Skip to content

Instantly share code, notes, and snippets.

@leechristensen
Last active July 3, 2024 19:16
Show Gist options
  • Save leechristensen/61f22ce081c2d4fcb960830a8132e3c5 to your computer and use it in GitHub Desktop.
Save leechristensen/61f22ce081c2d4fcb960830a8132e3c5 to your computer and use it in GitHub Desktop.
Ida IDC script that dumps the bytes at the mouse cursor's position as a GUID string
// Dumps the bytes at the mouse cursor's position as a GUID string
//
// Usage:
// 1. Click on the GUID's "Data1" field in Ida
// 2. Run the script (File -> Script File..., or hit Alt+F7)
// 3. When you load the script, it'll display the GUID in Ida's output window.
// After it's loaded, you can run it again anytime by executing the
// function `get_guid_at_cursor()` in Ida's IDC REPL prompt.
#include <idc.idc>
static get_cursor_addr() {
// There's really not an easier way to get the current address?
// get_screen_ea() doesn't work if field is in structure :(
auto line = get_curline();
auto start = strstr(line, ":");
auto end = strstr(line, " ");
auto str_ea = substr(line, start+1, end); // Extract the address
auto ea = xtol(str_ea);
return ea;
}
static get_guid_at_cursor() {
auto ea = get_cursor_addr();
if (ea == BADADDR) {
Message("Error: Could not determine the correct address.\n");
return;
}
auto guid = sprintf(
"{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}",
Byte(ea+3), Byte(ea+2), Byte(ea+1), Byte(ea),
Byte(ea+5), Byte(ea+4),
Byte(ea+7), Byte(ea+6),
Byte(ea+8), Byte(ea+9),
Byte(ea+10), Byte(ea+11), Byte(ea+12), Byte(ea+13), Byte(ea+14), Byte(ea+15)
);
return guid;
}
static main() {
print(get_guid_at_cursor());
}
@leechristensen
Copy link
Author

Hovering over a GUID structure and then loading the script:

image

With the script already loaded, running the get_guid_at_cursor() command:

image

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment