Questions tagged [ida-plugin]
Refer to any programs specifically designed to be a plugin of IDA Pro.
166
questions
0
votes
0
answers
29
views
Automatically rename known functions from libraries in IDA
I have a binary file written in c and c++ which uses some libraries. The C/C++ source code of these libraries is publicly accessible online (github). Is there a way in IDA to somehow import this ...
1
vote
2
answers
69
views
Restoring original stack variable in IDA Pro?
I would like to convert an instruction like:
lea ecx, [esp+150h+var_13E+2]
to:
lea ecx, [esp+14h]
I know it's possible to do this with the key K. But I'm writing an IDAPython plugin that needs ...
4
votes
2
answers
5k
views
ea_t datatype in IDA API
In IDAPython, what is the ea_t data type? It is used in the set_debug_name() function as follows:
bool set_debug_name(ea, name)
If I have a 64-bits address, can it be represented by the ea_t data ...
0
votes
0
answers
54
views
Hex-View in IDA [TMS320C3x]
For the target processor TMS320C3x, IDA does not display all data in HEX-VIEW as ASCII,
only every 4th byte.
The minimum addressable data block for this target processor is a 32-bit word.
It seems ...
- 96
0
votes
2
answers
193
views
How to make a plugin python function available to IDA's console?
I want to have utility functions shared between all databases, for example:
from idautils import *
from idaapi import *
from idc import *
from ida_name import *
def FindFunctionImpl(...
- 9,198
0
votes
0
answers
68
views
Import function symbols from a reflection system into IDA
I'd like to import structs and functions from a reflection system into IDA.
The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
- 356
0
votes
0
answers
88
views
IDA python : display not refreshing function parameters after type update
I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :)
The issue :
I have a ...
- 1
1
vote
0
answers
133
views
Log functions called in IDA Pro?
When I run an exe in IDA how could I log which functions were called into a text file?
log.txt:
call func1
call func2
call func1
call func1
Not worried about indirect calls.
This is for differential ...
- 11
1
vote
2
answers
2k
views
Get current file name with IDApython
I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that.
the closest things ...
- 10.9k
1
vote
1
answer
153
views
How to call the Color Picker window in Ida Pro from a script?
I'm going to make a python script that allows you to color selected functions - in the right colors.
To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
- 10.9k
2
votes
0
answers
65
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 267
3
votes
1
answer
125
views
How to highlight all external registers in a function
What I want:
detect all potentially usercall, userpurge - functions;
when entering the function, immediately see all external entities:
arguments passed through registers;
i.e., in order not to ...
- 9,198
2
votes
1
answer
5k
views
Using Python 3.7 and 2.x in same IDA
I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7.
Is there any way to run that Python 2.7 based plugin?
- 36.9k
2
votes
1
answer
136
views
Infer function parameter types from caller argument type in IDA
So i have the following code:
struct my_struct_t var1;
fun(var1);
I don't have the symbols for fun's parameter type but since it's called with an argument with type my_struct i would want IDA to ...
CommunityBot
- 1
2
votes
0
answers
60
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
- 111
3
votes
0
answers
172
views
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
- 111
2
votes
0
answers
60
views
Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?
Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:
mov rax, cs:KeDelayExecutionThrea
lea r8, [rsp+28h+arg_0]
xor edx, ...
- 518
2
votes
1
answer
98
views
Is it possible to tap into IDAPython from within a (C) plugin? ... or at least use that Python instance?
I'm wondering whether it is possible to write a plugin for IDA and/or Hex-Rays which would use Python callbacks to perform certain tasks.
In particular I am wondering if there is an official way to ...
- 10.9k
3
votes
3
answers
1k
views
IDA plugin with visual studio c++ 2019
Hello all and sorry for my bad English
I am trying to test an example for developing plugin in C++ with IDA from the book :
http://www.binarypool.com/idapluginwriting/idapw.pdf
I am using Visual c++ ...
- 10.9k
2
votes
1
answer
379
views
IDA API: Writing a plugin - How can I ensure that analysis has completed?
I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish.
get_auto_state
auto_wait
auto_is_ok
Looking at the API if ...
CommunityBot
- 1
3
votes
0
answers
329
views
What computer components improve the speed of disassembly in IDA Pro and plugins like BinDiff?
I’m disassembling binaries in IDA Pro.
It usually takes 15+ minutes just to pre-process/open one binary,
Then another 20-30 min before IDA is fully done disassembling and finally becomes idle.
...
- 267
4
votes
0
answers
613
views
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.
Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.
refer:...
- 10.9k
2
votes
0
answers
312
views
IDA api: get function argument definition
So let's say we have the following code:
0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
- 41
1
vote
0
answers
20
views
How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
- 113
1
vote
1
answer
471
views
How to clear all comments created in ida using funcap?
How to clear the comments created by funcap and restore database to it's previous state?
