📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  IDA Pro  >>  Develop a Code Analysis Program with IDA in Background

Topic created on: March 26, 2007 09:50 CDT by engma .

I want to develop a code analysis program with the help of IDA . For example, IDA batchs and analyzes the ELF files in background, and then their disassembled codes and function calls, etc can be used as inputs of my program to take certain further analysis as what I need. Can I realize it by using IDA SDK? Does SDK provide some functions I can employ?
Any help would be greatly appreciated.

  aeppert     March 26, 2007 12:30.50 CDT
IDA does have batch-mode analysis capabilities that can certainly be coupled with a plugin to perform whatever (within reason) you would want to achieve.

The batch-mode has been documented here and on Datarescue's forums in rather solid detail, thus I will not bother to rehash what has already been explained.

Basically, you are the one that must decide what needs to be parsed out via IDA and passed on as input to your secondary program. Only then can you determine if IDA is the correct course of action.  But, in general, I see no reason IDA Pro would not be capable of doing what you are asking - albeit I need a lot more information to completely make this determination.

  nezumi     March 28, 2007 00:09.00 CDT
it depends on what you want to get (as knows, you always get what you got :-)
the point is - IDA is _interactive_ and user-interacted oriented disassembler,
being running in the batch mode, IDA loses its best features,
and generates useless code. I see no reasons to use IDA in the batch mode,
however, if you want, see: http://www.datarescue.com/idabase/idadoc/417.htm

Ilfak offers to use the follow command line:
idag -c -A -Sanalysis.idc input-file,
where "analysis.idc" is very simple IDC-script placed in the \IDA\std\idc directory.
I don't recommend to deal with it, better write your own script for certain
type of the program. if you used to analyze many similar programs,
you can write IDC-script, doing everything you want and need to do,
this is good way to automate hard tedious job.
but!!! if you take a file you unfamiliar with,
batch mode is most worst way to disassemble it.
imagine what happens if file is packed or having some anti-disasm trick.
you'll get nothing!!! just large asm files with thousands "db" directives.
do you want this? I don't think so.

if you able to read in rus, I can send you my book, describing IDC-langue in details.

  engma   March 28, 2007 21:13.55 CDT
Thanks a  lot. Now I just dabble the area of reverse analysis, esp.   the application and development of IDA, and need strengthen these knowledge and experience. All of you give me good ideas and directons to begin works on static analysis effectively.

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit