TransWikia.com

IDA python : reading n bytes from an offset

Reverse Engineering Asked on November 10, 2021

Using python in IDA, I would like tu create a partial file dump.
For exemple I would like to dump the data from offset X for a size of Y.
I believe I could do it by using the idc.Dword function :

offset = X
res = []
while offset < offset + Y:
    res.append(idc.Dword(offset))
    offset += 4
return res

Is there a way of achieving that without reading manually each address?

One Answer

idaapi.get_many_bytes did the trick :

https://www.hex-rays.com/products/ida/support/idapython_docs/ida_bytes-module.html#get_many_bytes

Update for newer versions :

Python>get_bytes.__doc__
Return the specified number of bytes of the program
    @param ea: linear address
    @param size: size of buffer in normal 8-bit bytes
    @param use_dbg: if True, use debugger memory, otherwise just the database
    @return: None on failure
             otherwise a string containing the read bytes  

https://www.hex-rays.com/products/ida/support/idapython_docs/ida_bytes-module.html#get_bytes

Answered by user3714670 on November 10, 2021

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP