Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [idapro-sdk]

Software development kit of the IDAPro software suite, allow to develop processor modules, loaders and various extensions.

0
votes
2answers
117 views

What's happening in the assembly main function?

I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here. Where should I set the breakpoints (...
1
vote
0answers
47 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
1answer
52 views

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
1
vote
1answer
111 views

Can't find debugger in IDA PRO menu

I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files. This is an example when I didn't load any .exe: This is another example when ...
2
votes
2answers
102 views

How to get closing message from IDA Pro?

Is there any way to get SDK API message when Ida Pro is closing? I write plug-in that connect with other application and I need to close connections when IDA is closing.
0
votes
1answer
228 views

IDA SDK - Rename Variable permanently

I'm using ida 6.8 SDK and i have an problem with saving changed variables names, I used many functions like set_reg_name(C++), setMemberName(in python), they change the name but not permanently, ...
0
votes
1answer
350 views

How to force IDA pro to list some bytes as a specified instruction?

Please first read this My previous question, and then continue the following: **** The binary file size loaded into IDA is 0x1e400 = 123k, and when I try to only change the "Loading address" to ...
1
vote
1answer
56 views

IDA SDK: Event when database created / opened?

I'm writing a plugin which is available at all times (PLUGIN_FIX flag). However, I also need to be notified when a database is created or opened, as if I would handle the moment when init() is called ...
-2
votes
1answer
253 views

(Hex-Rays) How to define C macro?

Im want create reverse macro for constant integers, how i can do it? Example: #define MU_ITEM(x, y) (x * 512 + y) My goal is make result of number format like: before & after.
1
vote
0answers
306 views

Functions window empty for some ipa using ida pro

I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
2
votes
4answers
1k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
7
votes
2answers
2k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
2
votes
0answers
285 views

getting the flags of an IDA name

IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc). So far all is good and ...
4
votes
2answers
1k views

How can I call IDA Pro's MakeCode for one instruction at a time?

I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately. I ...
6
votes
1answer
2k views

How is IDAPython API structured?

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
3
votes
1answer
342 views

How to get the file format via Idapython?

I am working on a reverse engineering project on android apk. I would like to check if the file being analyzed is a binary file such as .so file or elf file. Is it possible to get it from idapro?
1
vote
1answer
341 views

How can I force-update IDA's action_handler_t object's state?

context about action_handler_t IDA provides multiple features and APIs to extend and enhance it's usability, one of those features is the creation of user defined action_handler_t objects by ...
1
vote
2answers
2k views

How to Find All Switch Jump Tables in IDAPython

I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly: jmp ds:off_65018790[ecx*4] ; switch jump ...
0
votes
1answer
368 views

Can I extract API call graph from IDA Pro to xml file?

I want to extract API call graph from IDA Pro to xml file for analysis. Can I extract API call graph from IDA Pro to xml file?
0
votes
2answers
580 views

IDA 6.8 SDK change calling convention

Is there any way to change the calling convention programmatically? I found some C++ code in this repo but wasn't able to successfully update it to 6.8. static bool idaapi convert_to_usercall(void *...
4
votes
1answer
310 views

IDA IDC Get memory reference in instruction

How can I get the memory referenced in the first operand of the instruction: mov [ebp+__GetProcAddress], eax ; I want to get 0x0133FD48 I want to do it while tracing over the code so the ...
1
vote
1answer
506 views

Check for multiple strings in IDAPython

I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,"Bob") to ...
4
votes
3answers
2k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
3
votes
3answers
1k views

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

I would like to determine if an instruction a) reads from or b) writes to a memory address. I can currently think of two approaches in IDA: Looking for a list of mnemonics (better: particular opcodes?...
2
votes
1answer
4k views

Idapython: How to get the opcode bytes corresponding to an instruction?

