so i'm going to try in IDA hit SHIFT-F2, select python, type in this code
filename = AskFile(1, "*.bin", "Output file name")
address = 0x004015C3
size = 0x4A3D
dbgr = False
with open(filename, "wb") as out:
data = GetManyBytes(address, size, use_dbg=dbgr)
out.write(data)
Showing posts with label idapython. Show all posts
Showing posts with label idapython. Show all posts
Friday, July 31, 2020
Ida Pro Python Save Dump Extract In Memory Unpacked Binary Bin
Thursday, July 16, 2020
IDAPython beginning, review Hex operand
Just me experimenting with IDAPython
grabbing an operand that is hex and converting/displaying it in multiple ways
# review a hex parameter in assembly
def hexParamReview(addressHex, paramNumber):
# get line address to pass to idapython
address = int(addressHex)
# display what segment its in
print "segment: %s" % idc.get_segm_name(address)
# get the assembly command
print "command: %s" % GetMnem(address)
# get the assembly 1st parameter
print "param %d: %s" % (paramNumber, GetOpnd(address, paramNumber))
# convert parameter from string to hex
hexAsString = ( GetOpnd(address ,paramNumber)[:-1] )
print "hex(param 0): 0x%s" % hexAsString
# convert parameter from hex to int
try:
print "int(param 0): %d" % int(hexAsString, 16)
except(ValueError):
print "int(param 0): invalid hex"
# convert parameter from hex to string
try:
print "str(param 0): %s" % hexAsString[2:].decode("hex")
except(TypeError):
print "str(param 0): undefined"
hexParamReview(0x100048C3, 0)
hexParamReview(here(), 0)
# example:
# 0x100048C3 push 4141h
# output:
# segment: .text
# command: push
# param 0: 4141h
# hex(param 0): 0x4141
# int(param 0): 16705
# str(param 0): AA
Subscribe to:
Posts (Atom)