I'm solving this CTF with IDA Pro 7.0.

At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it.

The main problems are:

  • the calculation is done using 8 assembly instructions, and it happens quite often, so it spams my screen.

  • it might not be calculated exactly the same every time, and I might miss it when auditing for bugs, but if the macro will only take place for specific instructions, I won't miss it.

So my question is: is there a way in IDA to combine these sequence of instructions to a single macro?

repeated code in red

Thanks!

  • IDA can hide code (View menu) and this can be done via IDC and consequently also via IDAPython. So what you could do is to list all instructions referencing your secret_list, check that it's a lea and that the subsequent instructions match your expectation and simply hide the address range and provide a meaningful alternative string on that hidden area (I typically use the ; comment style for these things as it's most explicit). In the past I have, for example, postprocessed some binaries which had lots of assertions with debug output to compress these to one line. – 0xC0000022L Nov 6 at 19:50
  • No, there is no way. I wish. I had asked myself for the same (but for the decompiler) various times. – joxeankoret Nov 6 at 20:07
  • 2
    @0xC0000022L - Thanks, after some research, the function add_hidden_range(0x10AF, 0x10C9, "calc_offset" ,0 , -1) did the trick. now it's just a matter of coding an IDAPython script to automatically search for all sequence of bytes of a specific macro, and replace them all ;) – reida Nov 6 at 23:38

Okay, to formalize this (and since I have some time now to type up an actual answer).

The add_hidden_range() IDC function and the SDK function of the same name (bytes.hpp) can be used for the purpose. (However, I am almost sure there was another function I used at the time.)

update_hidden_range() may also be of interest (see link above).

When I used this some years ago to write an IDC script (IDAPython didn't ship with IDA at the time), I used this to hide the code for some repetitive debug print and assertion functionality in some (checked) Windows binaries I was looking at. For this I used gray color and replaced the whole hidden range with an assembly-style comment (; prefix). The comment would then contain pseudocode of the debug print or assertion it was hiding. This helped a lot in making the disassembly a lot cleaner for reading.

The biggest challenge other than finding the functionality and the IDC function exposing it initially, was to look for the opcodes surrounding the xref locations of the known functions calls and make sure I wasn't hiding some interspersed opcodes. So essentially I made sure that the script would verbosely output whenever it hit an instance where unexpected opcodes where interspersed with the expected opcodes, showing the EA, and could then double click on that in the log pane to review those (in my case rare) instances manually.

Other instances where this technique proved useful were well-known inlined functions (think memmove, memcpy and friends). The patterns repeat and by hiding the opcodes and replacing them with meaningful pseudocode you can speed up reading your disassembly considerably (even without a decompiler plugin).

  • Can you add/provide any pre-written script as example? – Biswapriyo Nov 8 at 17:56
  • @Biswapriyo tough, the one I mentioned in my answer I don't have the rights to (did that for work) and besides I'd need the binary (anything else is like programming in thin air). I'll try to think of something that resembles what is needed. – 0xC0000022L Nov 8 at 20:25

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.