2

I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit) I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script. To do so, I use command as such, to call text interface:

$ ~/.ida-6.5/idal -A -SDump.py my_app

However, it just flashed out in a sec and quited before any analysis happened. The only thing I saw on the last line of IDA is:

The file is encrypted. The disassembly of it will be likely useless. Do you want to continue? ? -> N~o

Anyone know how to make it Yes so I can use command line? Thanks.

Improve this question

2 Answers 2

Reset to default
1

I finally managed to modify LC_ENCRYPTION_INFO as fellow and it works!

http://www.infointox.net/?p=114

Just be sure for multiple architectures, choose correct bytes to filp.

Improve this answer
1
  • to get rid of multiple architectures, using lipo to extract correct version.
    – pa4373
    Mar 9, 2014 at 18:51
0

You can use the yes command.

yes | ~/.ida-6.5/idal -A -SDump.py my_app
Improve this answer
1
  • 1
    It says: "TVision error: Can not work with redirected stdin/stdout". It seems tvision library won't accept the trick.
    – pa4373
    Feb 21, 2014 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.