Showing posts with label ida. Show all posts
Showing posts with label ida. Show all posts

Saturday, July 13, 2013

Creating library signatures for IDA

 C:\ida\flair61\bin\win>pcf tomcrypt.lib  
 tomcrypt.lib: skipped 25, total 566  
 C:\ida\flair61\bin\win>sigmake.exe tomcrypt.pat tomcrypt  
 tomcrypt.sig: modules/leaves: 541/485, COLLISIONS: 3  
 See the documentation to learn how to resolve collisions.  
Resolve collisions and it's ok (collisions problems can be found in file *.exc)

Thursday, July 11, 2013

IDA : Add structur

Declaring field of structure when they are big is a pain in the ass into IDA, idapython to the rescue !
 name = "WHATEVERYOUWANT"  
 size = 4242  
 struc_id = GetStrucIdByName(name)  
 DelStruc(struc_id)  
 struct = AddStrucEx(-1, name, 0)  
 for i in xrange(0, size / 4):  
      AddStrucMember(struct, "field_" + str(i), i * 4, 0x20000400, -1, 4)  
 if (size % 4) != 0:  
      AddStrucMember(struct,"field_" + str(size / 4),(size / 4) * 4,0x000400,-1,size % 4)