Contents
What can you do with IDAPython part 5?
In Part 5 of our IDAPython blog series, we used IDAPython to extract embedded executables from malicious samples. For this sixth installment, I’d like to discuss using IDA in a very automated way.
Can you run IDAPython without spawning a GUI?
Using this technique, we’ll be able to process many samples very quickly without needing to manually open each file in a new instance of IDA and run the IDAPython script. Many may be surprised to learn that IDA can be executed purely on the command-line without spawning a GUI.
What does the C switch in IDAPython do?
In these examples, the ‘-c’ switch generates a new IDB file, even in the event one already exists. Additionally, the ‘-S’ switch specifies the IDAPython script that will be run upon execution. We’ll be using these switches later on in the post.
How does Ida run on the command line?
Many may be surprised to learn that IDA can be executed purely on the command-line without spawning a GUI. In order to do so, the user must run the IDA executable with the ‘-A’ switch. This particular switch will instruct IDA to run in autonomous mode, ensuring that no windows or dialog boxes are presented to the user.
How to create a string type in IDAPython?
StringType: buf = idaapi. AssembleLine ( ea, seg. sel, ip, seg. bitness, line) old_batch = idc. Batch ( 1) idc. Batch ( old_batch) @param dest: If it is a string then it designates the new class type that will be created and copied to.
When did the first version of IDAPython come out?
IDAPython has been around for several years now, with the earliest known version dating back to 2005 based on old version tracking websites. Whilst it was previously provided separately from IDA Pro itself, since IDA Pro 5.4 it now comes standard with every IDA Pro installation.
How to use createoptions in ntcreatefile function?
The CreateOptions parameter’s FILE_OPEN_REQUIRING_OPLOCK flag eliminates the time between when you open the file and request an oplock that could potentially allow a third party to open the file, which would cause a sharing violation. An application can use the FILE_OPEN_REQUIRING_OPLOCK flag with NtCreateFile and then request any oplock.
Is there a way to undefine an instruction?
I’d like to undefine the instructions from address+1 onward and redefine them from address using MakeCode or something similar. So far I have not found any functions to undefine instructions. Any pointers on where I should be looking? Here is a POC from some code I wrote a while back.