3

I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M).

Looking at the idapython documentation, it looks like maybe I can do this via the bookmark_t proxy class and related functions, but it's not clear to me how to make this work. For example:

def find_index(*args) ‑> uint32
    find_index(e, ud) -> uint32
    e: lochist_entry_t const &
    ud: void *

e is obviously a lochist_entry_t, but I can't tell from the context what ud is supposed to represent, or how I would pass it as a void pointer to the call. (For giggles, I tried to pass None in place of a NULL pointer, and it actually crashed ida. Oops.)

I've searched the web for examples of using this api, but haven't found anything helpful.

Is what I'm trying to do possible? If so, can someone please provide a working example, or a reference/doc/blogpost somewhere that I missed, or even just a nudge the right direction?

Thanks in advance.

Edit:

Digging through more idapython documentation (in unrelated areas) leads me to believe that ud is user-defined context data, but it's not yet clear how to create this (since passing NULL/None seems to be a no-go) or pass it to the functions.

Edit 2:

Further research has led me to trying to use ctypes to create pointers to various data types, but even when using c_void_p to create a void pointer, I'm still getting a TypeError for the void* argument.

I also found some mention of using SWIG's cdata and similar functions, which would seem to make sense, since it appears idapython uses SWIG. However, I can't seem to figure out what/how to import to get access to that in python. Looking at various docs leads me to believe that those functions would be exposed via the SWIG interface definitions, and a quick look through the idapython SWIG interface definitions and the IDA SDK doesn't reveal anything I can actually import to give me access to those SWIG functions.

Edit 3:

I did manage to find uchar_array(size_t) which returns a character array pointer, so I tried to pass that to bookmark_t_size(e, ud) and again IDA crashed. So at this point, I'm not sure what to try next.

1 Answer 1

1

To clarify, location history and marked positions are two different things...but it's not surprising that you wandered into that API and got stuck since that's the SWIG wrapper around the SDK itself and is hence not too user-friendly.

However, there's get_mark_comment and get_marked_pos over at https://www.hex-rays.com/products/ida/support/idapython_docs/ida_idc.html which is much easier and straightforward to use. Your mark limit is MAX_MARK_SLOT, so you can use this with those idc functions to iterate through all of the possible marks in the database.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.