How do I get the 8B 45 FC corresponding to the mov eax, [rbp+var_4] etc. via idapython? I did not come up with a better solution than Getting the instruction via idautils.DecodeInstruction() ...
1
vote
1answer
182 views

IDA/Hexrays SDK: how to preserve lvar names?

Last night I was extending functionality of HexRaysCodeXplorer - implemented feature to automatically rename duplicating variables. It needs some fixes to work well, but the problem I cannot cope with ...
2
votes
1answer
3k views

Attaching debugger to process IDA Pro privilege problem

I am trying to attach the WinDBG to particular process but I constantly get the error below : I am using win 7 x64 and am trying to debug x64 application. I run the IDA Pro with admin privileges. I ...
3
votes
1answer
775 views

IDA basic block type fcb_cndret - what does it mean?

IDA Pro's idaapi.BasicBlock objects returned by idaapi.FlowChart() can be of the following types (see gdl.hpp in the SDK sources): // flow chart block types enum fc_block_type_t { fcb_normal, // ...
2
votes
1answer
1k views

Compiling plugins for use with IDA 5.0 free?

Is there a tutorial somewhere on how to make plugins work with IDA 5.0 free? Plugins built against the normal SDK libs don't work because the WLL of free IDA exports everything by ordinal and not by ...
6
votes
1answer
479 views

A wiki for IDA? [closed]

Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the ...
3
votes
1answer
369 views

Unload plugin without closing the .IDB?

IDC has a RunPlugin() function but there seems to be no way to unload a plugin explicitly. I searched high and wide - including the Hex-Rays forums - but found no answers. And judging by this post I'm ...
1
vote
3answers
373 views

IDA SDK Extract Offset From Instruction

get_screen_ea( ) is == .text:000000014000B065 mov cs:qword_142167D38, rcx Is there a function in the SDK to extract qword_142167D38? Preferably as a hexadecimal value rather than a string.
4
votes
1answer
896 views

How to debug an IDA Pro plugin built with the C++ IDASDK

I'm building an IDA Pro plugin (not a script) using the C++ SDK. On top of the frustration added by the lack of a proper API documentation, I cannot find a good way to debug my plugin. I've tried ...
5
votes
3answers
2k views

IDA Pro Renaming Imports

This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here: Any straight forward way to rename these functions?
3
votes
1answer
806 views

Ida Plugin Batch analysis issue.

I overcame recent issues with a redefinition and finished my Plugin. In short this plugin uses Hex-Rays Decompiler to decompile a given file, analyzes properties of the pseudocode and then appends ...
2
votes
1answer
441 views

Issue with Hex-Ray's Decompiler Plugin, redefinition of 'vsscanf'

I am currently writing a plugin for the Hex-Ray's Decompiler to be used on IDA 6.2. The basic gist is that it is supposed to get the decompiled functions and run some automated analysis on it, nothing ...
1
vote
0answers
470 views

How to map enum types to imm values in IDA

I have added support for type info handling in my IDA processor, and now in the use_regarg_type3 event, I am mapping a parameter that I know is an enum. But, I am unsure how to set an imm operand to ...
4
votes
1answer
2k views

IDA Pro/IDA Python, producing file via terminal

I am using IDA Pro 6.5 and running it via terminal with the following command line switches: -B (to run in batch mode, should automatically generate a .asm file containing results) -S running a ...
2
votes
1answer
962 views

IDA Pro only recognizes my files as BINARY

I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5
8
votes
1answer
735 views

How to get notified about IDA database events not covered in the IDA SDK?

In my previous question I had originally asked for this, but since this aspect of the question was completely disregarded, I feel compelled to ask it separately. There are certain events apparently ...
6
votes
2answers
296 views

How can my plugin get notified of anterior or posterior comments (and more) changes to an IDA database?

IDA Pro allows plugins to receive notifications for a number of events. These are defined in the hook_type_t enumeration inside loader.hpp in the SDK from what I saw. If I subscribe to HT_IDB events, ...