Questions tagged [ida-plugin]
Refer to any programs specifically designed to be a plugin of IDA Pro.
144
questions
0
votes
0answers
25 views
HexRay API - Programatically rebaseing program on firmware
I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
0
votes
0answers
21 views
How to create a form with a dropdown menu in ida in using C++ ask_form?
There is a function in kerwin.hpp, but its usage is unclear to me.
I want to display to the user a list of strings to choose from so I defined:
qstrvec_t fileNames;
I want the user to choose one and ...
0
votes
1answer
32 views
Failed to load IDA PLW plugin
I am trying to install mIDA plugin for IDA.
I found a compiled PLW file here: https://github.com/sourceincite/tools/tree/master/pymsrpc/mIDA , downloaded it and saved it to C:\Program Files\IDA 7.0\...
0
votes
1answer
36 views
IDAPython, parse IDA DB as PE file
I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
3
votes
0answers
78 views
Try to parse buffer as PE with IDAPython
file_buffer = requests.get(file_url)
buf_size = len(file_buffer)
pe_file = pefile.PE(data=file_buffer)
print("This is really a pe imphash %s." % pe_file.get_imphash())
addr = hex(id(...
0
votes
1answer
46 views
How to parse the NT headers and section headers of a PE file using IDApython?
I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
0
votes
1answer
48 views
How to parse the IAT using IDApython?
Is it possible to parse the IAT using IDApython?
i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
0
votes
2answers
90 views
IDA plugin with visual studio c++ 2019
Hello all and sorry for my bad English
I am trying to test an example for developping plugin in C++ with IDA from the book :
http://www.binarypool.com/idapluginwriting/idapw.pdf
I am using Visual c++ ...
0
votes
1answer
35 views
LPC2378FBD144 Arm7 hex file
I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3
im little confused about memory organization values i should put in the memory organization thank you for ...
0
votes
0answers
30 views
Use IDAPython to automatically attach to a remote GDB server
I would like to automate the process of connecting to a remote debug server.
The following code worked for the remote win32 debugger:
from ida_dbg import *
set_remote_debugger(addr, port)
...
0
votes
1answer
55 views
Custom IDA Decompilation Format
Is there a way to customize the format of IDA's decompiled code?
e.g.
char buf[7]; // [rsp+5h] [rbp-1Fh]
to
char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ]
or
switch (c)
to
switch( c )
0
votes
0answers
160 views
How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”
I have IDA 6.95, Python 2.7 and Python 3.7.
Currently when I start IDA it uses Python 2.7:
-----------------------------------------------------------------------------------------
Python 2.7.12 (v2.7....
1
vote
1answer
122 views
Get a networkx graph from the the function call-graph of the file using IDApython?
Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
1answer
183 views
Get current file name with IDApython
I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that.
the closest things ...
0
votes
0answers
15 views
How to get the color of a operand in IDApython?
Lets say there is a instruction, and the operand is pink, is there any API call that i can use to get the color of the operand? i searched in their documentation but only found GetColor API which ...
0
votes
0answers
28 views
Get the string usage sequence in each function with Idapython?
The only function i know for this task is idautils.Strings()
but the problem is i need to get the sequence of string usage in each function, meaning that if string 1 was first referenced then string ...
0
votes
0answers
46 views
Checking if a call is a API/Library call in IDApython?
I asked the question a while ago but found no answer so I'm trying my luck again
the only solution is this :
Finding all API calls in a function
but it doesn't work when the library call is a .NET ...
0
votes
0answers
24 views
How to check in IDApython that if a call is an API/Library call or not?
I want to check for every call instruction whether its an API call or library call (statically linked that flirt recognized)
The only solution i found is this :
Finding all API calls in a function
but ...
1
vote
0answers
53 views
Is there any way to apply FLIRT signatures through a script like idapython?
I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
0
votes
1answer
135 views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
0
votes
0answers
40 views
Defeating Tall Call obfuscation or something similar
If you look at the image below, you will see that IDA Pro's static analysis fails because the function doesn't actually end up there. There is no ret, add esp, 0x20 or pop to free the arguments on the ...
0
votes
0answers
32 views
IDA SDK Assemble instruction
What's the method of assembling instructions in IDA SDK c language?
Is that possible by passing insn_t* or str like option available in IDA [Edit->Patch program->Assemble]
1
vote
0answers
36 views
How to clear all comments created in ida using funcap?
How to clear the comments created by funcap and restore database to it's previous state?
I tried reanalyzing the program but comments do not seems to go away from database.
Though, checking-off ...
0
votes
0answers
53 views
how to calculate no basic blocks of a function using IDAPython
I am new to IDA Pro, IDAPython want to calculate no of basic blocks and its location in a function using IDAPython, please share the code with library needed to import.
0
votes
1answer
464 views
Find functions signatures in Ida?
I didn't understand the subject of find function in Ida via signature.
If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
1
vote
1answer
103 views
IDAPython: idaapi.get_highlight for demangled names
I'm using the following code to get the address of the selected function/variable:
hightlight = idaapi.get_highlight(idaapi.get_current_viewer())
screen_ea = idaapi.get_screen_ea()
ea = idaapi....
2
votes
1answer
613 views
IDA and Ghidra Reversing
I have several questions about IDA and Ghidra (for MIPS and ARM):
Is there any option to load an executable file with all its libraries?
For example, I want to enter inside a function which its ...
2
votes
1answer
51 views
Names not populating from disassembly to decompiler
I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation.
I have never noticed this ...
1
vote
1answer
1k views
Using Python 3.7 and 2.x in same IDA
I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7.
Is there any way to run that Python 2.7 based plugin?
1
vote
0answers
76 views
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.
I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
1
vote
0answers
35 views
IDA plugin handles signal only on hotkey press
IDA plugin handles signal only when I click the "hotkey" and not when I execute signal with
$ echo "test" > /tmp/fifo & # created w/ `mkfifo /tmp/fifo`
$ kill -SUIGUSR2 $(pidof ida)
Plugin ...
0
votes
0answers
21 views
Open all object files in Ida
I have archive file , like libc.a .
When I tried to open it with ida, ida ask to choose one object file that contain in archive file.
Is there any way to open all the object files in one Ida project?...
1
vote
1answer
154 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0answers
49 views
Identify encrypt /decrypt rsa function
I have arm static binary that I know it use RSA.
How can I find the encrypt/decrypt function?
1
vote
0answers
36 views
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
1
vote
0answers
70 views
How to load a library at a specific address in IDA and re-analyze the program statically?
I have a dumped PE that has calls like
call ds:dword_4010B4
now these are actually addresses of APIs in kernel32.dll
my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
1answer
264 views
Extracting instruction and operand information in IDA Python
I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
155 views
How to call WinApi from a breakpoint in IDA Pro?
When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):
//C++ code
SCROLLINFO s;
s....
0
votes
0answers
42 views
use ida python to add a remark when calling a function using register
I want to add a remark for all non direct function calls.
e.g. say i have
mov EAX [functionEP]
call EAX
Assuming i have many such calls to various functions, I would like to run the debugger and ...
2
votes
2answers
2k views
Use idapython to print register or memory value when the debugger is running
I want to record the value of a certain register or specific memory location when the program is being debugged.
e.g. in the following segment:
.text:0FD6268D shr ecx, 4
.text:...
1
vote
1answer
138 views
Tool to search known hash/encryption algo in files in Windows
I am looking for a tool (the best would be an Ida plugin) that can search files in a folder for a known hash (md5/sha1 etc.) and encryption (aes /rsa etc.).
I know an Ida plugin called FindCrypt2 but ...
1
vote
2answers
3k views
How to load a color theme correctly in IDAPro?
I work late nights and a dark theme like this would be nice with IDAPro.
I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
1
vote
0answers
93 views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
0
votes
2answers
1k views
How to identify base64 encode/decode in assembly
How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that?
FindCrypt2 Ida plugin not find that
1
vote
1answer
772 views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...
3
votes
1answer
432 views
IDA 7.0 - combine sequence of assembly instructions to a macro
I'm solving this CTF with IDA Pro 7.0.
At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it.
The main problems are:
the ...
3
votes
1answer
467 views
Point-to analysis of IDA Pro
I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.
According to my personal ...
1
vote
1answer
3k views
How to find V-Table in IDA? (Using class informer)
I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do).
But how do i find them in IDA? I'...
-2
votes
1answer
2k views
How to install ida plugin to identify encryption function
I saw here How to identify known encryption algorithm? the IDA plugin https://github.com/nihilus/IDA_Signsrch
I don't understand how to install it .
In the INSTALL I saw coppy the plug-in and ...
1
vote
1answer
712 views
Install and configure script language bar on IDA from IDC to Python
I'm new in the field of reverse engineering to detect malicious code in ELF file.
I installed IDA on Ubuntu (https://www.hex-rays.com/products/ida/support/download_freeware.shtml) then follow guide ...
