Questions tagged [ida-plugin]
Refer to any programs specifically designed to be a plugin of IDA Pro.
3
votes
1answer
111 views
Point-to analysis of IDA Pro
I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.
According to my personal ...
-1
votes
0answers
19 views
How to most optimally visit bytes with mapped file offset?
I'm writing and IDA Pro plugin with SDK 6.8 and so my most optimal code is this (with prefixed addresses valid only in the binary I'm reverse engineering).
for (uint32 i =0x00400000; i<0x00A30000;...
0
votes
0answers
45 views
Autor-resolve enumeration members?
How to make IDA auto-resolve integer constants into enumeration members when they are being used in a call?
I've tried setting appropriate function types and then reanalysing the program but alias ...
1
vote
1answer
112 views
How to find V-Table in IDA? (Using class informer)
I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do).
But how do i find them in IDA? I'...
-2
votes
1answer
149 views
How to install ida plugin to identify encryption function
I saw here How to identify known encryption algorithm? the IDA plugin https://github.com/nihilus/IDA_Signsrch
I don't understand how to install it .
In the INSTALL I saw coppy the plug-in and ...
-1
votes
1answer
79 views
Install and configure script language bar on IDA from IDC to Python
I'm new in the field of reverse engineering to detect malicious code in ELF file.
I installed IDA on Ubuntu (https://www.hex-rays.com/products/ida/support/download_freeware.shtml) then follow guide ...
3
votes
0answers
98 views
IDAPRO from command line interface: Exporting IDB file to BINEXPORT file
I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions:
"<path-to-idaq.exe>" -A -OExporterModule:<result-...
1
vote
0answers
36 views
Getting R6034 error message when starting IDA Pro
I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
0
votes
0answers
36 views
Is there a Heap Memory dump plugin for IDA similar to Immunity Debuggers !heap command?
Does anyone know of such a plugin or a method to get similar results using IDA?
0
votes
1answer
75 views
De-obfuscation - Emulation-oriented vs Script-oriented
What are the advantages of each method when employing de-obsfucation of potentially malicious code?
I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
1
vote
1answer
47 views
IDA SDK: Event when database created / opened?
I'm writing a plugin which is available at all times (PLUGIN_FIX flag).
However, I also need to be notified when a database is created or opened, as if I would handle the moment when init() is called ...
-1
votes
1answer
154 views
Dis-assamble .exe file to .asm in IDA Python [closed]
I have 5K .exe files from different sources like C and C++. I want to Dis-assamble them into .asm file using IDA Python. Consider this .exe file opened in IDA with text view:
I want this "Assembly" ...
0
votes
0answers
82 views
How can I identify the type of instructions and the type of operand
I was wondering how can I identify whether one insrtuction is a transfer instruction or an arithmetic instruction and how can I identify whether one operand is a string constant or a numeric constant?
-2
votes
1answer
173 views
(Hex-Rays) How to define C macro?
Im want create reverse macro for constant integers, how i can do it?
Example:
#define MU_ITEM(x, y) (x * 512 + y)
My goal is make result of number format like: before & after.
3
votes
1answer
461 views
Identify the porcessor type of a binary
There are different ways to identify the processor type such as using IDA or file command in Linux. But sometimes the processor type is not detected by these tools. Besides I do not have the correct ...
2
votes
1answer
227 views
IDA PRO: Monitor variable during execution
I'm new with IDA. Say I have a variable which is created in some function and it is argument to other functions.
My question is how to monitor this variable? In monitor I mean is there any way to set ...
0
votes
1answer
127 views
Getting Xrefs to Windows Library Functions in IDA Pro
Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press Ctrl+G you can search for a library function and set a breakpoint even ...
1
vote
1answer
189 views
Recover Library Function ProtoType from IDA-Pro
I am working on a reverse engineering task, in which I need to recover function prototype (including number of parameters, type of each parameter) from the input binary (ELF binary on 64-bit Linux).
...
1
vote
1answer
84 views
How to get API name from address in registry value in IDA plugin
For example I have eax 7c9100a4 -> ntdll.RtlCreateHeap
I can get reg value in my plugin but I can't get the api name
How can get the correct api name from the address?
2
votes
1answer
401 views
IDAPython: Change struct member content name
tl;dr
I have an array of structs, I'd like to iterate over it and change fields content, (name, values), upon simple conditions.
I can get the offset of the members, but I can't modify them due to the ...
-1
votes
2answers
114 views
Incorrect semicolon usage in decompiled variables
My problem is: hexrays thinks that semicolon is visible character.
In IDAPython idaapi.is_visible_char(';') returns True
In picture you can see "field_100C;" highlighted, but "field_100C" not ...
2
votes
1answer
660 views
Batch mode of ida pro 6.5
i have tried almost all links about batch mode.
My Question is that i did not get the user manual about batch mode of ida pro that how can i use the commands like -c -A -B and how i can run script on ...
0
votes
1answer
102 views
How can i rename Array to API Name in IDAPro?
I am studying to analysis malware..
While to analysis a malware using IDA, I want to rename array to API Name.
To Help your understanding, attached image.
Please help.
Thank you
4
votes
2answers
1k views
How can I call IDA Pro's MakeCode for one instruction at a time?
I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately.
I ...
0
votes
1answer
403 views
Variable mapping in IDA hotkey change
Is there a way to change hotkey for variable mapping ('=' by default)? For example: I'd like to bind it to 'Shift+Q'.
