4

I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit "c" in order to convert to instruction/code.

However, I am primarily trying to do all my ida work via linux terminal (using the command line ./idal -B input-file). Is there a command line flag, or another method, to automate the generating of instructions from the binary files? Or is this something I will have to manually do every time?

  • For additional information: I am running IDA 6.5 on linux ubuntu 12.10. I am primarily looking at MBR files. – user3119546 Jan 7 '14 at 14:03
3

I would do something like this in IDAPython:

# I didn't check this code, please use carefully !This code will pass through all defined segments and will try to make code on any unexplored area
# IDAPython documentation is at https://www.hex-rays.com/products/ida/support/idapython_docs/

import idautils
import idc

for ea in idautils.Segments():
    segend = idc.GetSegmentAttr(ea, idc.SEGATTR_END)
    start = ea
    while start < segend:
        idc.MakeCode(start)
        start = idc.FindUnexplored(start+1, idc.SEARCH_DOWN)

You can run it with -S command line switch as stated in previous answer

  • @w s So this seems to work when I run it via IDA GUI (going to file -> script file) and importing it that way. However, when I run it via terminal line with the -S flag. It comes out without the translated instructions. Is it something wrong with the way I am calling ida? ./idal -B ~/Desktop/test_binary.dump -S script.py? – user3119546 Jan 7 '14 at 15:39
  • 1
    SOLVED: In order to have a command line switch recognized you need to have it appear before the file to be analysed. – user3119546 Jan 7 '14 at 16:00
2

You can use specify an IDC script on the command line via the -S switch, with which you can try calling AnalyzeArea(); if that doesn't work, you can use MakeCode().

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.