📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  IDA Plugin Datas

Topic created on: August 29, 2006 14:35 CDT by Piotr .


Hiya,

I'm having some problems with processing datas (i guess i'm missing some function name:)), let me introduce the problem:

I have:
CODE:00401188 off_401188      dd offset sub_401145

This location is data,i know it by checking the flags (IsData bla bla), but i need to know how large is it (here its a dword) and moreover i also need to know if this data points to a sub offset or another data.

I could do it in more hardcore way by checking all the instructions, scaning them for data references and then check the requested data sizes. And finally testing the *(DWORD*) at the data for a data bit, but i guess IDA has some special functions with implements it in more easy way.

Also is there any IDA Function Reference arround?

Thanks

  igorsk     August 29, 2006 15:21.35 CDT
You should check IDA Plugin writing tutorial, it has a nice overview of IDA's API and concepts.
As for the problem at hand, here's a function from my script which tries to identify a vtable and calculate its size (I suppose that's what you're trying to do).

http://rafb.net/paste/results/1Xe07d60.html

While it's in IDC, you should be able to find similar functions in IDA API.

  pedram     August 29, 2006 17:05.14 CDT
> Piotr: Also is there any IDA Function Reference arround?

You mean like this?

http://www.openrce.org/reference_library/ida_sdk

Or more specific to the underlying functionality?

  Piotr     August 30, 2006 01:56.32 CDT
Pedram: I thought about something more specific, however i have managed the thing with igorsk stuff. Thanks.

Another question, is there any option for the IDA, to tell her not to apply any known structures? Just to keep data in the "raw" form?

I mean that when i have some struct request:
.text:0040106A                 mov     ecx, Context.Ecx
.text:00401070                 mov     edx, Context.Eax

the offsets of Context.Ecx, Context.Eax, are not marked
as data, and IsData returns false. But in fact this is a data reference. So is there any function/method (again) to know this offset is a data, even if it is a struct member.

  ero     August 30, 2006 03:26.19 CDT
Piotr: it seems to me like isData ought to work. Just in case, are you doing isData(GetFlags(address)) ? I had made the mistake in the past of just doing isData/isCode/etc forgetting calling the GetFlags() first

  Piotr     August 30, 2006 03:39.55 CDT
ERO:
Nope, im using the GetFlags and IsData works on normal data areas (not a struct or struct members), and finally i'm bit stonned with that :)

  PSUJobu     August 30, 2006 08:24.21 CDT
> Piotr:> I mean that when i have some struct request:
> .text:0040106A                 mov     ecx, Context.Ecx
> .text:00401070                 mov     edx, Context.Eax
>
> the offsets of Context.Ecx, Context.Eax, are not marked
> as data, and IsData returns false.

While I have not tested this, I will hazard a guess.  I am assuming that "Context" is a structure instance within a data segment, not a structure name.  Based on how IDA Pro operates, all offsets (other than 0) within that structure are "tail bytes" and will have no useful flags set.

For your test to work correctly, you would have to test for tail bytes (isTail(), IIRC) and "back up" to the head item (prevHead() would probably work) and test those flags.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit