I'm currently working with a huge set of assembly files (~1TiB
) which have been obviously created with the help of IDA Pro. However, it should be mentioned that I currently only own a free version of IDA.
For a project I need to perform analyses on the mnemoircs
and operands
on a subroutine level. Therefor I want to convert the IDA format in a plain assembly format, as the existing parser only works for "PLAIN ASM" files. The instructions are separated by a blank line for each subroutine.
IDA ASM
.text:00401000 ; =============== S U B R O U T I N E =======================================
.text:00401000
.text:00401000 ; Attributes: bp-based frame
.text:00401000
.text:00401000 sub_401000 proc near ; CODE XREF: sub_43BD35+Ap
.text:00401000
.text:00401000 var_C = dword ptr -0Ch
.text:00401000 var_8 = dword ptr -8
.text:00401000 var_4 = dword ptr -4
.text:00401000
.text:00401000 55 push ebp
.text:00401001 8B EC mov ebp, esp
.text:00401003 83 EC 0C sub esp, 0Ch
.text:00401006 89 4D F4 mov [ebp+var_C], ecx
.text:00401009 8B 45 F4 mov eax, [ebp+var_C]
.text:00401021 59 pop ecx
.text:00401022
.text:00401022 loc_401022: ; CODE XREF: sub_401000+Fj
.text:00401022 8B 45 F4 mov eax, [ebp+var_C]
.text:00401025 83 78 04 00 cmp dword ptr [eax+4], 0
.text:00401029 74 12 jz short locret_40103D
.text:0040102B 8B 45 F4 mov eax, [ebp+var_C]
.text:0040102E 8B 40 04 mov eax, [eax+4]
.text:00401031 89 45 F8 mov [ebp+var_8], eax
.text:00401034 FF 75 F8 push [ebp+var_8] ; void *
.text:00401037 E8 B8 0D 00 00 call ??3@YAXPAX@Z ; operator delete(void *)
.text:0040103C 59 pop ecx
.text:0040103D
.text:0040103D locret_40103D: ; CODE XREF: sub_401000+29j
.text:0040103D C9 leave
.text:0040103E C3 retn
.text:0040103E sub_401000 endp
Convert to:
PLAIN ASM
=============== S U B R O U T I N E =======================================
push ebp
mov ebp, esp
sub esp, 0Ch
mov [ebp+var_C], ecx
mov eax, [ebp+var_C]
pop ecx
mov eax, [ebp+var_C]
cmp dword ptr [eax+4], 0
jz short locret_40103D
mov eax, [ebp+var_C]
mov eax, [eax+4]
mov [ebp+var_8], eax
push [ebp+var_8] ; void *
call ??3@YAXPAX@Z ; operator delete(void *)
pop ecx
leave
retn
Question: Are there solutions or scripts already existing for such a (automatically or batch-mode) conversion (at the best without needing a IDA non-free version)?