Database conversion from idb to i64

Database conversion from idb to i64

Historically, there were ida and idat to deal with 32 bits binaries. Then 64 bits binaries make an appearance to our world and this is how ida64 and idat64 were born.

Hex-rays decided to remove ida, mainly to simplify the product and the code base. It was done in two steps

• make ida64 fully usable with 32 bits binaries

• offer a tool to migrate dabase from idb (32 bits) to i64 (64 bits) format

As from version 9.0 the 64 suffix in the binaries name has been removed.

Main usage

  ida foo.idb

This command converts foo.idb to foo.i64 on the fly. The user can immediately start working with the database. If foo.i64 already exists, IDA will ask if it should be overwritten or not. Please note foo.idb is left untouched by the upgrade.

List of the available command line switches

  --cvt64 automatically confirms the following question:
        'You passed 32bit IDB file foo.idb to ida64.
        Do you wish to convert it to 64bit database?'

  -Ocvt64 options:
        overwrite=yes/no/ask -yes: overwrite the existing i64 database
                              no: immediately exit if the i64 database exists
                              ask: ask the user what to do if the i64 database exists
                              default: ask
        restart=yes/no/ask  - yes: automatically open the converted database in IDA
                              no: exit after the conversion
                              ask: ask the user if the converted database should be opened
                              default: yes
        privmove=yes/no/ask - move privrange beyond 32bit addrspace after
                              conversion?
                              default: yes, which means to automatically move
                              the privrange to 0xFF00000000000000

Example

  idat --cvt64 -Ocvt64:overwrite=no:restart=no

This command automatically converts foo.idb and exits at the end of the conversion. If foo.i64 already exists, the conversion will not be performed. Since this command uses idat64, it can be used for batch processing.