2

I am learning how to use IDC Scripting,or IDAPython in IDA for Reversing binary.One day i face this problem:

You are given an array of random integer(4-byte integer) lies within the memory .The random number only be calculated while debugging .

The task is : extract each of those 4-byte integer from that array and put them into a new array,print the new array on console.

Arcording to what i have learned,IDA Hex-view present only 1 Hex Number in memory for each address.

For Example : at address 00791A00 contains an integer 1134,00791A04 contains an iteger 4567.In Hex-view it will be like this

                     00791A00 : 34
                     00791A01 : 11
                     00791A02 : 00
                     00791A03 : 00
                     00791A04 : 67
                     00791A05 : 45
                     00791A06 : 00
                     00791A07 : 00

Assuming the new array named "arr". So arr[0] = 0x1134,arr[1] = 0x4567. That's what i want! So,i'm wondering how can i do that with IDAPython,or IDC? The only thing i have known so far about IDC or IDAPython is writing a script to dump memory to a file.

Here is the Link from where i learned to dump memory: https://stackoverflow.com/questions/42744445/how-in-ida-can-save-memory-dump-with-command-or-script

I would appreciate if someone could give me a hint or walk me through with basic ideas on how to solve this problem.

0

from what i remember Ida would either show bytes with db prefix in Ida-view
or as a group of 16 bytes in hex-view
I am not sure where you see a display like that

enter image description here

if you mean the Ida View press d two times will make the db (define byte ) prefix to dd (define dword)
and selecting one dd will highlight the corresponding dword in hex view as in pic below

enter image description here

You can make an array using MakeDword(),MakeArray() idc commands

enter image description here

if you want to print the dwords with address you can employ a script like this

auto i;
for(i =0; i<5 ; i++) {
Message("%08x\t:%08x\n",(ScreenEA() + (i*4))Dword(ScreenEA() +(i*4)));
} 

enter image description here

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.