IDA JScript Updates

Author: David Zimmer
Date: 11.16.25 - 10:23am

so I guess I am in love with AI now. More toys less time, no typing pain.

I have had ollysync for like 20 years now. Step in olly, udp sync packet sent to my main desktop syncs IDA view. Great! for 32bit only.. boo.

So I have needed this for x64dbg now for a while. This weekend i prompted claude.ai and he was able to kick out a nice tcp remote shell that runs in x64dbg and accepts various commands for debugger automation. Took a Saturday to get it straightened out and tested which is a super reasonable timeline.

I have now already integrated this into IDA JScript with a new dbg. object. So within an IDA scripting IDE..we can now export comments and breakpoints and read values from a live debugger running on another network machine! It also supports the UDP view sync with IDA if enabled (dbg.notify).

This is kind of a more generic version of the Remote Lookup tool I released in 2017 using the remote. object. This model does however require a debugger attached instead of just raw memory analysis.

A python client and an olly plugin is included as well. The command table is below.

Its not fully tested yet but it is working. Ill release it now for early adopters.

Another thing should mention is that I will soon be ditching duktape as my js engine. A couple weeks ago i actually had claude create me an entire javascript engine in vb6! with support for debuging, COM integration, and i broke spec for TRUE x64 bit numbers!

It is mildly amusing that a scripting language developed in vb6 has true x64 bit number support when the host language does not! (mostly just sad but i wont ruminate)

Code is already included in ida jscript download now.

untested sample code

// In IDA JScript IDE with FULL debugging support:

// 1. Connect to remote x64dbg
dbg.Connect("192.168.1.100");

// 2. Scan IDB for interesting functions
for(var i = 0; i < ida.numFuncs(); i++) {
    var fname = ida.functionName(i);
    var fva = ida.functionStart(i);
    
    // 3. Find crypto/unpacking functions
    if(fname.indexOf("decrypt") > -1 || fname.indexOf("unpack") > -1) {
        
        // 4. Set breakpoint in REMOTE x64dbg!
        dbg.SetBreakpoint("0x" + fva.toString(16));
        
        // 5. Add your IDA comment as x64dbg label
        var comment = ida.getComment(fva);
        if(comment) {
            dbg.SetLabel("0x" + fva.toString(16), fname);
            dbg.SetComment("0x" + fva.toString(16), comment);
        }
        
        t("Exported: " + fname + " @ 0x" + fva.toString(16));
    }
}

// 6. Subscribe to notifications
dbg.NotifyModule("main");

// 7. Run and wait for UDP notifications in your listener
dbg.Run();

x64dbg Remote Control Commands:
  
  Memory:
    read [addr] [size]          - Read memory
    readstring [addr]           - Read ASCII string
    readstring [addr] -u        - Read Unicode string
    write [addr] [hex]          - Write memory
  
  Breakpoints:
    setbp [addr]                - Set breakpoint
    delbp [addr]                - Delete breakpoint
  
  Annotations:
    comment [addr] [text]       - Set comment
    getcomment [addr]           - Get comment
    label [addr] [name]         - Set label
  
  Registers:
    regs                        - Show all registers
    setreg [reg] [value]        - Set register
  
  Execution:
    step                        - Single step
    run                         - Continue execution
    pause                       - Pause execution
  
  Modules:
    modules                     - List modules
    module [addr]               - Module info
  
  Notifications:
    notify [pattern]            - Subscribe (e.g., notify [main])
    notify [start] [end]        - Subscribe to range (notify 0x400000 0x500000)
    unnotify [pattern]          - Unsubscribe from pattern
    unnotify [start] [end]      - Unsubscribe from range
    optrva [true|false]         - Set notification mode (VA default, RVA optional)
  
  Analysis:
    disasm [addr] [count]       - Disassemble
    eval [expr]                 - Evaluate expression
    status                      - Show status
  
  Session:
    help                        - This help
    quit/exit                   - Disconnect
    
  Note: Addresses can be expressions like 'kernel32.GetProcAddress'
        Or register names: eip, rax, esp, etc.
  
  Examples:
    read eip 100               - Read 100 bytes at EIP
    readstring eax             - Read ASCII string at EAX
    readstring 0x401000 -u     - Read Unicode string

Comments: (1)

On 11.28.25 - 8:35pm dave wrote:
now testing the new js engine. its great there is no cross language barriers. we can now streamline more such as directly returing native vb types like arrays to js, and even returning live js native types like json objects directly as com object function returns. com integration is working great. i dont even need a timeout feature since we have explicit control with ui refresh and perfect abort. It is working out very well so far

Leave Comment:

Name:

Email: (not shown)

Message: (Required)

Math Question: 34 + 45 = ? followed by the letter: V