PyHiew: Transferring names between IDA Pro and Hiew

Last week I updated PyHiew to version 0.2.0 which adds the ability to manage names in Hiew (add local/global names and comments).

In this blog post I demonstrate how to use these facilities to transfer names between IDA Pro and Hiew.

Here’s a summary of the script logic:

  • A PyHiew script will act as a server
  • It will display an information dialog and setups up a server socket then wait for connections
  • An IDA Pro python script will act as a client to send the names from IDA to Hiew
  • Hiew receives and populates the names

Using the script

Load the IDA client script (pyhiew\3rd\IDA-Names-Client.py) from the PyHiew package

names-sel-script

A message box will show, do not close it until you proceed with Hiew

names-ida-wait

Now run Hiew and open the desired file and press F11 to toggle the HEM modules.
Select PyHiew and then the IDA-Names-Server script
The script will display a message window like this:

names-wait

Depending on what you want to transfer you may press one of the function keys.

After selecting an option, Hiew will display a wait box. Now switch back to IDA and press OK to connect to Hiew and start the name transfer.

If the operation succeeds then the name count will be displayed:

names-after-copy

In Hiew (Hex/Asm view) you may press F12 to display the name window:

names-transferred

That’s it! This script ships with PyHiew 0.2.1

Advertisements

About 0xeb

I am a programmer and reverse engineer. I like to write software utilities, designing APIs and reverse engineering interesting stuff.
This entry was posted in IDA Pro, Python. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s