0

I'd like to export the Hex View generated from IDA to a file with the addresses intact similar to the .LST files generated for assembly instructions.

The closest I've come to generating this file is to select all and then export as a string. However this doesn't save the addresses.

Is there a way to produce this data?

  • What addresses? Merely the offsets in the file or the respective segment addresses and whatnot? IDA assigns some of those arbitrarily, i.e. it would be better to explain what your goal is and not so much ask about the specific next step you think you need. As for the offsets, standard tools like xxd can give you this ... e.g. xxd -g 1 <filename> – 0xC0000022L Jun 27 at 11:47
  • I just wanted a way to reconcile the Hex View with the .LST file with the disassembled instructions. I noticed using a different tools (od) gave slightly different offsets than IDA. – Srinivas Eswar Jun 28 at 15:23
1

i don't think you have a ready made dumper with rebased addresss intact in ida hexview

but you can improvise the idc Script Below to dump the bytes with Address intact

(this script was used in Idafree 5.0 long back so you may need to refresh the Function/syntax (idafree 5 was 32 bit idafree 7 is now 64 Bit so may be somethings change i don't know)

auto min;
auto count;
auto fhandle;

count = 0;
fhandle = fopen("c:\\idahexviewa.txt" , "wb");
min =MinEA();

for ( min ; min < min + 16 ; min = NextAddr(min) )
{
    if(min == BADADDR )
    {
        break;
    } 

    if(count == 0) 
    {
        fprintf( fhandle, "%s:%x " SegName(min), min);        
    }

    fprintf( fhandle , "%02x " , Byte(min));
    count = count+1;

    if( count == 16) 
    {
       count = 0;
       fprintf(fhandle, "\n");
    } 

}    
fclose(fhandle);

result

C:\>head -n 2 idahexviewa.txt
HEADER:2000000 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00
HEADER:2000010 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00

C:\>tail -n 2 idahexviewa.txt
.data:20581e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
.data:20581f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

C:\>wc -l idahexviewa.txt
22528 idahexviewa.txt

C:\>powershell -c "\"{0:x}\" -f (22528 * 16)"
58000

some 200 bytes appear to be missing so the hexview must have some hole

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.