2

i have tried almost all links about batch mode. My Question is that i did not get the user manual about batch mode of ida pro that how can i use the commands like -c -A -B and how i can run script on on any file with batch or terminal mode commands and what the use of idag, idaw

3
  • 1
    Which OS do you want to use ?
    – w s
    Apr 7 '17 at 17:52
  • 1
    What exactly are you trying to do ?
    – w s
    Apr 7 '17 at 17:53
  • currentyl i am using windows os and i want to export .asm or text files from multiple .exe files in IDA pro 6.5 and also each .exe file has its separate txt or .asm file and txt or .asm file contain the assembly code of that .exe
    – Jerry shaw
    Apr 8 '17 at 18:44
2

You should do the following:

  • Open a command line interpreter window of Windows OS (cmd.exe)
  • Find the exact location of the IDA executable that you are usually running (should be idaq.exe in modern versions, you can check the exact name in desktop shortcut by examining its properties)
  • Run it from the comma nd line interpreter window (paste the IDA executable full name, surround it with quotes) with -B command line switch. You'll have something like this: "c:\Program Files (x86)\IDA 6.95\idaq.exe" -B {full path to the file you want to analyze}
  • After running this command you should see the idb and assembly file in the same directory where your executable that you tried to analyze resides. Please note that you should run it on behalf of user that has write access permission for the folder where it resides. In addition you need to use appropriate IDA version: if the analyzed executable has 64 bit instruction set you have to use idaq64 executable.

Here is how it works (and worked always) on my computer with IDA 6.95 (I analyzing 64 bit object file test.o, and corresponding ida database extension is not idb, but i64):

C:\Users\[censored]\Downloads\idatest>copy z:\test.o .\
        1 file(s) copied.

C:\Users\[censored]\Downloads\idatest>"c:\Program Files (x86)\IDA 6.95\idaq64.exe" -B .\test.o

C:\Users\[censored]\Downloads\idatest>dir
 Volume in drive C is OSDisk
 Volume Serial Number is F88B-CF68

 Directory of C:\Users\[censored]\Downloads\idatest

04/13/2017  04:20 PM    <DIR>          .
04/13/2017  04:20 PM    <DIR>          ..
04/13/2017  04:20 PM             2,985 test.asm
04/13/2017  04:20 PM            65,992 test.i64
03/22/2017  06:44 PM             1,424 test.o
               3 File(s)         70,401 bytes
               2 Dir(s)   8,296,001,536 bytes free

Let me know in comments if something doesn't work. Btw, help on command line switches is here.

7
  • 1) Thank u for showing your interest 2) when i run this command in cmd i got nothing in cmd .The cmd just takes me to next line and ask for next command. 3) where the produce .asm files are placed 4) what will be the path of your file "calc.exe"
    – Jerry shaw
    Apr 11 '17 at 7:30
  • Please put the full path to your executable instead of calc.exe: it is a kind of tradition to use this executable as an example. Keep me posted.
    – w s
    Apr 11 '17 at 19:10
  • again when i give path to calc.exe like "C:\Program Files (x86)\IDA 6.5" -B .\C:\Program Files (x86)\IDA 6.5\calc.exe and run this command in cmd i got nothing in cmd .The cmd just takes me to next line and ask for next command
    – Jerry shaw
    Apr 12 '17 at 8:12
  • Check the content of the directory where you are running IDA. do you see new files there ? There should be idb and asm files
    – w s
    Apr 12 '17 at 8:14
  • actually i got nothing in that directory
    – Jerry shaw
    Apr 12 '17 at 9:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.