In this weeks MindshaRE we will show you how to add IDA into the right click context menu of windows explorer. This is handy when quickly disassembling .dll's and .exe's.
MindshaRE is our weekly look at some simple reverse engineering tips and tricks. The goal is to keep things small and discuss every day aspects of reversing. You can view previous entries here by going through our blog history.
When disassembling binaries in IDA most people will go through a couple steps to load a new binary. In the past I would first open IDA, locate the binary I want to disassemble, and drag it from the explorer window into the IDA MFC. This is fine, but we are always looking for a more efficient way to work.
Adding IDA to the right click context menu in explorer is pretty simple. This allows you to right click any binary you have set up for IDA to handle, and simply clicking "IDA" or whatever you want to label it. By doing this we can disassembly target binaries with a few clicks. There are several ways we can achieve this but I will present the one I use. Here's the steps to accomplish this.
- Open "regedit.exe"
- Open the key "HKEY_CLASSES_ROOT"
- Locate the file extension class you want.* ("dllfile" and "exefile")
- Open the sub key "shell", it the key does not exist create it
- Create a new key
- Give it the text label you want displayed when you right click the file type
- Create another key under the label and name it "command"
- Open the "(Default)" key under the newly created label key
- Add the path to your installation of IDA Pro's idag.exe binary in double quotes followed by "%1"
- Repeat for any other file extensions you want
- Close "regedit.exe"
Adding IDA to the context menu is a very simple action. But if you are like me and use the application daily it can really help. Thats all for this week, see you next week.
-Cody
