How to create an anonymous IDA PRO database (. IDB)

source:http://www.0xebfe.net/blog/2013/01/13/how-to-create-an-anonymous-ida-pro-database-dot-idb/

Probably it ' s not secret for you, every. IDB files contains header with your license information.

There is "Netnodes" in every. IDB file that reveals your identity. Basically "Netnode" is a block with some data and check:idasdk\include\netnode.hpp for more info.

So there is netnodes:

"$ user1"-Contains plaint text info about your license.
"$ original User"-contains encrypted info about your license.

Actually you can freely delete "$ user1" Netnode without any consequences, because IDA doesn ' t check it at all. But "$ original user" Netnode have strategic meaning for IDA PRO. This netnode contains RSA-1024 encrypted license information, same info so you have a "ida.key" file. When you open. IDB database IDA reads "$ original user" value, decrypts it with public RSA-1024 key and checks your license against MD5 H Ashes of blacklisted "pirated" licenses.

So what are we can do? We can ' t delete it, because IDA checks this netnode on every opening. We can ' t generate own value, because we don ' t have private RSA key. But we can copy this value from another. IDB file:)

I Googled and found this. IDB file from Trustwave:here

So let's dump "$ original user" Netnode in source. IDB file with following Python script:

netnode_dumper.py
Import Idaapi
Import Binascii
Print (Binascii.hexlify (Idaapi.netnode (' $ original user ', 0, False). Supval (0))

After the insert dumped value into the this script and the run it in IDA in destination. IDB:

netnode_updater.py
Import Idaapi
Import Binascii
Dumped_netnode_value = ' 111insert_your_hex_value_here111 '
Idaapi.netnode (' $ User1 ', 0, False). Kill () # deleting Netnode with plain text info
Idaapi.netnode (' $ original user ', 0, False). Supset (0, Binascii.unhexlify (dumped_netnode_value))

Save, re-open database. Let ' s check:

Yep, we have. IDB file from Trustwave now:)

And when IDA shows your this message:

Or "Sorry, this database have been created by a pirate version of IDA".

This means "$ original user" Netnode contains banned license info. But you still can copy this value from legit. IDB with Hex editor.

How to create an anonymous IDA PRO database (. IDB)