Questions tagged [ida-plugin]
Refer to any programs specifically designed to be a plugin of IDA Pro.
117
questions
1
vote
0answers
24 views
Names not populating from disassembly to decompiler
I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation.
I have never noticed this ...
1
vote
0answers
37 views
Using Python 3.7 and 2.x in same IDA
I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7.
Is there any way to run that Python 2.7 based plugin?
0
votes
0answers
47 views
Find vulnerabilities in ARM IoT device
I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro.
I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
0
votes
0answers
29 views
IDA plugin handles signal only on hotkey press
IDA plugin handles signal only when I click the "hotkey" and not when I execute signal with
$ echo "test" > /tmp/fifo & # created w/ `mkfifo /tmp/fifo`
$ kill -SUIGUSR2 $(pidof ida)
Plugin ...
0
votes
0answers
12 views
Open all object files in Ida
I have archive file , like libc.a .
When I tried to open it with ida, ida ask to choose one object file that contain in archive file.
Is there any way to open all the object files in one Ida project?...
0
votes
1answer
27 views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
0
votes
0answers
27 views
Identify encrypt /decrypt rsa function
I have arm static binary that I know it use RSA.
How can I find the encrypt/decrypt function?
1
vote
0answers
27 views
IDA Pro SP tracking
I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
1
vote
0answers
26 views
How to load a library at a specific address in IDA and re-analyze the program statically?
I have a dumped PE that has calls like
call ds:dword_4010B4
now these are actually addresses of APIs in kernel32.dll
my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
1answer
150 views
Extracting instruction and operand information in IDA Python
I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
97 views
How to call WinApi from a breakpoint in IDA Pro?
When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint):
//C++ code
SCROLLINFO s;
s....
0
votes
0answers
32 views
use ida python to add a remark when calling a function using register
I want to add a remark for all non direct function calls.
e.g. say i have
mov EAX [functionEP]
call EAX
Assuming i have many such calls to various functions, I would like to run the debugger and ...
2
votes
2answers
875 views
Use idapython to print register or memory value when the debugger is running
I want to record the value of a certain register or specific memory location when the program is being debugged.
e.g. in the following segment:
.text:0FD6268D shr ecx, 4
.text:...
1
vote
1answer
128 views
Tool to search known hash/encryption algo in files in Windows
I am looking for a tool (the best would be an Ida plugin) that can search files in a folder for a known hash (md5/sha1 etc.) and encryption (aes /rsa etc.).
I know an Ida plugin called FindCrypt2 but ...
1
vote
2answers
1k views
How to load a color theme correctly in IDAPro?
I work late nights and a dark theme like this would be nice with IDAPro.
I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
1
vote
0answers
80 views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
0
votes
2answers
778 views
How to identify base64 encode/decode in assembly
How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that?
FindCrypt2 Ida plugin not find that
1
vote
1answer
407 views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...
3
votes
1answer
340 views
IDA 7.0 - combine sequence of assembly instructions to a macro
I'm solving this CTF with IDA Pro 7.0.
At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it.
The main problems are:
the ...
3
votes
1answer
375 views
Point-to analysis of IDA Pro
I am aware that many users on this forum are experts (developers) of IDA Pro. So I am tentatively inquiring some high-level ideas behind the point-to analysis of IDA Pro.
According to my personal ...
1
vote
1answer
2k views
How to find V-Table in IDA? (Using class informer)
I've been trying for a while now to get my head around V-Tables, V-Table patching, etc, i understand what V-Tables are and why they are used (At least i think i do).
But how do i find them in IDA? I'...
-2
votes
1answer
1k views
How to install ida plugin to identify encryption function
I saw here How to identify known encryption algorithm? the IDA plugin https://github.com/nihilus/IDA_Signsrch
I don't understand how to install it .
In the INSTALL I saw coppy the plug-in and ...
-1
votes
1answer
541 views
Install and configure script language bar on IDA from IDC to Python
I'm new in the field of reverse engineering to detect malicious code in ELF file.
I installed IDA on Ubuntu (https://www.hex-rays.com/products/ida/support/download_freeware.shtml) then follow guide ...
4
votes
0answers
386 views
IDAPRO from command line interface: Exporting IDB file to BINEXPORT file
I'm trying to convert my IDB files to BINEXPORT files using the following command that has been advised in many similar questions:
"<path-to-idaq.exe>" -A -OExporterModule:<result-...
1
vote
0answers
201 views
Getting R6034 error message when starting IDA Pro
I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
1
vote
1answer
217 views
De-obfuscation - Emulation-oriented vs Script-oriented
What are the advantages of each method when employing de-obsfucation of potentially malicious code?
I've been told to always use emulators like x86emu since it doesn't actually run the code when ...
1
vote
1answer
86 views
IDA SDK: Event when database created / opened?
I'm writing a plugin which is available at all times (PLUGIN_FIX flag).
However, I also need to be notified when a database is created or opened, as if I would handle the moment when init() is called ...
