Last active
July 3, 2024 19:16
-
-
Save leechristensen/61f22ce081c2d4fcb960830a8132e3c5 to your computer and use it in GitHub Desktop.
Ida IDC script that dumps the bytes at the mouse cursor's position as a GUID string
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
// Dumps the bytes at the mouse cursor's position as a GUID string | |
// | |
// Usage: | |
// 1. Click on the GUID's "Data1" field in Ida | |
// 2. Run the script (File -> Script File..., or hit Alt+F7) | |
// 3. When you load the script, it'll display the GUID in Ida's output window. | |
// After it's loaded, you can run it again anytime by executing the | |
// function `get_guid_at_cursor()` in Ida's IDC REPL prompt. | |
#include <idc.idc> | |
static get_cursor_addr() { | |
// There's really not an easier way to get the current address? | |
// get_screen_ea() doesn't work if field is in structure :( | |
auto line = get_curline(); | |
auto start = strstr(line, ":"); | |
auto end = strstr(line, " "); | |
auto str_ea = substr(line, start+1, end); // Extract the address | |
auto ea = xtol(str_ea); | |
return ea; | |
} | |
static get_guid_at_cursor() { | |
auto ea = get_cursor_addr(); | |
if (ea == BADADDR) { | |
Message("Error: Could not determine the correct address.\n"); | |
return; | |
} | |
auto guid = sprintf( | |
"{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}", | |
Byte(ea+3), Byte(ea+2), Byte(ea+1), Byte(ea), | |
Byte(ea+5), Byte(ea+4), | |
Byte(ea+7), Byte(ea+6), | |
Byte(ea+8), Byte(ea+9), | |
Byte(ea+10), Byte(ea+11), Byte(ea+12), Byte(ea+13), Byte(ea+14), Byte(ea+15) | |
); | |
return guid; | |
} | |
static main() { | |
print(get_guid_at_cursor()); | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Hovering over a GUID structure and then loading the script:
With the script already loaded, running the
get_guid_at_cursor()
command: