8

While disassembling a malware binary, I came across several arrays of shorts. The size of each array is 1024 members. I would like to export them to C style arrays, as:

short array1[1024] = { 2, 5, 8, ... , 4};  /* This is just an example */

I could definitely do Copy/Paste and edit the whole thing by hand. However, it seems to be pretty tedious. I wonder, is there a better approach to achieve it? Could it be done with script/plugin?

2 Answers 2

12

A small script will do the trick. In IDC, something like:

auto ea, len, i;
len = 1024;
ea = /* whatever */;

Message("short array[1024] = {\n  ");
for(i = 0; i < len; i = i + 1)
{
  Message("0x%.04lx", Word(ea+i*2));
  if( i != (len - 1) )
    Message(",");

  if(i > 0 && (i % 0x1f) == 0)
    Message("\n  ");
}
Message("};\n\n");


To Handle Bytes instead of Words
Replace 
`Word(...)` with `Byte(...)` 
and
`0x%.04lx` with `0x%.02lx`
and
 Word(ea+i*2) with Byte(ea+i)


To Handle DWORDs instead of WORDs
Replace 
`Word(...)` with `DWord(...)` 
and
`0x%.04lx` with `0x%.08lx`
and
 Word(ea+i*2) with DWord(ea+i*4)
3
  • I think you wanted to replace if(i > 0 && (i & 0x1f) == 0) with if(i > 0 && (i % 0x1f) == 0) modulus instead of and =] I fixed it for you
    – SSpoke
    Oct 24, 2015 at 5:56
  • No, the code is correct as written. And with 0x1f is the same as unsigned modulus by 0x20. Oct 24, 2015 at 9:57
  • Nope I tested your code it didn't work, the And operator just did it once.. and never worked for the next batch of 32 bytes idk why though it should work you are right..
    – SSpoke
    Oct 24, 2015 at 21:35
10

Old question, but as of IDA 6.5, there is a new menu option Edit/Export data... that handles this situation for you. First select the data you wish to export then, via the menu option, choose the output format and file name in which to save the data.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.