Appcall
The debugger’s Appcall feature effectively extends the capabilities of IDC or IDAPython to make any function in the active process callable from a script. There are an infinite number of uses for such a capability, including mapping additional memory into the process address space (by calling VirtualAlloc or similar) and injecting new libraries into the process being debugged (by calling LoadLibrary or by calling functions within the process to perform tasks you would rather perform manually, such as decoding blocks of data or computing hash values).
In order to make use of Appcall, the function you wish to invoke must be loaded in the address space of the process being debugged, and IDA must know or be informed of the function’s prototype ...
Get The IDA Pro Book, 2nd Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
