This way to automate things called IDAPython, its documentation is here:
1 - Save this script somewhere, remember where.
#Not used, not debbugged, not ran even once
#Use on your own risk, beware errors
splitted = l.split()
straddr = splitted
strname = splitted.replace("\r", "")....
What you could do as a workaround for the missing time-support in Ida:
IDC has an "Exec" command (as mentioned in a comment) allowing you to make arbitrary calls to the OS. This might help. In the "Exec" bracktes you enter a command in much the same way as typing it on the command line.
The following is an idc script file
Writing the date and time with ...
I found a project which has some rudimentary documentation on the file format and even some Python code to parse it:
It hasn't been updated since 2013 but still may be useful.
There is also some (rather high level) information over at the Archive Team:
That's simple a some Lua bytecode (version 5.2) stored as base64. Use base64 -d to decode it, and then check the binary file generated using file:
$ file DancingShoes.bin
DancingShoes.bin: Lua bytecode, version 5.2
This is most likely caused by at least one of three issues:
The first time IDA starts up on a machine, it'll prompt you for a license and you'll have to accept it. If the first time you run IDA is with the -S flag, IDA will hang on that screen and you'll need to manually accept it (either in that execution or a previous one). You could also work around it ...
As far as I know, IDA doesn't have a function_name_to_address() that gets a pattern and returns an address. You can iterate over all the functions and check if their name matches the one you want. It should not take too long.
from idautils import *
from idaapi import *
from idc import *
ea = BeginEA()
for funcAddr in Functions(SegStart(ea), SegEnd(ea)):
You can use the following function:
if not init_hexrays_plugin():
f = get_func(ea)
if f is None:
cfunc = decompile(f);
if cfunc is None:
# Failed to decompile
lines = 
sv = cfunc.get_pseudocode();
for sline in sv:
line = tag_remove(sline.line);
Found it in IDAPython documentation.
There is a function exec_idc_script here in module ida_expr.I never used it myself but according to the spec it should work.
In addition there is a RunPythonStatement in IDC if you need to do it conversely.
You probably need the 2003 version of pe_sections.idc. There were some bugs in the older versions related to parsing x64 files. We were learning both IDC scripting and the details of the x64 format at the same time.
IDAPython is the way to go when you want to do such things. I'd say something like that should work:
CONST_1 = "1234h"
CONST_2 = "ABCDh"
for func in Functions():
got_first, got_second = False, False
func_start = GetFunctionAttr(func,FUNCATTR_START)
func_end = GetFunctionAttr(func,FUNCATTR_END)
for ea in Heads(func_start, func_end):