I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M).
Looking at the idapython documentation, it looks like maybe I can do this via the
bookmark_t proxy class and related functions, but it's not clear to me how to make this work. For example:
def find_index(*args) ‑> uint32 find_index(e, ud) -> uint32 e: lochist_entry_t const & ud: void *
e is obviously a lochist_entry_t, but I can't tell from the context what
ud is supposed to represent, or how I would pass it as a void pointer to the call. (For giggles, I tried to pass
None in place of a NULL pointer, and it actually crashed ida. Oops.)
I've searched the web for examples of using this api, but haven't found anything helpful.
Is what I'm trying to do possible? If so, can someone please provide a working example, or a reference/doc/blogpost somewhere that I missed, or even just a nudge the right direction?
Thanks in advance.
Digging through more idapython documentation (in unrelated areas) leads me to believe that
ud is user-defined context data, but it's not yet clear how to create this (since passing NULL/None seems to be a no-go) or pass it to the functions.
Further research has led me to trying to use
ctypes to create pointers to various data types, but even when using
c_void_p to create a void pointer, I'm still getting a
TypeError for the
I also found some mention of using SWIG's
cdata and similar functions, which would seem to make sense, since it appears idapython uses SWIG. However, I can't seem to figure out what/how to import to get access to that in python. Looking at various docs leads me to believe that those functions would be exposed via the SWIG interface definitions, and a quick look through the idapython SWIG interface definitions and the IDA SDK doesn't reveal anything I can actually import to give me access to those SWIG functions.
I did manage to find
uchar_array(size_t) which returns a character array pointer, so I tried to pass that to
bookmark_t_size(e, ud) and again IDA crashed. So at this point, I'm not sure what to try next.