3

I'm new to IDAPython. Basically I want to iterate through all functions in an IDB file and their instructions using ida python script. The final goal is to export the functions & their instructions from idapro. in certain format.

from idautils import *
from idaapi import *

ea = BeginEA()
for funcea in Functions(SegStart(ea), SegEnd(ea)):
    functionName = GetFunctionName(funcea)
    print functionName

Using above script I'm retrieving function names, now I also want to print the assembly instructions of each function. I know may I have to use GetDisasm(ea), not sure how to use the API.

TIA

6

Please note that it will print only those functions that were recognized as such by IDA autoanalysis or defined manually, exactly as your code snippet. This snippet is not debugged, use on your own risk.

from idautils import *
from idaapi import *
from idc import *

for segea in Segments():
    for funcea in Functions(segea, SegEnd(segea)):
        functionName = GetFunctionName(funcea)
        for (startea, endea) in Chunks(funcea):
            for head in Heads(startea, endea):
                print functionName, ":", "0x%08x"%(head), ":", GetDisasm(head)

If you want to extract the instructions as binary you can use idc.NextHead function to get instruction boundaries.

The function chunks mentioned in the code are not the same as we see in the the graph view in IDA (the function has more than one chunk if it is discontinuous ): chunks in graph view are called "basic blocks", see more correct definition by the link.

  • Thanks! This is what I wanted. BTW, Is there any way I can get the instruction sets in chunks, the way we get in IDA graph view? – Dev.K. Feb 23 '17 at 16:57
  • @Dev.K. These chunks are called "basic blocks". As far as I know there is no IDAPython API to work with it, however all starting instructions of the chunks can be found by number of code references to them. – w s Feb 23 '17 at 17:00
  • @Dev.K. See updated answer, more correct definition of basic block referenced – w s Feb 23 '17 at 17:34
  • Instead of iterating over all segments, one may call idautils.Functions(). The default behavior will iterate over all functions defined in the IDB. – NirIzr Sep 26 '18 at 0:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.