4

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions:

import idc
import idaapi
import idautils

def set_breakpoints():
    ea = idc.ScreenEA()
    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
        if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
            for ref in idautils.CodeRefsTo(function_ea, 0):
                    idc.AddBpt(ref)

def rem_breakpoints():
    ea = idc.ScreenEA()
    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
        if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
            for ref in idautils.CodeRefsTo(function_ea, 0):
                    idc.DelBpt(ref)

idaapi.add_hotkey("Alt-Z", set_breakpoints)
idaapi.add_hotkey("Alt-X", rem_breakpoints)

Now I want to have the same functionality for imported win api functions (from "Import" tab), but I cannot find any flags that will indicate that function is imported. Maybe someone can point me into right direction to do this. Thanks.

4

This code snippet was copied from https://github.com/idapython/src/blob/master/examples/ex_imports.py

# -----------------------------------------------------------------------
# This is an example illustrating how to enumerate imports
# (c) Hex-Rays
#
import idaapi

def imp_cb(ea, name, ord):
    if not name:
        print "%08x: ord#%d" % (ea, ord)
    else:
        print "%08x: %s (ord#%d)" % (ea, name, ord)
    # True -> Continue enumeration
    # False -> Stop enumeration
    return True

nimps = idaapi.get_import_module_qty()

print "Found %d import(s)..." % nimps

for i in xrange(0, nimps):
    name = idaapi.get_import_module_name(i)
    if not name:
        print "Failed to get import module name for #%d" % i
        continue

    print "Walking-> %s" % name
    idaapi.enum_import_names(i, imp_cb)

print "All done..."

The remaining steps from enumerating imports to setting breakpoints are trivial.

  • One note: the entries in the .idata section are usually pointers to the target functons, not functions themselves, so they'll need to be dereferenced before setting breakpoints. – Igor Skochinsky Oct 1 '16 at 18:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.