-1
votes
1answer
369 views
Dis-assamble .exe file to .asm in IDA Python [closed]
I have 5K .exe files from different sources like C and C++. I want to Dis-assamble them into .asm file using IDA Python. Consider this .exe file opened in IDA with text view:
I want this "Assembly" ...
-2
votes
1answer
425 views
(Hex-Rays) How to define C macro?
Im want create reverse macro for constant integers, how i can do it?
Example:
#define MU_ITEM(x, y) (x * 512 + y)
My goal is make result of number format like: before & after.
2
votes
1answer
863 views
Identify the porcessor type of a binary
There are different ways to identify the processor type such as using IDA or file command in Linux. But sometimes the processor type is not detected by these tools. Besides I do not have the correct ...
2
votes
1answer
812 views
IDA PRO: Monitor variable during execution
I'm new with IDA. Say I have a variable which is created in some function and it is argument to other functions.
My question is how to monitor this variable? In monitor I mean is there any way to set ...
0
votes
1answer
250 views
Getting Xrefs to Windows Library Functions in IDA Pro
Ok so let's say that a program obfuscated its IAT and i can't see it in IDA Pro. In OllyDbg there is a plugin where you press Ctrl+G you can search for a library function and set a breakpoint even ...
1
vote
1answer
283 views
Recover Library Function ProtoType from IDA-Pro
I am working on a reverse engineering task, in which I need to recover function prototype (including number of parameters, type of each parameter) from the input binary (ELF binary on 64-bit Linux).
...
1
vote
1answer
191 views
How to get API name from address in registry value in IDA plugin
For example I have eax 7c9100a4 -> ntdll.RtlCreateHeap
I can get reg value in my plugin but I can't get the api name
How can get the correct api name from the address?
2
votes
1answer
809 views
IDAPython: Change struct member content name
tl;dr
I have an array of structs, I'd like to iterate over it and change fields content, (name, values), upon simple conditions.
I can get the offset of the members, but I can't modify them due to the ...
-1
votes
2answers
150 views
Incorrect semicolon usage in decompiled variables
My problem is: hexrays thinks that semicolon is visible character.
In IDAPython idaapi.is_visible_char(';') returns True
In picture you can see "field_100C;" highlighted, but "field_100C" not ...
2
votes
1answer
1k views
Batch mode of ida pro 6.5
i have tried almost all links about batch mode.
My Question is that i did not get the user manual about batch mode of ida pro that how can i use the commands like -c -A -B and how i can run script on ...
0
votes
1answer
192 views
How can i rename Array to API Name in IDAPro?
I am studying to analysis malware..
While to analysis a malware using IDA, I want to rename array to API Name.
To Help your understanding, attached image.
Please help.
Thank you
3
votes
2answers
2k views
How can I call IDA Pro's MakeCode for one instruction at a time?
I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately.
I ...
0
votes
1answer
780 views
Variable mapping in IDA hotkey change
Is there a way to change hotkey for variable mapping ('=' by default)? For example: I'd like to bind it to 'Shift+Q'.
0
votes
1answer
500 views
Is there any IDA plugin to display AST?
Hex Ray has introduced a decompiler API as part of IDA v6.6. Is there any plugin which displays the detail Abstract Syntax Tree (AST) produced by the decompiler graphically?
I want something like ...
0
votes
1answer
595 views
Dynamic Analysis Detection
Suppose you want to conceal an application's true purpose from analysts by reacting to dynamic analysis tools. How is it possible to detect running (in debugger mode) the application under a reverse ...
6
votes
1answer
8k views
How can I set breakpoint and get value of a register with IDApython
How can I set a breakpoint and get the value of the EAX register with IDApython?
I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
2answers
2k views
How to Find All Switch Jump Tables in IDAPython
I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly:
jmp ds:off_65018790[ecx*4] ; switch jump
...
4
votes
1answer
7k views
Executing an IDAPython script with arguments within IDA Pro
I have an IDAPython script x.py which takes some arguments, which prevents me from simply using alt + F7 and selecting my script.
How can I execute this script within IDA Pro and specify the ...
0
votes
1answer
2k views
How can I export a struct in IDA Pro to a c-style struct?
I have a struct in IDA Pro that I want to export to a c-style struct. For example:
00000000 ICreateErrorInfo struc ; (sizeof=0x4, align=0x4, standard type)
00000000 ...
1
vote
1answer
590 views
Find cryptography used by iOS applications by analyzing ARM assembly in IDA?
I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
4
votes
1answer
2k views
IDA Pro Plugin to add x64dbg
Is there a plugin for IDA Pro to enable me to add x64dbg debugger support to IDA Pro 6.8 or 6.9?
2
votes
1answer
1k views
Hex-Rays and IDA Python plugin loading order
I have made a plugin (using IDA Python) that requires the Hex-Rays plugin.
As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
2
votes
1answer
872 views
Obtaining the Pseudocode of a function via a script
I am looking for a way to obtain the pseudocode of a function via a script. I am using IDAPro 6.9 on OS X 10.11.4 (El Capitan).
I did locate this documentation on using the decompiler in batch mode:
...
