Home

Awesome

IDBTOOL

A tool for extracting information from IDA databases. idbtool knows how to handle databases from all IDA versions since v2.0, both i64 and idb files. You can also use idbtool to recover information from unclosed databases.

idbtool works without change with IDA v7.0.

Much faster than loading a file in IDA

With idbtool you can search thousands of .idb files in seconds.

More precisely: on my laptop it takes:

Loading an approximately 5 Gbyte idb file in IDA, takes about 45 minutes. While idb3.h takes basically no time at all, no more than a few milliseconds.

Download

Two versions of this tool exist:

One written in python

One written in C++

Both repositories contain a library which can be used for reading .idb or .i64 files.

An IDA Pro plugin making use of idb3.h can be found here:

This is a plugin making it easy to copy scripts, structs or enums from recent ida databases.

Usage

Usage:

idbtool [options] [database file(s)] [-- address-list]

All addresses after -- will be printed as symbol+offset.

Query

Queries need to be specified last on the command line.

Example:

idbtool [database file(s)]  --query  "Root Node;V"

Will list the source binary for all the databases specified on the command line.

A query is a string with the following format:

Example queries:

List the highest node and following record in the database in two different ways, the first: starting at the first record below ffc00000, and listing the next. The second: starting at the first record after ffc00000, and listing the previous:

Note that this should be the nodeid in the $ MAX NODE record.

List the last two records:

List the first two records, the $ MAX LINK and $ MAX NODE records:

A full database dump

Several methods exist for printing all records in the database. This may be useful if you want to investigate more of IDA''s internals. But can also be useful in recovering data from corrupted databases.

LIBRARY

The header file idb3.h contains a library for reading from IDA Pro databases.

IDBFile

Class for accessing sections of an .idb or .i64 file.

Constructor Parameters:

Methods:

ID0File, ID1File, NAMFile

Constructor Parameters:

Constant

ID0File

Methods

Convenience Methods

ID1File

Methods

NAMFile

Methods

Cursor

Methods

TODO

Author

Willem Hengeveld itsme@xs4all.nl