2

I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit) I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script. To do so, I use command as such, to call text interface:

$ ~/.ida-6.5/idal -A -SDump.py my_app

However, it just flashed out in a sec and quited before any analysis happened. The only thing I saw on the last line of IDA is:

The file is encrypted. The disassembly of it will be likely useless. Do you want to continue? ? -> N~o

Anyone know how to make it Yes so I can use command line? Thanks.

1

I finally managed to modify LC_ENCRYPTION_INFO as fellow and it works!

http://www.infointox.net/?p=114

Just be sure for multiple architectures, choose correct bytes to filp.

1
  • to get rid of multiple architectures, using lipo to extract correct version. – pa4373 Mar 9 '14 at 18:51
0

You can use the yes command.

yes | ~/.ida-6.5/idal -A -SDump.py my_app
1
  • 1
    It says: "TVision error: Can not work with redirected stdin/stdout". It seems tvision library won't accept the trick. – pa4373 Feb 21 '14 at 23:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.