys
- no UNDO (save often!)
► Use it
Basically, you load a binary, select a processor and start analysis.
Sometimes, IDA is able to define the exact format of the binary (EXE, ELF,..) and so exactly knows where the code start.
If not, move to the code start and press C (code).
Or, better one, you can create your own loader (see below)
I won't explain the basis in process here. I suggest you read
this BlackHat training
or, if you're looking for more,
the IDA Pro Book, 2nd Edition
And yes, I still use 6.1, it's the more "common" version, which mean a better compatibility rate with freely available plugins
► Basic Loader
If you deal with old systems, apart Arcade which often use raw binary, it's almost sure the program format isn't handle by IDA.
The processor is probably available (Z80, 6502, 68000) but it doesn't understand the header (segments def, interrupt vectors, rom header)
According the complexity of the header, it's in fact easy to explain it to IDA : you need to write your own loader.
► Extended Loader
The loader will tell to IDA what to load and where to start code analysis.
But you could even make something more useful : define the BIOS functions, which will make easy to read the disassembled code.
To do this, you need the know these BIOS functions of course so get your system dev doc!
► Basic Plugin
Sometimes, you need to convert a lot of bytes to something more.
The easiest way to do it, if it's something you do 'often', is to write a plugin.
This plugin could be called from menu and/or hotkeys to act of selected code or whatever you need
► Extented Plugin
Here, we jump to the hardest part of IDA. Be sure to do it only if you need it AND you'll use it more than once (and you'll share it)
It allows you to add code on IDA, with a new GUI if needed.
COMING (not so) SOON