IDA JScript UpdatesAuthor: David Zimmer Date: 11.16.25 - 10:23am so I guess I am in love with AI now. More toys less time, no typing pain. I have had ollysync for like 20 years now. Step in olly, udp sync packet sent to my main desktop syncs IDA view. Great! for 32bit only.. boo. So I have needed this for x64dbg now for a while. This weekend i prompted claude.ai and he was able to kick out a nice tcp remote shell that runs in x64dbg and accepts various commands for debugger automation. Took a Saturday to get it straightened out and tested which is a super reasonable timeline. I have now already integrated this into IDA JScript with a new dbg. object. So within an IDA scripting IDE..we can now export comments and breakpoints and read values from a live debugger running on another network machine! It also supports the UDP view sync with IDA if enabled (dbg.notify). This is kind of a more generic version of the Remote Lookup tool I released in 2017 using the remote. object. This model does however require a debugger attached instead of just raw memory analysis. A python client and an olly plugin is included as well. The command table is below. Its not fully tested yet but it is working. Ill release it now for early adopters. Another thing should mention is that I will soon be ditching duktape as my js engine. A couple weeks ago i actually had claude create me an entire javascript engine in vb6! with support for debuging, COM integration, and i broke spec for TRUE x64 bit numbers! It is mildly amusing that a scripting language developed in vb6 has true x64 bit number support when the host language does not! (mostly just sad but i wont ruminate) Code is already included in ida jscript download now. // In IDA JScript IDE with FULL debugging support: // 1. Connect to remote x64dbg dbg.Connect("192.168.1.100"); // 2. Scan IDB for interesting functions for(var i = 0; i < ida.numFuncs(); i++) { var fname = ida.functionName(i); var fva = ida.functionStart(i); // 3. Find crypto/unpacking functions if(fname.indexOf("decrypt") > -1 || fname.indexOf("unpack") > -1) { // 4. Set breakpoint in REMOTE x64dbg! dbg.SetBreakpoint("0x" + fva.toString(16)); // 5. Add your IDA comment as x64dbg label var comment = ida.getComment(fva); if(comment) { dbg.SetLabel("0x" + fva.toString(16), fname); dbg.SetComment("0x" + fva.toString(16), comment); } t("Exported: " + fname + " @ 0x" + fva.toString(16)); } } // 6. Subscribe to notifications dbg.NotifyModule("main"); // 7. Run and wait for UDP notifications in your listener dbg.Run();
x64dbg Remote Control Commands:
Memory:
read [addr] [size] - Read memory
readstring [addr] - Read ASCII string
readstring [addr] -u - Read Unicode string
write [addr] [hex] - Write memory
Breakpoints:
setbp [addr] - Set breakpoint
delbp [addr] - Delete breakpoint
Annotations:
comment [addr] [text] - Set comment
getcomment [addr] - Get comment
label [addr] [name] - Set label
Registers:
regs - Show all registers
setreg [reg] [value] - Set register
Execution:
step - Single step
run - Continue execution
pause - Pause execution
Modules:
modules - List modules
module [addr] - Module info
Notifications:
notify [pattern] - Subscribe (e.g., notify [main])
notify [start] [end] - Subscribe to range (notify 0x400000 0x500000)
unnotify [pattern] - Unsubscribe from pattern
unnotify [start] [end] - Unsubscribe from range
optrva [true|false] - Set notification mode (VA default, RVA optional)
Analysis:
disasm [addr] [count] - Disassemble
eval [expr] - Evaluate expression
status - Show status
Session:
help - This help
quit/exit - Disconnect
Note: Addresses can be expressions like 'kernel32.GetProcAddress'
Or register names: eip, rax, esp, etc.
Examples:
read eip 100 - Read 100 bytes at EIP
readstring eax - Read ASCII string at EAX
readstring 0x401000 -u - Read Unicode string
Comments: (1)On 11.28.25 - 8:35pm dave wrote:
|
About Me More Blogs Main Site
|
||||||||||||||||||||||||||||||||