Skip to main content

Questions tagged [idapro-sdk]

Software development kit of the IDAPro software suite, allow to develop processor modules, loaders and various extensions.

Filter by
Sorted by
Tagged with
9 votes
1 answer
931 views

How to get notified about IDA database events not covered in the IDA SDK?

In my previous question I had originally asked for this, but since this aspect of the question was completely disregarded, I feel compelled to ask it separately. There are certain events apparently ...
0xC0000022L's user avatar
  • 10.9k
8 votes
2 answers
5k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
Aviv's user avatar
  • 337
8 votes
1 answer
3k views

How is IDAPython API structured?

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
sherlock's user avatar
  • 1,381
6 votes
1 answer
561 views

A wiki for IDA? [closed]

Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the ...
DarthGizka's user avatar
  • 2,010
6 votes
2 answers
395 views

How can my plugin get notified of anterior or posterior comments (and more) changes to an IDA database?

IDA Pro allows plugins to receive notifications for a number of events. These are defined in the hook_type_t enumeration inside loader.hpp in the SDK from what I saw. If I subscribe to HT_IDB events, ...
0xC0000022L's user avatar
  • 10.9k
5 votes
3 answers
3k views

IDA Pro Renaming Imports

This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here: Any straight forward way to rename these functions?
IChooseYou's user avatar
5 votes
1 answer
2k views

How to debug an IDA Pro plugin built with the C++ IDASDK

I'm building an IDA Pro plugin (not a script) using the C++ SDK. On top of the frustration added by the lack of a proper API documentation, I cannot find a good way to debug my plugin. I've tried ...
Benny's user avatar
  • 828
5 votes
3 answers
5k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
user avatar
4 votes
2 answers
6k views

How can I call IDA Pro's MakeCode for one instruction at a time?

I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately. I ...
ida_user_200's user avatar
4 votes
2 answers
1k views

IDA basic block type fcb_cndret - what does it mean?

IDA Pro's idaapi.BasicBlock objects returned by idaapi.FlowChart() can be of the following types (see gdl.hpp in the SDK sources): // flow chart block types enum fc_block_type_t { fcb_normal, // ...
langlauf.io's user avatar
  • 1,560
4 votes
1 answer
4k views

IDA Pro/IDA Python, producing file via terminal

I am using IDA Pro 6.5 and running it via terminal with the following command line switches: -B (to run in batch mode, should automatically generate a .asm file containing results) -S running a ...
user3119546's user avatar
4 votes
4 answers
2k views

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

I would like to determine if an instruction a) reads from or b) writes to a memory address. I can currently think of two approaches in IDA: Looking for a list of mnemonics (better: particular opcodes?...
langlauf.io's user avatar
  • 1,560
4 votes
1 answer
1k views

Ida Plugin Batch analysis issue.

I overcame recent issues with a redefinition and finished my Plugin. In short this plugin uses Hex-Rays Decompiler to decompile a given file, analyzes properties of the pseudocode and then appends ...
Viktor K's user avatar
4 votes
1 answer
1k views

Unload plugin without closing the .IDB?

IDC has a RunPlugin() function but there seems to be no way to unload a plugin explicitly. I searched high and wide - including the Hex-Rays forums - but found no answers. And judging by this post I'm ...
DarthGizka's user avatar
  • 2,010
4 votes
1 answer
2k views

32 bit vs 64 bit IDA Pro

I am confused on the differences between using 64 bit and 32 bit IDA versions on a 32 bit application. If I use 64 bit IDA on the 32 bit application, will it make use of 64 bit or 32 bit architecture?
bonijad383's user avatar
4 votes
1 answer
968 views

IDA IDC Get memory reference in instruction

How can I get the memory referenced in the first operand of the instruction: mov [ebp+__GetProcAddress], eax ; I want to get 0x0133FD48 I want to do it while tracing over the code so the ...
user1618465's user avatar
3 votes
1 answer
7k views

Idapython: How to get the opcode bytes corresponding to an instruction?

How do I get the 8B 45 FC corresponding to the mov eax, [rbp+var_4] etc. via idapython? I did not come up with a better solution than Getting the instruction via idautils.DecodeInstruction() ...
langlauf.io's user avatar
  • 1,560
3 votes
1 answer
3k views

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
Ray's user avatar
  • 1,103
3 votes
1 answer
888 views

How to get the file format via Idapython?

I am working on a reverse engineering project on android apk. I would like to check if the file being analyzed is a binary file such as .so file or elf file. Is it possible to get it from idapro?
wesley's user avatar
  • 31
3 votes
1 answer
2k views

IDA Pro only recognizes my files as BINARY

I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5
user3119546's user avatar
3 votes
2 answers
1k views

Force IDA to reanalyze a function recursively?

How can i force IDA to re analyze a function recursively (meaning including every function inside of it and so on) and recognize all the functions inside of all the functions? because right now when a ...
Notoriouss's user avatar
3 votes
0 answers
170 views

IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?

