1

Using python in IDA, I would like tu create a partial file dump. For exemple I would like to dump the data from offset X for a size of Y. I believe I could do it by using the idc.Dword function :

offset = X
res = []
while offset < offset + Y:
    res.append(idc.Dword(offset))
    offset += 4
return res

Is there a way of achieving that without reading manually each address?

  • See idc.get_bytes: def get_bytes(ea, size, use_dbg = False) – b27etula Jul 21 at 18:46
2

idaapi.get_many_bytes did the trick :

https://www.hex-rays.com/products/ida/support/idapython_docs/ida_bytes-module.html#get_many_bytes

Update for newer versions :

Python>get_bytes.__doc__
Return the specified number of bytes of the program
    @param ea: linear address
    @param size: size of buffer in normal 8-bit bytes
    @param use_dbg: if True, use debugger memory, otherwise just the database
    @return: None on failure
             otherwise a string containing the read bytes  

https://www.hex-rays.com/products/ida/support/idapython_docs/ida_bytes-module.html#get_bytes

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.