I tried reanalyzing the program but comments do not seems to go away from database.
Though, checking-off ...
- 461
2
votes
1
answer
890
views
Load to Ida binary with all of SO
I have a Linux ARM binary with a lot of shared libraries.
Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
- 428
1
vote
1
answer
464
views
Is there any way to apply FLIRT signatures through a script like idapython?
I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
- 3,429
1
vote
0
answers
6k
views
How to change IDA to use Python 3.7 and not Python 2.7: "do not have the x86_64 architecture"
I have IDA 6.95, Python 2.7 and Python 3.7.
Currently when I start IDA it uses Python 2.7:
-----------------------------------------------------------------------------------------
Python 2.7.12 (v2.7....
1
vote
1
answer
428
views
Custom IDA Decompilation Coloring
Is there a way to customize the coloring of IDA's decompiled code?
IDA -> Options -> Colors -> Syntax doesn't seem to affect the coloring of decompilation.
- 9,198
3
votes
2
answers
3k
views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
- 168
0
votes
1
answer
3k
views
(IDAPython)How to get the function name string from the Function address?
For example, in the Registers windows of IDA pro, It show the following.
( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.)
EAX 766D32B0 WS2_32.dll:...
- 103
1
vote
1
answer
143
views
Removing empty blocks ida api
i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues.
mba_t *mba;
mba->remove_empty_blocks();
It throws following error
"...
- 9,198
1
vote
1
answer
1k
views
How to get function signature using IDA Python in IDA Pro
I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names.
I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
CommunityBot
- 1
1
vote
1
answer
480
views
Analyze Arm Linux CPP binary in Ida Pro
I tried to open CPP binary with Ida. Most of the code analyze well .
The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
CommunityBot
- 1
1
vote
1
answer
268
views
Can I get loaded pdb file path from IDAPython?
IDA Pro can automatically download and load .pdb files from symbol server.
And now I want to write an IDAPython plugin to obtain some data from the .pdb file.
But I don't know how to get the file path ...
- 1,130
1
vote
1
answer
817
views
How is it possible to generate C++ class header from a .dll or ELF file?
I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
- 36.9k
2
votes
2
answers
4k
views
How to Find All Switch Jump Tables in IDAPython
I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly:
jmp ds:off_65018790[ecx*4] ; switch jump
...
- 103
2
votes
1
answer
496
views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
- 10.9k
2
votes
2
answers
1k
views
IDA PRO Hex-Rays try-catch
I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice.
I've been searching and it seems like IDA does not support them so I was wondering if there is ...
- 9,198
1
vote
1
answer
328
views
Display open handles in IDA pro, just like xdbg?
I want to know for example that if a ReadFile is happening and the handle number is 100, which file or whatever this handle belongs to?
lets assume for whatever reason i cannot trace CreateFiles to ...
- 176
1
vote
1
answer
188
views
Try to parse buffer as PE with IDAPython
file_buffer = requests.get(file_url)
buf_size = len(file_buffer)
pe_file = pefile.PE(data=file_buffer)
print("This is really a pe imphash %s." % pe_file.get_imphash())
addr = hex(id(...
CommunityBot
- 1
1
vote
3
answers
6k
views
How to load a color theme correctly in IDAPro?
I work late nights and a dark theme like this would be nice with IDAPro.
I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
- 101
1
vote
2
answers
754
views
How to parse the NT headers and section headers of a PE file using IDApython?
I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
- 320
0
votes
1
answer
427
views
how to call the function from IDAPython with passing arguments by manually push them to the stack
would you please tell me how to call the function from IDAPython code ?
I want to simulate it by manually push to stack as the two arguments and calling the function.
0
votes
1
answer
298
views
Is there any way to STOP the loop of the IDApython?
Is there any way to STOP the loop of the IDApython ?
I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
- 9,198
1
vote
3
answers
140
views
Identify APIs inside functions
I know it's a silly question 😂😂
I'm using IDA and I want to know if there is a plugin to identify all called APIs inside a function instead of entering each function manually?
- 76
3
votes
2
answers
3k
views
Hex-Rays and IDA Python plugin loading order
I have made a plugin (using IDA Python) that requires the Hex-Rays plugin.
As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
- 320
0
votes
1
answer
1k
views
Failed to load IDA PLW plugin
I am trying to install mIDA plugin for IDA.
I found a compiled PLW file here: https://github.com/sourceincite/tools/tree/master/pymsrpc/mIDA , downloaded it and saved it to C:\Program Files\IDA 7.0\...
- 36.9k
0
votes
1
answer
163
views
IDAPython, parse IDA DB as PE file [duplicate]
I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
- 31
1
vote
1
answer
1k
views
Find all syscall in statically Arm Binary
What is the easy and fast way to find all syscall in statically Arm binary ?
Is there any Ida plugin that do that?
CommunityBot
- 1