IDC examples

IDC examples

The following examples demonstrate the usage of native IDA scripting language in more complex scripts. Our selection illustrates how IDC can help you automate everyday tasks and speed up your learning efforts while learning IDC scripting.

Where can I find all the examples?

The full library of our examples is shipped with your IDA instance in the idc folder.

Before you start

Some of the examples shows below used an imports another scripts, like idc.idc: the file that contains IDA built-in function declarations and internal bit definitions. It is recommend to check the idc folder for all sample scripts.

How to run the examples?

Load the script via File Loader

1. Navigate to File -> Script file...

2. In the new dialog, select the .idc script you want to run and click Open.

Load the script via Script command

1. Navigate to File -> Script command....

2. Change the scripting language to IDC.

3. Paste the code into Please enter script body field and click Run.

Sample scripts

You can also find the scripts below in the idc folder inside your IDA directory.

analysis

Sample IDC program to automate IDA.

//
// Sample IDC program to automate IDA.
//
// IDA can be run from the command line in the batch (non-interactive) mode.
//
// If IDA is started with
//
//         ida -A -Sanalysis.idc file
//
// then this IDC file will be executed. It performs the following:
//
//   - analyzes the input file
//   - creates the output file
//   - exits to the operating system
//
// Feel free to modify this file as you wish
// (or write your own script/plugin to automate IDA)
//
// Since the script calls the qexit() function at the end,
// it can be used in the batch files (use text mode idat)
//
// NB: "ida -B file" is a shortcut for the command line above
//

#include <idc.idc>

static main()
{
  // turn on coagulation of data in the final pass of analysis
  set_inf_attr(INF_AF, get_inf_attr(INF_AF) | AF_DODATA | AF_FINAL);
  // .. and plan the entire address space for the final pass
  auto_mark_range(0, BADADDR, AU_FINAL);

  msg("Waiting for the end of the auto analysis...\n");
  auto_wait();

  msg("\n\n------ Creating the output file.... --------\n");
  auto file = get_idb_path()[0:-4] + ".asm";

  auto fhandle = fopen(file, "w");
  gen_file(OFILE_ASM, fhandle, 0, BADADDR, 0); // create the assembler file
  msg("All done, exiting...\n");

  // the following line instructs IDA to quit without saving the database
  // process_config_directive("ABANDON_DATABASE=YES");

  qexit(0); // exit to OS, error code 0 - success
}

arraytst

Sample demonstration on how to use array manipulation functions.

//
//      This example shows how to use array manipulation functions.
//

#include <idc.idc>

#define MAXIDX  100

static main() {
  auto id,idx,code;

  id = create_array("my array");
  if ( id == -1 ) {
    warning("Can't create array!");
  } else {

    msg("Filling array of longs...\n");
    for ( idx=0; idx < MAXIDX; idx=idx+10 )
      set_array_long(id,idx,2*idx);

    msg("Displaying array of longs...\n");
    for ( idx=get_first_index(AR_LONG,id);
          idx != -1;
          idx=get_next_index(AR_LONG,id,idx) )
      msg("%d: %d\n",idx,get_array_element(AR_LONG,id,idx));

    msg("Filling array of strings...\n");
    for ( idx=0; idx < MAXIDX; idx=idx+10 )
      set_array_string(id, idx, sprintf("This is %d-th element of array", idx));

    msg("Displaying array of strings...\n");
    for ( idx=0; idx < MAXIDX; idx=idx+10 )
      msg("%d: %s\n",idx,get_array_element(AR_STR,id,idx));

  }

}

bds

Sample executed when IDA detects Delphi 6-7 or BDS.

//
// This file is executed when IDA detects Delphi6-7 or BDS2005-BDS2006
// invoked from pe_bds.pat
//
// Feel free to modify this file as you wish.
//

#include <idc.idc>

static main()
{
  // Set Delphi-Style string
  //set_inf_attr(INF_STRTYPE,STRTYPE_LEN4);

  // Set demangled names to display
  //set_inf_attr(INF_DEMNAMES,DEMNAM_NAME);

  // Set compiler to Borland
  set_inf_attr(INF_COMPILER, COMP_BC);
}


// Add old borland signatures