I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M).
Looking at the idapython documentation, it looks like maybe I can do this via the bookmark_t
proxy class and related functions, but it's not clear to me how to make this work. For example:
def find_index(*args) ‑> uint32
find_index(e, ud) -> uint32
e: lochist_entry_t const &
ud: void *
e
is obviously a lochist_entry_t, but I can't tell from the context what ud
is supposed to represent, or how I would pass it as a void pointer to the call. (For giggles, I tried to pass None
in place of a NULL pointer, and it actually crashed ida. Oops.)
I've searched the web for examples of using this api, but haven't found anything helpful.
Is what I'm trying to do possible? If so, can someone please provide a working example, or a reference/doc/blogpost somewhere that I missed, or even just a nudge the right direction?
Thanks in advance.
Edit:
Digging through more idapython documentation (in unrelated areas) leads me to believe that ud
is user-defined context data, but it's not yet clear how to create this (since passing NULL/None seems to be a no-go) or pass it to the functions.
Edit 2:
Further research has led me to trying to use ctypes
to create pointers to various data types, but even when using c_void_p
to create a void pointer, I'm still getting a TypeError
for the void*
argument.
I also found some mention of using SWIG's cdata
and similar functions, which would seem to make sense, since it appears idapython uses SWIG. However, I can't seem to figure out what/how to import to get access to that in python. Looking at various docs leads me to believe that those functions would be exposed via the SWIG interface definitions, and a quick look through the idapython SWIG interface definitions and the IDA SDK doesn't reveal anything I can actually import to give me access to those SWIG functions.
Edit 3:
I did manage to find uchar_array(size_t)
which returns a character array pointer, so I tried to pass that to bookmark_t_size(e, ud)
and again IDA crashed. So at this point, I'm not sure what to try next.