I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
none32's user avatar
  • 111
3 votes
0 answers
535 views

getting the flags of an IDA name

IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc). So far all is good and ...
NirIzr's user avatar
  • 11.8k
3 votes
0 answers
97 views

Catch function flags change event in IDA plugin

Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it ...
ov7a's user avatar
  • 131
2 votes
4 answers
7k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
chris's user avatar
  • 125
2 votes
1 answer
449 views

IDA: Demangled name simplification in idapython

With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them. For example, the following function: Python> ida_name.demangle_name(idc....
Blub's user avatar
  • 123
2 votes
2 answers
252 views

How to get closing message from IDA Pro?

Is there any way to get SDK API message when Ida Pro is closing? I write plug-in that connect with other application and I need to close connections when IDA is closing.
tanitrielle's user avatar
2 votes
1 answer
2k views

Check for multiple strings in IDAPython

I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,"Bob") to ...
Eccmms's user avatar
  • 97
2 votes
1 answer
7k views

Attaching debugger to process IDA Pro privilege problem

I am trying to attach the WinDBG to particular process but I constantly get the error below : I am using win 7 x64 and am trying to debug x64 application. I run the IDA Pro with admin privileges. I ...
FreeMind's user avatar
  • 639
2 votes
1 answer
2k views

Compiling plugins for use with IDA 5.0 free?

Is there a tutorial somewhere on how to make plugins work with IDA 5.0 free? Plugins built against the normal SDK libs don't work because the WLL of free IDA exports everything by ordinal and not by ...
DarthGizka's user avatar
  • 2,010
2 votes
1 answer
98 views

Is it possible to tap into IDAPython from within a (C) plugin? ... or at least use that Python instance?

I'm wondering whether it is possible to write a plugin for IDA and/or Hex-Rays which would use Python callbacks to perform certain tasks. In particular I am wondering if there is an official way to ...
0xC0000022L's user avatar
  • 10.9k
2 votes
1 answer
347 views

Names not populating from disassembly to decompiler

I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation. I have never noticed this ...
lotsaquestions's user avatar
2 votes
1 answer
915 views

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
Ranganatha Rao's user avatar
2 votes
2 answers
4k views

How to Find All Switch Jump Tables in IDAPython

I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly: jmp ds:off_65018790[ecx*4] ; switch jump ...
Alex's user avatar
  • 133
2 votes
1 answer
210 views

IDAPython's FlowChart wrong basic blocks

I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA. As you ...
Luca's user avatar
  • 121
2 votes
1 answer
502 views

Issue with Hex-Ray's Decompiler Plugin, redefinition of 'vsscanf'

I am currently writing a plugin for the Hex-Ray's Decompiler to be used on IDA 6.2. The basic gist is that it is supposed to get the decompiled functions and run some automated analysis on it, nothing ...
Viktor K's user avatar
2 votes
0 answers
58 views

Is it possible to create nested memory mapped registers in IDA Processor Modules?

Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
none32's user avatar
  • 111
2 votes
0 answers
59 views

Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?

Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following: mov rax, cs:KeDelayExecutionThrea lea r8, [rsp+28h+arg_0] xor edx, ...
OneAndOnly's user avatar
2 votes
0 answers
65 views

Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)

Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
OneAndOnly's user avatar
2 votes
0 answers
231 views

Convert instructions to op code bytes in python script for IDA Pro

I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work. This is my python ...
Luca's user avatar
  • 121
2 votes
0 answers
117 views

Getting all instances of Local type in Ida

I create a local type in Ida and put in some places this local type. How can I got all the references to dhat Local type?
yfr24493AzzrggAcom's user avatar
1 vote
3 answers
595 views

IDA SDK Extract Offset From Instruction

get_screen_ea( ) is == .text:000000014000B065 mov cs:qword_142167D38, rcx Is there a function in the SDK to extract qword_142167D38? Preferably as a hexadecimal value rather than a string.
IChooseYou's user avatar
1 vote
2 answers
2k views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...
OneAndOnly's user avatar
1 vote
1 answer
135 views

IDA API: obtain operand size prefix (x64)

I am trying to tell apart the following two instructions: 8D 02 lea eax, [rdx] // auxfix = 0x1810 67 8D 02 lea eax, [edx] // auxfix = 0x810 The only difference is in the insn_t....
bernd feinman's user avatar
1 vote
1 answer
138 views

Removing empty blocks ida api

i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues. mba_t *mba; mba->remove_empty_blocks(); It throws following error "...
Ronny's user avatar
  • 73
1 vote
3 answers
2k views

IDA SDK - Rename Variable permanently

I'm using ida 6.8 SDK and i have an problem with saving changed variables names, I used many functions like set_reg_name(C++), setMemberName(in python), they change the name but not permanently, ...
LighFusion's user avatar
1 vote
1 answer
828 views

How can I force-update IDA's action_handler_t object's state?

context about action_handler_t IDA provides multiple features and APIs to extend and enhance it's usability, one of those features is the creation of user defined action_handler_t objects by ...
NirIzr's user avatar
  • 11.8k
1 vote
1 answer
120 views

IDA SDK - can't understand the output of displacement query functions?

OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)): //op is ...
rec's user avatar
  • 475
1 vote
1 answer
184 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
BlackRussian's user avatar
1 vote
1 answer
2k views

Can't find debugger in IDA PRO menu

I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files. This is an example when I didn't load any .exe: This is another example when ...
Adrian Hernando Solanas's user avatar