A tool for extracting information from IDA databases.
idbtool knows how to handle databases from all IDA versions since v2.0, both
You can also use
idbtool to recover information from unclosed databases.
idbtool works without change with IDA v7.0.
With idbtool you can search thousands of .idb files in seconds.
More precisely: on my laptop it takes:
Loading a approximately 5 Gbyte idb file in IDA, takes about 45 minutes. While idb3.h takes basically no time at all, no more than a few milliseconds.
Two versions of this tool exist:
One written in python
One written in C++
Both repositories contain a library which can be used for reading
idbtool [options] [database file(s)]
--names will list all named values in the database.
--scripts will list all scripts stored in the database.
--structs will list all structs stored in the database.
`--imports` will list all imported symbols from the database
--enums will list all enums stored in the database.
--info will print some general info about the database.
--pagedump dump btree page tree contents.
--dec list all records in ascending / descending order.
--query search specific records in the database.
--limit limit the number of results returned by
-id1 dump only one specific section.
--i32 tell idbtool that the specified file is from a 64 or 32 bit database.
--recover group files from an unpacked database.
--classify summarizes node usage in the database
--dump hexdump the original binary data
Queries need to be specified last on the commandline.
idbtool [database file(s)] --query "Root Node;V"
Will list the source binary for all the databases specified on the commandline.
A query is a string with the following format:
Root Node;V-> prints record containing the source binary name
?Root Node-> prints the Name record pointing to the root
>Root Node-> prints the first 10 records starting with the root node id.
<Root Node-> prints the 10 records startng with the recordsbefore the rootnode.
.0xff000001;N-> prints the rootnode name entry.
#1;N-> prints the rootnode name entry.
List the highest node and following record in the database in two different ways,
the first: starting at the first record below
ffc00000, and listing the next.
The second: starting at the first record after
ffc00000, and listing the previous:
--query "<#0xc00000" --limit 2 --inc -v
--query ">#0xc00000" --limit 2 --dec -v
Note that this should be the nodeid in the
$ MAX NODE record.
List the last two records:
--limit 2 --dec -v
List the first two records, the
$ MAX LINK and
$ MAX NODE records:
--limit 2 --inc -v
Several methods exist for printing all records in the database. This may be useful if you want to investigate more of IDA''s internals. But can also be useful in recovering data from corrupted databases.
--deccan be used to enumerate all b-tree records in either forward, or backward direction.
-vto get a prettier key/value output
--id0walks the page tree, instead of the record tree, printing the contents of each page
--pagedumplinearly skip through the file, this will also reveal information in deleted pages.
When IDA or your computer crashed while working on a disassembly, and you did not yet save the database,
you are left with a couple of files with extensions like
These files are the unpacked database, i call them
--i32 options you can inspect these
naked files individually.
or use the
--recover option to view them as a complete database together.
idbtool will figure out automatically which files would belong together.
idbtool can figure out the bitsize of the database from an
.id0 file, but not(yet) from the others.
idblib.py contains a library.
Willem Hengeveld [email protected]