1

I want to collect all the IDA recovered symbol information in data sections (this information could be function name, or it could be an entry of jump table, or it could be a reference to other data sections).

Here is an example of data sections from a IDA disassembled binary.

enter image description here

Basically there are three recovered symbols in data section, and I want to collect these information in a format like this:

0x804a018 : sub_804847b
0x804a01dc : _strchr
0x804a020 : sub_80484AE

I am thinking to traverse all the memory address of a binary's data sections, and check the content of each address, to see whether it is a recovered symbol.

But basically how to read a suspicious symbol when iterating addresses? I read the idc interface, but I just cannot find any the correct api to do so. Could anyone help me on this issue? I appreciate that.

------------------------ explain ------------------------

I didn't get an answer in that post, in addition, I think what I explained in that post is somehow misleading.

marked as duplicate by Jason Geffner, perror, jvoisin, peter ferrie, usr2564301 Apr 22 '15 at 18:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • It can also be a random sequence of binary numbers instead of an address. The only numbers that should be converted to an actual address are those listed in the relocation table. – usr2564301 Apr 3 '15 at 9:58
  • @JasonGeffner, hi Jason, firstly, my question is still not be answered in that post. Secondly, I am worried that post contains much more stuff that can mislead other people. Anyway, any though on this issue? :) – lllllllllllll Apr 3 '15 at 14:16
  • @Jongware, thank you and I know it could be. So you mean the symbolized memory references are already listed in relocation table, does IDA-Pro collects this information? – lllllllllllll Apr 3 '15 at 14:18
  • If they are present in the executable, then it should be aware: my free-demo version shows a comment such as OFF32 SEGDEF [CODE,524A0612] for undefined bytes that are relocated, but it does not complain if I define them otherwise. I'm not sure if one can interrogate the relocation table through IDA. – usr2564301 Apr 3 '15 at 15:10
1

As far as I understood your question, you will need the following IDAPython apis:

  • Getting a content from specific memory address : idc.Dword(address) or idc.Qword(address) - you should choose the function according to the pointer size.
  • Obtaining a name of the address: idc.Name(address)

All the mentioned IDAPython apis has the similar things in idc

So, for your specific example you'll get the desired output as follows (IDAPython):

import idc
addresses = [0x804a018, 0x804a01dc ,0x804a020 ]

for a in addresses:
    print hex(a)," : ", idc.Name(idc.Dword(a))

Filtering the data in the .data section is completely different story.

For example you can do the following (it is not 100% correct):

import idc

segstart = your_code_segment_start
segend = your_code_segment_end
ptrstep = your_system_pointer_size_in_bytes

for a in range(segstart, segend, ptrstep):
    data = idc.Dword(a) #replace with qword if working with 64 bit)
    if a < segstart or a >= segend:
        continue
    if not idc.Name(data) is None:
        print hex(a), " --> ", idc.Name(data)

Not the answer you're looking for? Browse other questions tagged or ask your own question.