Showing posts with label idapython. Show all posts
Showing posts with label idapython. Show all posts

Friday, July 31, 2020

Ida Pro Python Save Dump Extract In Memory Unpacked Binary Bin

so i'm going to try in IDA hit SHIFT-F2, select python, type in this code
 filename = AskFile(1, "*.bin", "Output file name")
 address = 0x004015C3
 size = 0x4A3D
 dbgr = False
 with open(filename, "wb") as out:
  data = GetManyBytes(address, size, use_dbg=dbgr)
  out.write(data)

Thursday, July 16, 2020

IDAPython beginning, review Hex operand

Just me experimenting with IDAPython
grabbing an operand that is hex and converting/displaying it in multiple ways

# review a hex parameter in assembly
def hexParamReview(addressHex, paramNumber):
 # get line address to pass to idapython
 address = int(addressHex)
 # display what segment its in
 print "segment: %s" % idc.get_segm_name(address)
 # get the assembly command
 print "command: %s" % GetMnem(address)
 # get the assembly 1st parameter
 print "param %d: %s" % (paramNumber, GetOpnd(address, paramNumber))
 # convert parameter from string to hex
 hexAsString = ( GetOpnd(address ,paramNumber)[:-1] )
 print "hex(param 0): 0x%s" % hexAsString
 # convert parameter from hex to int
 try:
  print "int(param 0): %d" % int(hexAsString, 16)
 except(ValueError):
  print "int(param 0): invalid hex"
 # convert parameter from hex to string
 try:
  print "str(param 0): %s" % hexAsString[2:].decode("hex")
 except(TypeError):
  print "str(param 0): undefined"

hexParamReview(0x100048C3, 0)
hexParamReview(here(), 0)


# example:
#  0x100048C3 push 4141h
# output:
#  segment: .text
#  command: push
#  param 0: 4141h
#  hex(param 0): 0x4141
#  int(param 0): 16705
#  str(param 0): AA