3

I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.


2

After some research time, I found a way to do it in CPP but not in python. https://github.com/SentineLabs/Memloader/blob/main/MemoryLoader/MemoryLoader/MemoryLoader.cpp The most relevant part of the code dealing with loading PEs from buffer to memory: void destroy_linput(linput_t* li) { close_linput(li); } linput_t* create_linput(std::vector< bit7z::...


1

A handle is an abstract object. I am assuming that you are using IDA for static analysis, and that you are not using any embedded debugger through IDA. Correct me if it's not the case. From a static analysis point of view, you can't trace back the object where is comes from only with its value (100 in your exemple). The handle value is going to be different ...


1

If someone feels the need to do this programmatically in a non-debug setting, this is the code I would use. Note #1: There are some shortcut functions of my own GetFuncStart and such that are not included, I'm sure you can work them out. The reference to the Commenter class will just have to be removed. Note #2: The seemingly extreme measures taken in ...


1

During debugging IDA does a limited amount of autoanalysis to speed up the debugging experience and not interfere with the process. What you can do is to copy the module to be analyzed to the database, then stop the debugger and let IDA finish the autoanalysis on the saved data. This can be done via the "Analyze module" command in the Modules list. ...


1

You can parse a header using File > Load file > C header file or create a type library beforehand.


1

If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to setup your header file. Hope this helps.


1

You are looking for DecodeInstruction(ea) in idautils module (I am referring to idapython api). It returns: <class 'ida_ua.insn_t'> type object. In Ida sdk that'd be decode_insn function.


Only top voted, non community-wiki answers of a minimum length are eligible