Challenge

Information is rarely produced and consumed strictly inside an application. Modern computers exchange information with other computers, store information on the disk, or in the cloud. Quite often, the used data format is undocumented, but there may be the need to interact with the application or extract its data. For example, to extract data from an obsolete software we need to know the used format. Or to take down a botnet, we may need to know its network protocol in order to send commands to the zombie computers it infected.

Approach

To deal with exotic file formats, IDA Pro can be easily extended with custom-crafted "loaders" and make the data available from within the UI. When it comes to reverse-engineering network protocols, one will typically pair up IDA Pro with a packet capture tool (e.g., Wireshark). The discovery of the protocol will be sped up thanks to analyzing both the traffic, and matching its usage in the client-side or server-side code.