Skip to main content

Questions tagged [idc]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
92 views

IDC script offsets

I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
0 votes
1 answer
88 views

Patch all calls to a single function using IDC

I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this: In c++ disassembled code exist calls to a certain function. 2 thousand ...
0 votes
1 answer
96 views

How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?

Is there an API which lets me programmatically: set the default string type (Setup) and rebuild the string list (Rebuild) ???
1 vote
1 answer
92 views

Need Help Figuring out Multi-byte (in-memory) byte replacement using ida script (idc)

"I am trying to create a simple IDC script for IDA 7.7, which takes a known memory address (in the format 0x00000000), a string of replacement bytes (either in the format ffffffff or ff ff ff ff, ...
2 votes
0 answers
215 views

In IDA freeware, how to create a new database in IDC and load a file into it?

I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder. What ...
1 vote
0 answers
80 views

RE internship possibilities

I am currently studying computer science and I have to do a mandatory internship (6 months) soon. I am really enjoying re and I would love to get an internship in that area. My problem is that the ...
2 votes
1 answer
455 views

How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?

TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc). In order to explicitly load a type library I can use ...
1 vote
2 answers
336 views

Renaming a local stack variable with IDAPython

I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so... In my ...
1 vote
1 answer
557 views

How to have arrays in IDA's IDC

So to cut straight to the chase - I'm lazy, IDA is mysterious, I need to use IDA arrays in my IDC code for convenience. Because IDC is like C(++) in its syntax I figured I could do: auto lala[4] = {0,...
2 votes
1 answer
214 views

ApplyPatches to input file via IDC

Anybody know, how via IDC scripts applying patching for input file (i mean context menu: "Edit - Patch program - Apply patches to input file"). I viewed entire idc.idc and didn't see desired ...
1 vote
0 answers
168 views

Passing a pointer to a pointer to a string with IDA Pro's Appcall

I need to call an encryption function in a program with the following signature (the second argument is returned): char** __usercall decode(char** input, char** output) As far as I can tell, Appcall ...
3 votes
0 answers
153 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
3 votes
0 answers
64 views

Is there a way to resume execution of a process for a given amount of time then suspend it?

I am using the following IDC script in IDA: #include <idc.idc> static main() { for (i=0; i<10; i++) { PauseProcess(); ...
1 vote
2 answers
942 views

How to set conditional breakpoint to modify ZF (Zero flag)

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0. I don't know how to do it: I searched for example scripts in IDC or ...
2 votes
1 answer
773 views

Best way to quickly mark all lines as code in IDA?

I have a fairly large obfuscated program, and I need to mark all of the lines as code. I was able to do this in IDC by iterating through the lines and running MakeCode. It works for small amounts of ...
1 vote
1 answer
604 views

How to get the current offset use IDC or IDAPython?

When writing an IDA script, how to use IDC or IDAPython to get the file offset for a memory address?
1 vote
1 answer
4k views

How to convert Unexplored data in IDA Pro to code?

I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
0 votes
0 answers
306 views

How to find first/next instruction in IDA trace via IDC

Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns ...