Hot answers tagged

5

This way to automate things called IDAPython, its documentation is here: 1 - Save this script somewhere, remember where. #Not used, not debbugged, not ran even once #Use on your own risk, beware errors import idaapi import idautils import idc def do_rename(l): splitted = l.split() straddr = splitted[0] strname = splitted[1].replace("\r", "")....


5

What you could do as a workaround for the missing time-support in Ida: IDC has an "Exec" command (as mentioned in a comment) allowing you to make arbitrary calls to the OS. This might help. In the "Exec" bracktes you enter a command in much the same way as typing it on the command line. The following is an idc script file Writing the date and time with ...


4

I found a project which has some rudimentary documentation on the file format and even some Python code to parse it: https://github.com/eriksoe/Schockabsorber It hasn't been updated since 2013 but still may be useful. There is also some (rather high level) information over at the Archive Team: http://fileformats.archiveteam.org/wiki/Shockwave_(Director) ...


3

That's simple a some Lua bytecode (version 5.2) stored as base64. Use base64 -d to decode it, and then check the binary file generated using file: $ file DancingShoes.bin DancingShoes.bin: Lua bytecode, version 5.2


2

You need to run idc.auto_wait in the python script to allow IDA to process all the entries in it's auto-analysis queue before it tries to navigate around based on analysis-dependent features.


2

This is most likely caused by at least one of three issues: The first time IDA starts up on a machine, it'll prompt you for a license and you'll have to accept it. If the first time you run IDA is with the -S flag, IDA will hang on that screen and you'll need to manually accept it (either in that execution or a previous one). You could also work around it ...


2

As far as I know, IDA doesn't have a function_name_to_address() that gets a pattern and returns an address. You can iterate over all the functions and check if their name matches the one you want. It should not take too long. from idautils import * from idaapi import * from idc import * ea = BeginEA() for funcAddr in Functions(SegStart(ea), SegEnd(ea)): ...


2

You can use the following function: def decompile_func(ea): if not init_hexrays_plugin(): return False f = get_func(ea) if f is None: return False cfunc = decompile(f); if cfunc is None: # Failed to decompile return False lines = [] sv = cfunc.get_pseudocode(); for sline in sv: line = tag_remove(sline.line); lines....


2

Found it in IDAPython documentation. There is a function exec_idc_script here in module ida_expr.I never used it myself but according to the spec it should work. In addition there is a RunPythonStatement in IDC if you need to do it conversely.


1

You probably need the 2003 version of pe_sections.idc. There were some bugs in the older versions related to parsing x64 files. We were learning both IDC scripting and the details of the x64 format at the same time.


1

IDAPython is the way to go when you want to do such things. I'd say something like that should work: CONST_1 = "1234h" CONST_2 = "ABCDh" for func in Functions(): got_first, got_second = False, False func_start = GetFunctionAttr(func,FUNCATTR_START) func_end = GetFunctionAttr(func,FUNCATTR_END) for ea in Heads(func_start, func_end): ...


Only top voted, non community-wiki answers of a minimum length are eligible