1

test Platform is 32 bit Linux ELF and 32 bit Windows PE.

I use IDC script to extract all the functions from binary and dump into a file, then do the analysis based on the examples in IDA Pro book.

But I don't know how to extract .data .rodata and .bss sections from ELF file using IDC script.

Currently I use IDA Pro to create a asm file, and use Python script to do the string parser work, extracting .data .rodata and .bss sections from this asm file.

Basically It works fine, but a really tedious modification work is required, and as my test base is relatively large(notepad++ and others..), I have to spend lots of time do modify work to correctly extract this three sections.

My question is "is there any idc script/idapython script can extract .data .rodata and .bss sections from ELF file?" and any solutions on Windows are also welcomed.

Thank you!

  • What do you mean by extract section ? What information exactly do you want to get from there ? – w s Feb 2 '14 at 15:26
  • @ws Just the data info defined in .data .rodata and .bss sections... – lllllllllllll Feb 2 '14 at 15:40
3

For the .bss section something like the following may work for you:

import idaapi
import idc

print "section .bss"
start = idaapi.get_segm_by_name(".bss").startEA
end = idaapi.get_segm_by_name(".bss").endEA
item = idc.NextHead(start - 1, end)
while item != BADADDR:
   next = idc.NextHead(item, end)
   if next != BADADDR:
      print "%s: resb %d" % (idc.Name(item), next - item)
   else:
      print "%s: resb %d" % (idc.Name(item), end - item)
   item = next

although in practice, NextHead does not seem to pick up anything named as unk_XXXX, so you may need to further iterate over the section to determine whether there are any cross references to an address to decide whether to associate a declaration with it.

For the .data and .rodata sections you will need to change to db/dw/dd/... as appropriate and additionally dump the content of the related items. The challenge for items in these sections is to properly determine the size of each item and correctly choose db/dw/dd/... Dumping raw bytes with db may be the simplest approach here.

2
#Use carefully, I didn't check this code
#beware errors
#It's IDAPython, not IDC
#

import idautils
import idc
import idaapi

segfiles = {".rodata": "rodata.bin",
            ".data": "data.bin"}

# over all segments
for s in idautils.Segments():
    if idc.SegName(s) in segfiles:
        #if we need this segment ...
        fname = segfiles[idc.SegName(s)]
        f = open(fname, "wb")
        start = idc.GetSegmentAttr(s, idc.SEGATTR_START)
        end = idc.GetSegmentAttr(s, idc.SEGATTR_END)
        #from start to end write all to file
        while start < end:
            b = idc.Byte(start)
            f.write(b)
            start += 1
        f.close()
  • Hi ws, Thank you a lot for your answer! what I am trying to do is to generate file like this:bss Is it possible to use IDA script to generate this from binary? – lllllllllllll Feb 2 '14 at 18:33
  • Run IDA from command line with -S switch – w s Feb 2 '14 at 18:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.