0

I want to get an asm file which was dissassembled using IDA Pro and use scripts to make lots of asm files at once.

I tried two ways to get asm file

first one was with idapython:

idc.GenerateFile(idc.OFILE_ASM, idc.GetInputFile()+".asm", 0, idc.BADADDR, 0)

generated asm file successfully but that file had some functions which was hided

like this:

; [0000000C BYTES: COLLAPSED FUNCTION j__UIAccessibilityPostNotification. PRESS KEYPAD CTRL-"+" TO EXPAND]

second one was changed to batch mode to get asm file:

~/.ida-6.5/idal -c -parm:ARMv7 -B myFilePath/myFile

also generated asm file successfully but I just got same problems that was some functions which was hided

Is there an way to select unhide all and then export asm file from IDA?

Exiling
  • 63
  • 1
  • 8

1 Answers1

0

late answer
if you don't have a problem to send a keystroke prior to the execution of the idc command

you can define a macro that unhides all the collapsed functions

assuming you are using the gui version open idagui.cfg navigate to keyboard shortcut definition and locate the "Unhide All" entry and define a key sequence i have defined ctrl+2 as keystorke below in ida free 5.0

\IDA_FRE_5\cfg>cat idagui.cfg | grep -i unhide
"Unhide"                =       "Numpad+"
"UnhideAll"             =       "Ctrl+2"
"GraphUnhideGroup"      =       0               // Unhide group
"GraphUnhideAllGroups"  =       0               // Unhide all groups

close and open ida for this to take effect

from now on if you hit ctrl+2 and run the idc command you will get an asm with that doesnt contain collapsed functions

foo.asm was generated prior to ctrl+2 blah.asm after hitting ctrl+2

auto fp;
fp = fopen("c:\\blah.asm","w");
GenerateFile(OFILE_ASM,fp,0x10127a4,0x10127aa,0x0);
fclose(fp);

contents of both file below

C:\>type foo.asm blah.asm

foo.asm


;
; ╔═════════════════════════════════════════════════════════════════════════╗
; ║     This file is generated by The Interactive Disassembler (IDA)        ║
; ║     Copyright (c) 2010 by Hex-Rays SA, <support@hex-rays.com>           ║
; ║                      Licensed to: Freeware version                      ║
; ╚═════════════════════════════════════════════════════════════════════════╝
;
; [00000006 BYTES: COLLAPSED FUNCTION _XcptFilter. PRESS KEYPAD "+" TO EXPAND]

blah.asm


;
; ╔═════════════════════════════════════════════════════════════════════════╗
; ║     This file is generated by The Interactive Disassembler (IDA)        ║
; ║     Copyright (c) 2010 by Hex-Rays SA, <support@hex-rays.com>           ║
; ║                      Licensed to: Freeware version                      ║
; ╚═════════════════════════════════════════════════════════════════════════╝
;

; ███████████████ S U B R O U T I N E ███████████████████████████████████████

; Attributes: thunk

_XcptFilter     proc near               ; CODE XREF: start+199↑p
                jmp     ds:__imp__XcptFilter
_XcptFilter     endp
blabb
  • 8,674
  • 1
  • 18
  • 27