6

As a beginner I'm trying to disassemble a file with IDA Pro 6.5. I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program.

Now, I want to get the image base of current setting through IDC or IDAPython. Are there anyone to tell me how to write script?

Thanks in advance.

9

idaapi.get_imagebase() is your friend.

Just in case you didn't know, all the reference documentation for idapython is here

Example:

Python>hex(idaapi.get_imagebase())
0x100000L
  • My firend, You mean that I should wirte a plug-in for get image base? but I just want to get image base through IDC or IDAPython? – user6903 Mar 18 '15 at 9:13
  • No. Just run this function from the python command line near "Python" button or from "File-->Script command" dialog. – w s Mar 18 '15 at 9:16
  • Yes, I got it. Thank you so much! My friend. – user6903 Mar 18 '15 at 9:22
3

idc unattended

F:\IDA_FRE_5>del outtext.txt & idag.exe -A -S.\segbase.idc c:\WINDOWS\system32\c
alc.idb & sleep 5 & type outtext.txt
Segment Base is 1001000

F:\IDA_FRE_5>type segbase.idc
#include <idc.idc>
static main ()
{
auto fpo,fullstr,segbase;
        Batch(1);
        segbase = SegStart(MinEA());
        Message("base is %x\n",segbase);
        fpo = fopen("outtext.txt","wb");
        fullstr = form("Segment Base is %x\n",segbase);
        writestr(fpo,fullstr);
        fclose(fpo);
        Exit(0);

}

F:\IDA_FRE_5>
  • Unattended... Nice touch! :) – Carlos Garcia Apr 20 '15 at 12:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.