0

Is it possible to parse the IAT using IDApython?

i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?

3
  • Sorry to ask a slightly confused question here, but what exactly keeps you from using any of your Python modules from IDAPython, provided they share compatibility in the same Python version range? – 0xC0000022L Dec 16 '20 at 9:05
  • @0xC0000022L because lief sometimes doesn't properly parse stuff, and considering IDA pro is a professional software i would assume it should have a better parser compared to lief. – OneAndOnly Dec 16 '20 at 10:39
  • Okay, so LIEF doesn't fit your bill. Fine, use something like pefile then or report the issues LIEF has or even fix them yourself. I don't see why IDAPython itself should pack a parser for PE files when IDA provides this out-of-the-box in the respective loader module. However, I'll ping one of the IDA folks. – 0xC0000022L Dec 16 '20 at 13:53
1

There’s no built-in functionality for that, it’s too target-specific to be useful as standard API. What you can do is to retrieve the list of exports and/or imports for the file which was used to create the database. If you need the low-level IAT details you’ll have to parse it manually from memory or database (not sure if database keeps enough information so you may need to go back to the input file).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.