📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  IDA Python inserting segments, functions, code etc

Topic created on: May 29, 2009 13:49 CDT by rwartell .

I'm working with IDA Python to do some automated disassembly and modifications and I am having trouble figuring out a few things.

My current problem is that I'd like to be able to add segments, functions and instructions or data to the disassembled file.  I've been looking through the documentation of the IDA Python API and the only thing I can find about this is the MakeCode instruction, but all it takes as a parameter is the address you want the instruction at, not the opcode or size or anything of the instruction.  If anyone can help with this that would be great.  I also need to be able to add segments and modify header information if anyone knows any details or can point me to a tutorial about that.

  rwartell   May 29, 2009 13:53.36 CDT
I just realized that the MakeCode function is for telling ida to treat a certain address as code rather than data or something along those lines.  So obviously that's not what I'm looking for.

  phn1x     May 29, 2009 14:48.47 CDT

Change the current Segment Boundaries :
SegBounds()

Create a segment:
SegCreate()

Create A Function:
MakeFunction()

Make Instructions:
MakeCode()

data:
MakeQword()
MakeWord()

* MakeStr() is foobarred, use make_ascii_string from idaapi


If you haven't done so already, I'd check out: dkbza.org/data/Introduction%20to%20IDAPython.pdf

  rwartell   May 29, 2009 14:51.46 CDT
Found another relevant post about this.  It seems it isn't possible to do what I'm looking for simply in an IDA script. But it seems that it may be possible to overwrite the .text segment of a pe file, then add a new segment at the end of the pe file and add instructions or overwrite instructions in that section.  Does that seem feasible?  If anyone could give me advice on that, that would great.

  phn1x     May 29, 2009 14:58.14 CDT
> rwartell: Found another relevant post about this.  

Linkage?

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit