3

I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.


2

After some research time, I found a way to do it in CPP but not in python. https://github.com/SentineLabs/Memloader/blob/main/MemoryLoader/MemoryLoader/MemoryLoader.cpp The most relevant part of the code dealing with loading PEs from buffer to memory: void destroy_linput(linput_t* li) { close_linput(li); } linput_t* create_linput(std::vector< bit7z::...


1

If someone feels the need to do this programmatically in a non-debug setting, this is the code I would use. Note #1: There are some shortcut functions of my own GetFuncStart and such that are not included, I'm sure you can work them out. The reference to the Commenter class will just have to be removed. Note #2: The seemingly extreme measures taken in ...


1

During debugging IDA does a limited amount of autoanalysis to speed up the debugging experience and not interfere with the process. What you can do is to copy the module to be analyzed to the database, then stop the debugger and let IDA finish the autoanalysis on the saved data. This can be done via the "Analyze module" command in the Modules list. ...


1

You can parse a header using File > Load file > C header file or create a type library beforehand.


1

If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to setup your header file. Hope this helps.


1

You are looking for DecodeInstruction(ea) in idautils module (I am referring to idapython api). It returns: <class 'ida_ua.insn_t'> type object. In Ida sdk that'd be decode_insn function.


1

You can generate graphs in the DOT format by calling gen_flow_graph() with the CHART_GEN_DOT flag. The DOT file can then be imported into networkx using the from_pydot() function.


1

You can use get_input_file_path() IDC function and then extract the file name from it. It's also available in IDAPython as ida_nalt.get_input_file_path (source).


Only top voted, non community-wiki answers of a minimum length are eligible