0
votes
1answer
273 views
Is there any IDA plugin to display AST?
Hex Ray has introduced a decompiler API as part of IDA v6.6. Is there any plugin which displays the detail Abstract Syntax Tree (AST) produced by the decompiler graphically?
I want something like ...
0
votes
0answers
98 views
Reversing so lib's with IDA
When i decompile APK file there are .so lib's i choise the one with my CPU architecture in my case ARMv7.
The .so lib's are writen in C#, but i can't see the fine C sharp code, even when i decompile ...
0
votes
1answer
290 views
Dynamic Analysis Detection
Suppose you want to conceal an application's true purpose from analysts by reacting to dynamic analysis tools. How is it possible to detect running (in debugger mode) the application under a reverse ...
4
votes
1answer
5k views
How can I set breakpoint and get value of a register with IDApython
How can I set a breakpoint and get the value of the EAX register with IDApython?
I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
2answers
1k views
How to Find All Switch Jump Tables in IDAPython
I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly:
jmp ds:off_65018790[ecx*4] ; switch jump
...
2
votes
1answer
4k views
Executing an IDAPython script with arguments within IDA Pro
I have an IDAPython script x.py which takes some arguments, which prevents me from simply using alt + F7 and selecting my script.
How can I execute this script within IDA Pro and specify the ...
0
votes
1answer
773 views
How can I export a struct in IDA Pro to a c-style struct?
I have a struct in IDA Pro that I want to export to a c-style struct. For example:
00000000 ICreateErrorInfo struc ; (sizeof=0x4, align=0x4, standard type)
00000000 ...
1
vote
1answer
471 views
Find cryptography used by iOS applications by analyzing ARM assembly in IDA?
I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
5
votes
1answer
1k views
IDA Pro Plugin to add x64dbg
Is there a plugin for IDA Pro to enable me to add x64dbg debugger support to IDA Pro 6.8 or 6.9?
2
votes
1answer
892 views
Hex-Rays and IDA Python plugin loading order
I have made a plugin (using IDA Python) that requires the Hex-Rays plugin.
As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
2
votes
1answer
526 views
Obtaining the Pseudocode of a function via a script
I am looking for a way to obtain the pseudocode of a function via a script. I am using IDAPro 6.9 on OS X 10.11.4 (El Capitan).
I did locate this documentation on using the decompiler in batch mode:
...
4
votes
3answers
2k views
IDApython and IDA-decompiler commenting
Looking at the functions exposed by idaapi I see that functions like the following are exposed.
get_user_cmt
set_user_cmt
save_user_cmts
As these functions are exposed I'm hoping that I have a way ...
0
votes
0answers
74 views
tools like patchdiff and bindiff for x64 [duplicate]
I know the patchdiff it also for X64 but it crash on my ida.
so is there any tools like this for x64?
thanks for all helpers
this is not this question i am talking about x64 bins
2
votes
0answers
484 views
IDA Pro get line number in main view
I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
3
votes
1answer
689 views
IDA Pro Dump of instructions and offsets
I'm writing a plugin for IDA PRO with IDAPython and I need to make a dump of the full disassembled code with offsets.
I know I can export a html file and then parse it but I cannot call the ...
1
vote
1answer
1k views
How to stop IDA debugger when a register is set to a particular value?
I use the following script to set IDA in trace mode and make it stop as soon as EAX register is set to a given value :
#include <idc.idc>
static main()
{
auto r_eip, code, eax;
...
3
votes
2answers
3k views
Which plugin for identifying crypto algorithms in IDA Pro 6.9?
I stumbled upon findcrypt2 but it seems not to work anymore. Is there a new version of findcryp2 anywhere or are there similar plugins which are able to identify different crypto algorithms by ...
3
votes
0answers
83 views
Catch function flags change event in IDA plugin
Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it ...
7
votes
1answer
479 views
Adding a toolbar to IDA using PySide
So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
1
vote
0answers
337 views
Using MyNav Python Scripts With IDA Pro 6.1 On Windows 7
I just came across the MyNav Python scripts and would like to use some of their functionality on my IDA Pro database. I have IdaPython installed properly, but I cannot seem to get the plugins to show ...
4
votes
1answer
970 views
IDAPython Strings constantly returns NoneType with str()
I'm trying to automate disassembly of a firmware image using IDA Pro 6.5 and IDA Python. One of the process I want to implement is to locate strings and create a data segment around them.
Using the ...
3
votes
0answers
306 views
IDA Plugin to diff functions within the same binary
Sometimes by reversing I find several functions within the same binary file which look suspiciously similar. Is there a plugin/script to quickly compare them and see their differences?
P.S. I'm aware ...
1
vote
1answer
184 views
How to port function names from one exe to another?
I have two 64 bit elf files for one program but with 2 different version.
IDA can resolve the function names in one of them while not for the other.
I don't have bindiff but I want an automatic ...
2
votes
2answers
1k views
Automatic generation of call graph in IDA Pro
I want to generate call graph from Ida pro but I want to do it automatically. I wrote these two scripts but they did not work. Could you help me what is the problem?
1:
#include ida.idc;
#include ...
2
votes
1answer
403 views
IDA Plugin/Script Output File Character Limit?
I am currently working on both a plugin and an ida-python script that export fairly big JSON files.
I just noticed, that both will at times cut off the output files with no error message. Sometimes ...
