I have a large section in IDA that is a data lookup table of word length data. I want to change them all to word length rather than byte length. I know you can make an array but when I do it becomes an array of bytes.
4 Answers
- Create one word (or dword)
- Use the "Make array" command to create an array of words. You can select the range of data you want to convert to automatically calculate the item count.
If you want to have each element as a separate item and not part of array, uncheck the "Create as array" option.
There may be a better way of doing it, but I've always accomplished this with a simple script that lets me just select the range of bytes that I want to convert to dwords. Something like:
ea = SelStart()
end = SelEnd()
print "Making DWORDs from 0x%X - 0x%X" % (ea, end)
MakeUnknown(ea, (end-ea), DOUNK_SIMPLE)
while ea < end:
MakeDword(ea)
ea += 4
-
That's a good idea, I haven't started using scripts that much yet so I didn't even think about doing that.– gigawattMay 1, 2013 at 15:04
Here is how I did it.
I changed the first couple of bytes to data, made an array so I had an array of words and then edited the array to contain more elements.
According to devttys0's answer.
This script is for IDA version higher than 7.4.
def convert_data():
align_size = ida_kernwin.ask_long(4, "align size")
if align_size == None:
return
start = idc.read_selection_start()
end = idc.read_selection_end()
print("Align %d bytes from 0x%X - 0x%X" % (align_size, start, end))
ida_bytes.del_items(start, (end-start), ida_bytes.DELIT_SIMPLE)
flag = None
if align_size == 1:
flag = ida_bytes.FF_BYTE
elif align_size == 2:
flag = ida_bytes.FF_WORD
elif align_size == 4:
flag = ida_bytes.FF_DWORD
elif align_size == 8:
flag = ida_bytes.FF_QWORD
elif align_size == 16:
flag = ida_bytes.FF_OWORD
if flag == None:
ida_kernwin.warning("align size is invalid")
return
while start < end:
ida_bytes.create_data(start, flag, align_size, ida_idaapi.BADADDR)
start += align_size