ida js w/dbg

Author: David Zimmer
Date: 10.18.15 - 3:56am

So I finally found some free time this weekend to integrate the duktape debugger activex control I created with the original IDA JScript interface.Only took about 5hrs to get it swapped out and working.

Select your Version of IDA:

2015: IDA <= 6.9 Installer (source)
2020: IDA 7+ Installer (source)
Related: gleegraph qwingraph replacement using IDASrvr

The old version only works on 32bit disassemblies. The newer version now supports 32 and 64bit disassemblies.

Note: While IDAJscript can do many things on its own, If you do need access to the full IDA API, I often use this as an IDC or IDAPython script generator. Its actually pretty convenient and allows you to review massive script actions for bugs before applying them.

quick overview:

script ida using javascript
full syntax highlighting, brace matching, auto indent, tool tips
intellisense
full debugger support, step in/out/over, breakpoints, mouse over variable vals
debugger cmdline to query/set vals, run functions etc
small IDA plugin as an IPC server with main UI as running out of process to simplify development.
currently supports following (8.11.23):
- crypt: crc32 toHexStr fromHexStr md5 md5File hexdump writeBin getBin sha1 sha256 sha1File sha256File
- x64: toHex add subtract
- fso: readFile writeFile appendFile fileExists deleteFile openFileDialog saveFileDialog expandPath loadToJS
- ida: isUp is32Bit message makeStr makeUnk loadedFile patchString patchByte getAsm instSize xRefsTo xRefsFrom getName functionName hideBlock showBlock setname addComment getComment addCodeXRef addDataXRef delCodeXRef delDataXRef funcVAByName renameFunc find decompile jump jumpRVA refresh undefine showEA hideEA removeName makeCode funcIndexFromVA nextEA prevEA funcCount() numFuncs() functionStart functionEnd readByte originalByte imageBase screenEA() quickCall clearDecompilerCache() isCode isData readLong readShort readQWord dumpFunc dumpFuncBytes getopv add_enum get_enum add_enum_member importFile addSect sectExists delSect getSects getFunc readStr OffsetToVa VaToOffset getRes
- list1: AddItem Clear ListCount Enabled
- app: intToHex t clearLog caption alert getClipboard setClipboard benchMark askValue exec enableIDADebugMessages timeout do_events() hexDump hexstr toBytes confirm
- remote: ip response ScanProcess ResolveExport
- al: addAddr showList() hideList() clear() copyAll() setColHeaders
- pb: max value clear() inc()
- fn: index name start end size xrefs refqty argsize tailqty labelqty frsize

Credits:

Duktape - http://duktape.org
Scintilla by Neil Hodgson [neilh@scintilla.org] - site: http://www.scintilla.org/
ScintillaVB by Stu Collier - site: http://www.ceditmx.com/software/scintilla-vb/
CSubclass by Paul Canton [Paul_Caton@hotmail.com]
Interface by David Zimmer - site http://sandsprite.com

Comments: (3)

On 09.30.17 - 3:09am Dave wrote:
IDA Compare will need similar updates and might just get converted to use IDASRVR as well and move the IDB exporter to the out of process GUI part. In practice it may take a while not because its hard, but because I dont care. I still use IDA 6.7 despite having access to the newer versions for exactly these types of upgrade reasons.

On 08.09.23 - 11:16am Dave wrote:
Ida is now doing away with its 32bit version fir 32bit disassembly and will doing everything from one 64 bit exe. I will be able to make this transition with it but not sure when I update my personal license. Too expensive to do arbitrarily. The x64 side of ida Jscript may just work without hiccup on 32 but binaries someone let me know

On 01.11.25 - 7:04am Dave wrote:
The first versions of this project started when windows was 32bit only. VB has no support for x64 numbers natively. Keep in mind JS has a MAX_SAFE_INTEGER of:

0x001FFFFFFFFFFFFF vrs full x64 range
0xFFFFFFFFFFFFFFFF

This is why I handle x64 values as strings by default and have the x64 class to safely handle add/subtract/tohex for any condition.

I have tried to make this as invisible as possible, but do keep this in mind if you are using large JS native numbers in your scripts.

In x64 Disasm I did have a few places where you might get an 0x[decimal] number back. I think I have fixed them all now.

I am almost considering ditching the JS engine and switching over to python. Check this control out

https://sandsprite.com/blogs/index.php?uid=11&pid=534&year=2023

Leave Comment:

Name:

Email: (not shown)

Message: (Required)

Math Question: 95 + 11 = ? followed by the letter: V