i have tried almost all links about batch mode. My Question is that i did not get the user manual about batch mode of ida pro that how can i use the commands like -c -A -B and how i can run script on on any file with batch or terminal mode commands and what the use of idag, idaw
-
1Which OS do you want to use ?– w sApr 7, 2017 at 17:52
-
1What exactly are you trying to do ?– w sApr 7, 2017 at 17:53
-
currentyl i am using windows os and i want to export .asm or text files from multiple .exe files in IDA pro 6.5 and also each .exe file has its separate txt or .asm file and txt or .asm file contain the assembly code of that .exe– Jerry shawApr 8, 2017 at 18:44
1 Answer
You should do the following:
- Open a command line interpreter window of Windows OS (cmd.exe)
- Find the exact location of the IDA executable that you are usually running (should be idaq.exe in modern versions, you can check the exact name in desktop shortcut by examining its properties)
- Run it from the comma
nd line interpreter window (paste the IDA executable full name, surround it with quotes) with
-B
command line switch. You'll have something like this:"c:\Program Files (x86)\IDA 6.95\idaq.exe" -B {full path to the file you want to analyze}
- After running this command you should see the idb and assembly file in the same directory where your executable that you tried to analyze resides. Please note that you should run it on behalf of user that has write access permission for the folder where it resides. In addition you need to use appropriate IDA version: if the analyzed executable has 64 bit instruction set you have to use idaq64 executable.
Here is how it works (and worked always) on my computer with IDA 6.95 (I analyzing 64 bit object file test.o, and corresponding ida database extension is not idb, but i64):
C:\Users\[censored]\Downloads\idatest>copy z:\test.o .\
1 file(s) copied.
C:\Users\[censored]\Downloads\idatest>"c:\Program Files (x86)\IDA 6.95\idaq64.exe" -B .\test.o
C:\Users\[censored]\Downloads\idatest>dir
Volume in drive C is OSDisk
Volume Serial Number is F88B-CF68
Directory of C:\Users\[censored]\Downloads\idatest
04/13/2017 04:20 PM <DIR> .
04/13/2017 04:20 PM <DIR> ..
04/13/2017 04:20 PM 2,985 test.asm
04/13/2017 04:20 PM 65,992 test.i64
03/22/2017 06:44 PM 1,424 test.o
3 File(s) 70,401 bytes
2 Dir(s) 8,296,001,536 bytes free
Let me know in comments if something doesn't work. Btw, help on command line switches is here.
-
1) Thank u for showing your interest 2) when i run this command in cmd i got nothing in cmd .The cmd just takes me to next line and ask for next command. 3) where the produce .asm files are placed 4) what will be the path of your file "calc.exe" Apr 11, 2017 at 7:30
-
Please put the full path to your executable instead of calc.exe: it is a kind of tradition to use this executable as an example. Keep me posted.– w sApr 11, 2017 at 19:10
-
again when i give path to calc.exe like "C:\Program Files (x86)\IDA 6.5" -B .\C:\Program Files (x86)\IDA 6.5\calc.exe and run this command in cmd i got nothing in cmd .The cmd just takes me to next line and ask for next command Apr 12, 2017 at 8:12
-
Check the content of the directory where you are running IDA. do you see new files there ? There should be idb and asm files– w sApr 12, 2017 at 8:14
-