5

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions:

import idc
import idaapi
import idautils

def set_breakpoints():
    ea = idc.ScreenEA()
    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
        if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
            for ref in idautils.CodeRefsTo(function_ea, 0):
                    idc.AddBpt(ref)

def rem_breakpoints():
    ea = idc.ScreenEA()
    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
        if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
            for ref in idautils.CodeRefsTo(function_ea, 0):
                    idc.DelBpt(ref)

idaapi.add_hotkey("Alt-Z", set_breakpoints)
idaapi.add_hotkey("Alt-X", rem_breakpoints)

Now I want to have the same functionality for imported win api functions (from "Import" tab), but I cannot find any flags that will indicate that function is imported. Maybe someone can point me into right direction to do this. Thanks.

1 Answer 1

6

This code snippet was copied from

https://github.com/idapython/src/blob/master/examples/core/list_imports.py

"""
summary: enumerate file imports

description:
  Using the API to enumerate file imports.
"""

import ida_nalt

nimps = ida_nalt.get_import_module_qty()

print("Found %d import(s)..." % nimps)

for i in range(nimps):
    name = ida_nalt.get_import_module_name(i)
    if not name:
        print("Failed to get import module name for #%d" % i)
        name = "<unnamed>"

    print("Walking imports for module %s" % name)
    def imp_cb(ea, name, ordinal):
        if not name:
            print("%08x: ordinal #%d" % (ea, ordinal))
        else:
            print("%08x: %s (ordinal #%d)" % (ea, name, ordinal))
        # True -> Continue enumeration
        # False -> Stop enumeration
        return True
    ida_nalt.enum_import_names(i, imp_cb)

print("All done...")

The remaining steps from enumerating imports to setting breakpoints are trivial.

1
  • 1
    One note: the entries in the .idata section are usually pointers to the target functons, not functions themselves, so they'll need to be dereferenced before setting breakpoints.
    – Igor Skochinsky
    Oct 1, 2016 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.