[RevEng] Processing multiple executables in IDA

I once wanted to process a batch of executables, producing .lst and .asm for each. This is what I did for each .exe file:

"c:\Program Files\IDA ...\idat.exe" -c -A -SC:\tmp\tmp.idc fname.exe

This is almost the same as:

"c:\Program Files\IDA ...\idat.exe" -c -A -Sanalysis.idc fname.exe

Where c:\tmp\tmp.idc is a hacked original analysis.idc file:

#include <idc.idc>

// copypasted from analysis.idc and hacked...

//#define WriteTxt(file, ea1, ea2) \
//        gen_file(OFILE_ASM, fopen(file, "w"), ea1, ea2, 0)
#define WriteLst(file, ea1, ea2) \
        gen_file(OFILE_LST, fopen(file, "w"), ea1, ea2, 0)

static main()
{
  // turn on coagulation of data in the final pass of analysis
  set_inf_attr(INF_AF, get_inf_attr(INF_AF) | AF_DODATA);

  msg("Waiting for the end of the auto analysis...\n");
  auto_wait();
  msg("\n\n------ Creating the output file.... --------\n");
  auto file = get_idb_path()[0:-4] + ".asm";
  WriteTxt(file, 0, BADADDR);           // create the assembler file
  auto file2 = get_idb_path()[0:-4] + ".lst";
  WriteLst(file2, 0, BADADDR);

  msg("All done, exiting...\n");
  qexit(0);                              // exit to OS, error code 0 - success
}

diff -ru analysis.idc tmp.idc

 #include <idc.idc>

+// copypasted from analysis.idc and hacked...
+
+//#define WriteTxt(file, ea1, ea2) \
+//        gen_file(OFILE_ASM, fopen(file, "w"), ea1, ea2, 0)
+#define WriteLst(file, ea1, ea2) \
+        gen_file(OFILE_LST, fopen(file, "w"), ea1, ea2, 0)
+
 static main()
 {
   // turn on coagulation of data in the final pass of analysis
@@ -35,6 +17,9 @@
   msg("\n\n------ Creating the output file.... --------\n");
   auto file = get_idb_path()[0:-4] + ".asm";
   WriteTxt(file, 0, BADADDR);           // create the assembler file
+  auto file2 = get_idb_path()[0:-4] + ".lst";
+  WriteLst(file2, 0, BADADDR);
+
   msg("All done, exiting...\n");
   qexit(0);                              // exit to OS, error code 0 - success
 }

List of my other blog posts.

Yes, I know about these lousy Disqus ads. Please use adblocker. I would consider to subscribe to 'pro' version of Disqus if the signal/noise ratio in comments would be good enough.