Skip to content

Instantly share code, notes, and snippets.

@icewall

icewall/getGUIDfunction.py

Last active August 31, 2022 14:21
Show Gist options
  • Save icewall/265ed2aa7225b1f82562af0e411f248c to your computer and use it in GitHub Desktop.
Save icewall/265ed2aa7225b1f82562af0e411f248c to your computer and use it in GitHub Desktop.
Download ZIP
IDA Pro python getGUID
Raw
getGUIDfunction.py
def getGUID(ea):
data1 = idc.GetManyBytes(ea,4)
data1 = struct.unpack("<I",data1)[0]
#print "%08x" % (data1)
ea += 4
data2 = idc.GetManyBytes(ea,2)
data2 = struct.unpack("<H",data2)[0]
#print "%04x" % (data2)
ea += 2
data3 = idc.GetManyBytes(ea,2)
data3 = struct.unpack("<H",data3)[0]
#print "%04x" % (data3)
ea += 2
data4 = idc.GetManyBytes(ea,2)
data4 = struct.unpack(">H",data4)[0]
#print "%04x" % (data4)
ea += 2
data5 = idc.GetManyBytes(ea,6)
data5Str = ""
for b in data5:
data5Str += "%02x" % ord(b)
#print data5Str
return "%08x-%04x-%04x-%04x-%s" % (data1,data2,data3,data4,data5Str)
"""
Python>guid = getGUID(0x00000001C0002020)
Python>print guid
900448e4-b685-dd11-ad8b-0800200c9a66
"""
@bash-c
Copy link

bash-c commented Aug 31, 2022

ida 7.4+ version below for anyone who needs it

def getGUID(ea):
    data1 = idc.get_bytes(ea,4)
    data1 = struct.unpack("<I",data1)[0]
    #print "%08x" % (data1)

    ea += 4
    data2 = idc.get_bytes(ea,2)
    data2 = struct.unpack("<H",data2)[0]
    #print "%04x" % (data2)

    ea += 2
    data3 = idc.get_bytes(ea,2)
    data3 = struct.unpack("<H",data3)[0]
    #print "%04x" % (data3)

    ea += 2
    data4 = idc.get_bytes(ea,2)
    data4 = struct.unpack(">H",data4)[0]
    #print "%04x" % (data4)

    ea += 2
    data5 = idc.get_bytes(ea,6)
    data5Str = ""
    for b in data5:
        data5Str += "%02x" % b
    #print data5Str
    return "%08x-%04x-%04x-%04x-%s" % (data1,data2,data3,data4,data5Str)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment