OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Topic created on: October 4, 2007 20:41 CDT by saphex .

Hi,

I have an idea for IDA. I wanted to know if its possible to do this in IDA (in paint it is :P).

Best regards,
saphex

RolfRolles		October 4, 2007 21:20.50 CDT
So you want two disassembly listings side-by-side. If you mean for manual browsing of disassembly listings coming from the same database, there's an easy way to accomplish this: View->Open subviews->Disassembly to open a new disassembly window; minimize/close all non-disassembly MDI windows and then Windows->Tile windows vertically. You can then save this desktop view under Windows->Save desktop, and load it as desired via Windows->Load desktop. (IMO, desktop save/load is a nice and under-appreciated feature of IDA.) If you go this route, you'll probably end up tweaking Options->General->Disassembly->* indentation for readability. This may be more rudimentary than what you had in mind, but it does the trick. If you're intending to do this programmatically inside of IDA in a single window with listings coming out of either the same or different databases (as evidenced by the source code directory in Eclipse in the screen shot), you've got some work to do. If using a different database, the first question is how are you going to acquire the relevant data from the other database? This part is somewhat involved because it isn't directly possible in IDA to programmatically open that database inside of the currently-running instance and retrieve its contents. You could indirectly do something like Atli's PE scripts, but this might be undesirable for other reasons. The solution employed by a few open-source plugins (take a look at EBDS, for instance) has been to spawn an instance of IDA and have custom code extract and transmit this data to the first instance somehow (usually involving a custom file format/database schema -- see pIDA from PaiMei or IDACompare, and additionally see Essense for more along these lines). IDA's representation of a disassembly line with colors may pose an issue for serialization purposes. As for the GUI, if you want to keep it inside of IDA this new feature in the 5.1 SDK offers advances over previous GUI functionality, but it comes with some limitations.

saphex		October 5, 2007 08:11.44 CDT
Hi, Yes the idea is to load other idb file, get is functions info and compare them with the functions of currently loaded file. I thought that IDA had some function to load another idb. I have EBDS and that is what I'm using for diffing (didn't know it was open source, will take a look at it and the others you wrote). For the gui, I think I will be using IDA ability to generate graphs (found some open source plugins that exemplify that). Best regards and thanks for the enlightenments, saphex

saphex		October 5, 2007 12:44.38 CDT
Hi, I'm having a problem with the chooser window. I don't know how to add the l_FuncList elements to the window list. void idaapi getl_matched(void obj, ulong n, char const arrptr) { list_t l_FuncList; if (n == 0) { for (int i = 0; i < qnumber(g_pHeader); i++) qstrncpy(arrptr[i], g_pHeader[i], MAXSTR); } else { list_t l_FuncList = (list_t)obj; for (int s_Index = 0; s_Index < l_FuncList.size(); s_Index++) { //msg("Address %08a", l_FuncList[s_Index]); } } } Best regards, saphex Edit:* I found out what was the problem (chooser size function)

Note: Registration is required to post to the forums.

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit