7

Bear with me as I am new to IDA and have not managed to find an answer to my question on google or other related outlets.

I am reversing a firmware blob from an ARM device of which I have a c header file defining various memory locations as follows:

#define IO_LCD_OUT 0x4000000

Is there a way I can load this header file into IDA in order to redefine immediate values?

For Example, instead of:

MOV     R12, #0x4000000

Could IDA instead print:

MOV     R12, IO_LCD_OUT

Are there other ways to acheive this outcome aside from how I am trying to approach this? I have the header file with memory locations defined and would like to load that information into ida!

I have tried to parse it using File -> Load File -> Parse C Header File and have had no luck!

  • What error message(s) are you getting when you try Parse C Header File? – Jason Geffner Nov 18 '14 at 2:06
  • I'm not getting any error messages, it loads the file perfectly fine. I just don't know how to change the way the immediate values are displayed. When I right click 0x4000000 for example, there are no options that allow me to define it as the variable in the header file – Thomas Nov 18 '14 at 5:25
5

You can use custom enumerations here.

  1. Go to Enums list (Shift+F10).
  2. Add a new enum for you list of constants (Ins)
  3. Add constant(s) to the list (N), e.g. name IO_LCD_OUT and value 0x4000000
  4. Now you should be able to replace these constants in the disassembly, using M or the context menu.

You can speed up things by:

  1. Generating an IDC file from the header to build the enum programmatically (use functions AddEnum and AddConstEx). The h2enum.idc script might work too.
  2. Converting those defines to a C style enum, parsing the header, then using the imported enum from your disassembly (you will need to first perform Synchronize to idb step in the Local Types).
  • Will you have ability to cross reference addresses mentioned in defined constants ( for example #define IO_LCD_OUT 0x4000000 ) ? If yes, how is it possible ? – w s Nov 18 '14 at 13:39
  • 2
    No, currently cross-references to enums are not maintained, though we're considering adding this feature. – Igor Skochinsky Nov 18 '14 at 14:43
3

Importing header files will not do this work because there is no general way to find out meaning of any defined constant.

You'll need to do some manual work for it.

I handling this problem as follows (it requires some IDA scripting, but it should be easy):

  1. For all required memory regions (for example LCD) data segment should be created by using idc.AddSeg IDAPython api or via IDA UI. Addresses of those regions can be gathered from datasheets or by analysis of header files.
  2. All those address-meaning-defines should be extracted from header files and converted to global variable names by idc.MakeName IDAPython api.
  3. Binary should be reanalyzed (Options-->General-->Analisys-->Reanalyze program). If addresses are still not recognized, you will need to write IDAPython script that converts these addresses to offsets by idc.OpOff IDAPython api.

As far as I know there is no general solution for this problem in IDA for now.

  • When the values are referring to memory and are not just flags or whatnot, this is probably the better approach. – Igor Skochinsky Nov 18 '14 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.