Is it possible to parse the IAT using IDApython?
i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
3
-
Sorry to ask a slightly confused question here, but what exactly keeps you from using any of your Python modules from IDAPython, provided they share compatibility in the same Python version range?– 0xC0000022L ♦Dec 16, 2020 at 9:05
-
@0xC0000022L because lief sometimes doesn't properly parse stuff, and considering IDA pro is a professional software i would assume it should have a better parser compared to lief.– OneAndOnlyDec 16, 2020 at 10:39
-
Okay, so LIEF doesn't fit your bill. Fine, use something like pefile then or report the issues LIEF has or even fix them yourself. I don't see why IDAPython itself should pack a parser for PE files when IDA provides this out-of-the-box in the respective loader module. However, I'll ping one of the IDA folks.– 0xC0000022L ♦Dec 16, 2020 at 13:53
Add a comment
|
1 Answer
There’s no built-in functionality for that, it’s too target-specific to be useful as standard API. What you can do is to retrieve the list of exports and/or imports for the file which was used to create the database. If you need the low-level IAT details you’ll have to parse it manually from memory or database (not sure if database keeps enough information so you may need to go back to the input file).
answered Dec 16, 2020 at 14:32
