How to extract all the rodata data and bss section using IDC script in IDA Pro?

Question

test Platform is 32 bit Linux ELF and 32 bit Windows PE.

I use IDC script to extract all the functions from binary and dump into a file, then do the analysis based on the examples in IDA Pro book.

But I don't know how to extract .data .rodata and .bss sections from ELF file using IDC script.

Currently I use IDA Pro to create a asm file, and use Python script to do the string parser work, extracting .data .rodata and .bss sections from this asm file.

Basically It works fine, but a really tedious modification work is required, and as my test base is relatively large(notepad++ and others..), I have to spend lots of time do modify work to correctly extract this three sections.

My question is "is there any idc script/idapython script can extract .data .rodata and .bss sections from ELF file?" and any solutions on Windows are also welcomed.

Thank you!

Answer 1

For the .bss section something like the following may work for you:

import idaapi
import idc

print "section .bss"
start = idaapi.get_segm_by_name(".bss").startEA
end = idaapi.get_segm_by_name(".bss").endEA
item = idc.NextHead(start - 1, end)
while item != BADADDR:
   next = idc.NextHead(item, end)
   if next != BADADDR:
      print "%s: resb %d" % (idc.Name(item), next - item)
   else:
      print "%s: resb %d" % (idc.Name(item), end - item)
   item = next

although in practice, NextHead does not seem to pick up anything named as unk_XXXX, so you may need to further iterate over the section to determine whether there are any cross references to an address to decide whether to associate a declaration with it.

For the .data and .rodata sections you will need to change to db/dw/dd/... as appropriate and additionally dump the content of the related items. The challenge for items in these sections is to properly determine the size of each item and correctly choose db/dw/dd/... Dumping raw bytes with db may be the simplest approach here.

Answer 2

#Use carefully, I didn't check this code
#beware errors
#It's IDAPython, not IDC
#

import idautils
import idc
import idaapi

segfiles = {".rodata": "rodata.bin",
            ".data": "data.bin"}

# over all segments
for s in idautils.Segments():
    if idc.SegName(s) in segfiles:
        #if we need this segment ...
        fname = segfiles[idc.SegName(s)]
        f = open(fname, "wb")
        start = idc.GetSegmentAttr(s, idc.SEGATTR_START)
        end = idc.GetSegmentAttr(s, idc.SEGATTR_END)
        #from start to end write all to file
        while start < end:
            b = idc.Byte(start)
            f.write(b)
            start += 1
        f.close()