> For the complete documentation index, see [llms.txt](https://sansong.gitbook.io/cyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sansong.gitbook.io/cyber/rev/outils/ida/ida-scripting.md).

# IDA Scripting

https\://hex-rays.com/products/ida/support/tutorials/idc/

**Déchiffrer une partie de la mémoire**

> <https://hex-rays.com/products/ida/support/tutorials/idc/decrypt/>

Déchiffrer les données de <mark style="color:blue;">`start`</mark> à <mark style="color:blue;">`end`</mark> en xorant avec <mark style="color:blue;">`key`</mark>.

```c
static decrypt(start, end, key ) {
  auto addr, x;           // we define the variables
  for ( addr=start; addr < end; addr=addr+4 ) {
    x = Dword(addr);    // fetch the dword
    x = (x^key);       // decrypt it
    PatchDword(addr,x); // put it back
  } 
}
```

{% hint style="info" %}
Attention aux types:

<mark style="color:blue;">`Dword, Byte...`</mark> -> adapter <mark style="color:blue;">`PatchDword, PatchByte...`</mark> en fonction du cas

```
Rappels:
    - byte : 1 octet
    - word : 2 octets
    - dword: 4 octets
    - qword: 8 octets
```

{% endhint %}

1. Le charger sur IDA: <mark style="color:blue;">`File > Script command...`</mark> (Shift + F2)

<figure><img src="https://1813806532-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FZRRTPIEA4wb6exZozwS0%2Fuploads%2FvckHWSn2voJeXlXmfuw2%2Fidascript.png?alt=media&amp;token=623e0184-0ac4-43d2-b0a8-244688d539c4" alt="" width="428"><figcaption></figcaption></figure>

2. Cliquer sur <mark style="color:blue;">`Run`</mark>

{% hint style="info" %}
Les potentiels messages d'erreurs du script s'affichent dans la console IDA à ce moment
{% endhint %}

2. Appeler la fonction dans la console IDA

```sh
IDC>decrypt(0x8048104, 0x80482E8, 0x8048FC1)
```