How to get the CPU architecture via Idapython?

Question

I was not able to find an API function to get the CPU architecture of the loaded binary. In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type.

I don't want to fall back to running some additional (python) tool such as file, readelf or a python ELF parser. I also don't like the idea of parsing the strings displayed at the beginning of the IDA assembly listing.

There must be a way to use idc.py, idaapi.py or idautils.py for this.

Answer 1

You can get the name of the processor from the idainfo struct:

import idaapi

info = idaapi.get_inf_structure()

if info.is_64bit():
    bits = 64
elif info.is_32bit():
    bits = 32
else:
    bits = 16

try:
    is_be = info.is_be()
except:
    is_be = info.mf
endian = "big" if is_be else "little"

print 'Processor: {}, {}bit, {} endian'.format(info.procName, bits, endian)
# Result: Processor: mipsr, 32bit, big endian

Still haven't found the endian, though.

EDIT: Endian can be determined by processor name. For example, mipsr is big endian, and mipsrl is little endian.

EDIT:
Added a proper endian check (mf == MSB First). Based on this answer.

EDIT:
Since IDA7 beta 3 (170724), idainfo.mf was removed, and idainfo.is_be() must be used. Based on keypatch

Answer 2

Not all processor name has endian information. Generally it can be determinded as:

BIG_ENDIAN if _idaapi.cvar.inf.mf else LITTLE_ENDIAN

Answer 3

This is definitely not exact answer, but probably you could make use of

idaapi.ph_get_regnames() 

Returns the list of register names as defined in the processor module

Different platforms has different register sets, and if you will not find your solution about exact cpu you can give it a try. This function exists in IDA 6.8.

Answer 4

Using the minsc plugin at https://github.com/arizvisa/ida-minsc, you can access database information using database.information. To get the detected architecture, you can access it via instruction.arch (currently only Intel, Mips, and Arm are implemented for this particular method).

Python>db.info.processor(), db.info.bits(), db.info.byteorder(), ins.arch
('metapc', 0x20, 'little', <pc.Intel object at 0x7fdf2c145e90>)

Disclaimer: I maintain the ida-minsc plugin.

Register information can be accessed via instruction.architecture.register (or instruction.register).

Python>ins.arch.reg
<class 'internal.architecture.map_t'>
%bnd0  : <class 'register_t' index=97 dtype=dt_byte16 name='bnd0' position=0+128>
%bnd1  : <class 'register_t' index=98 dtype=dt_byte16 name='bnd1' position=0+128>
%bnd2  : <class 'register_t' index=99 dtype=dt_byte16 name='bnd2' position=0+128>
%bnd3  : <class 'register_t' index=100 dtype=dt_byte16 name='bnd3' position=0+128>
...
%zmm31  : <class 'register_t' index=164 dtype=dt_byte64 name='zmm31' position=0+512>
 %ymm31 : \_<class 'register_t' index=132 dtype=dt_byte32 name='ymm31' position=0+256>
 %xmm31 :   \_<class 'register_t' index=116 dtype=dt_byte16 name='xmm31' position=0+128>

If you want to access the processor information as soon as the disassembler figures it out, you can add a hook. First we define some function that corresponds to IDP_Hooks.ev_newprc. Then we can use the idp hooks in the ui module from minsc accessed as ui.hooks.idp.

import database as db, ui
def choose_processor(*dunno):
    print('got', db.info.processor())
Python>ui.hook.idp.add('ev_newprc', choose_processor)

IDP Hook is now added (Note: edited a bit to highlight the function we've attached).

Python>ui.hook.idp
Events currently connected to IDP_Hooks:
...
IDP_Hooks.ev_newprc           : __main__.choose_processor(*dunno)[+0]
...
IDP_Hooks.ev_rename           : internal.hooks.changing(*parameters)[+0]

Now upon opening up or creating a database we'll see the following output.

Loading processor module procs/arm.so for ARM...
...
OK
WARNING:root:Detected processor module : AArch32 (13)
got ARM
Assuming __fastcall calling convention by default
...