Questions tagged [idc]
The idc tag has no usage guidance.
18
questions
3
votes
0
answers
156
views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
- 31
3
votes
0
answers
66
views
Is there a way to resume execution of a process for a given amount of time then suspend it?
I am using the following IDC script in IDA:
#include <idc.idc>
static main()
{
for (i=0; i<10; i++)
{
PauseProcess();
...
- 371
2
votes
1
answer
489
views
How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?
TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc).
In order to explicitly load a type library I can use ...
- 10.9k
2
votes
1
answer
217
views
ApplyPatches to input file via IDC
Anybody know, how via IDC scripts applying patching for input file (i mean context menu: "Edit - Patch program - Apply patches to input file"). I viewed entire idc.idc and didn't see desired ...
2
votes
1
answer
800
views
Best way to quickly mark all lines as code in IDA?
I have a fairly large obfuscated program, and I need to mark all of the lines as code. I was able to do this in IDC by iterating through the lines and running MakeCode. It works for small amounts of ...
- 121
2
votes
0
answers
218
views
In IDA freeware, how to create a new database in IDC and load a file into it?
I have IDA freeware version 5 and version 8, v5 is running on wine, v8 is directly on kali OS, and I am trying to create an IDC script to generate asm+lst files for all files in a certain folder.
What ...
1
vote
1
answer
4k
views
How to convert Unexplored data in IDA Pro to code？
I am analyzing a malware, it has a lot of confusing methods, I wrote an idc script to remove confusion, use the MakeCode() function to convert some Unexplored data into code, but there are still some ...
- 11
1
vote
1
answer
590
views
How to have arrays in IDA's IDC
So to cut straight to the chase - I'm lazy, IDA is mysterious, I need to use IDA arrays in
my IDC code for convenience. Because IDC is like C(++) in its syntax I figured I could do:
auto lala[4] = {0,...
- 115
1
vote
2
answers
973
views
How to set conditional breakpoint to modify ZF (Zero flag)
In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0.
I don't know how to do it:
I searched for example scripts in IDC or ...
- 583
1
vote
1
answer
609
views
How to get the current offset use IDC or IDAPython?
When writing an IDA script, how to use IDC or IDAPython to get the file offset for a memory address?
- 411
1
vote
1
answer
104
views
IDC script offsets
I'm new to IDC scripts and would like some help at trying to apply and offset to a binary I have in loaded in IDA. Sorry not sure if my terminology is correct but I have a reference in my file "...
- 11
1
vote
1
answer
100
views
Need Help Figuring out Multi-byte (in-memory) byte replacement using ida script (idc)
"I am trying to create a simple IDC script for IDA 7.7, which takes a known memory address (in the format 0x00000000), a string of replacement bytes (either in the format ffffffff or ff ff ff ff, ...
- 13
1
vote
0
answers
80
views
RE internship possibilities
I am currently studying computer science and I have to do a mandatory internship (6 months) soon. I am really enjoying re and I would love to get an internship in that area. My problem is that the ...
- 11
1
vote
2
answers
357
views
Renaming a local stack variable with IDAPython
I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so...
In my ...
- 408
1
vote
0
answers
171
views
Passing a pointer to a pointer to a string with IDA Pro's Appcall
I need to call an encryption function in a program with the following signature (the second argument is returned):
char** __usercall decode(char** input, char** output)
As far as I can tell, Appcall ...
- 111
0
votes
1
answer
91
views
Patch all calls to a single function using IDC
I am quite new in reverse-engineering and programming in general, sorry in advance if this question is dumb. It goes like this:
In c++ disassembled code exist calls to a certain function. 2 thousand ...
0
votes
1
answer
97
views
How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?
Is there an API which lets me programmatically:
set the default string type (Setup) and
rebuild the string list (Rebuild)
???
- 10.9k
0
votes
0
answers
310
views
How to find first/next instruction in IDA trace via IDC
Ida marks the instructions, which were executed during the trace, with a specific color. I want to enumerate all of them. I tried to use GetColor(ea, CIC_ITEM) to find them, but if just returns ...
- 1,850