Questions tagged [idapro-sdk]
Software development kit of the IDAPro software suite, allow to develop processor modules, loaders and various extensions.
75
questions
9
votes
1
answer
905
views
How to get notified about IDA database events not covered in the IDA SDK?
In my previous question I had originally asked for this, but since this aspect of the question was completely disregarded, I feel compelled to ask it separately.
There are certain events apparently ...
- 10.9k
8
votes
2
answers
5k
views
idapython - Get Xrefs to a stack variable
I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so.
What I am trying to achieve is a code ...
- 337
8
votes
1
answer
3k
views
How is IDAPython API structured?
In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
- 1,351
6
votes
1
answer
560
views
A wiki for IDA? [closed]
Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the ...
- 2,010
6
votes
2
answers
370
views
How can my plugin get notified of anterior or posterior comments (and more) changes to an IDA database?
IDA Pro allows plugins to receive notifications for a number of events. These are defined in the hook_type_t enumeration inside loader.hpp in the SDK from what I saw. If I subscribe to HT_IDB events, ...
- 10.9k
5
votes
3
answers
3k
views
IDA Pro Renaming Imports
This PE file destroys its import address table. However, all the function addresses are in this _rdata segment here:
Any straight forward way to rename these functions?
- 81
5
votes
1
answer
2k
views
How to debug an IDA Pro plugin built with the C++ IDASDK
I'm building an IDA Pro plugin (not a script) using the C++ SDK. On top of the frustration added by the lack of a proper API documentation, I cannot find a good way to debug my plugin.
I've tried ...
- 828
5
votes
3
answers
5k
views
IDApython and IDA-decompiler commenting
Looking at the functions exposed by idaapi I see that functions like the following are exposed.
get_user_cmt
set_user_cmt
save_user_cmts
As these functions are exposed I'm hoping that I have a way ...
user1743
4
votes
2
answers
5k
views
How can I call IDA Pro's MakeCode for one instruction at a time?
I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately.
I ...
- 43
4
votes
2
answers
1k
views
IDA basic block type fcb_cndret - what does it mean?
IDA Pro's idaapi.BasicBlock objects returned by idaapi.FlowChart() can be of the following types (see gdl.hpp in the SDK sources):
// flow chart block types
enum fc_block_type_t
{
fcb_normal, // ...
- 1,540
4
votes
1
answer
4k
views
IDA Pro/IDA Python, producing file via terminal
I am using IDA Pro 6.5 and running it via terminal with the following command line switches:
-B (to run in batch mode, should automatically generate a .asm file containing results)
-S running a ...
- 495
4
votes
4
answers
2k
views
IDA: Generic approach to determine if an instruction reads from, or writes to, memory?
I would like to determine if an instruction a) reads from or b) writes to a memory address.
I can currently think of two approaches in IDA:
Looking for a list of mnemonics (better: particular opcodes?...
- 1,540
4
votes
1
answer
1k
views
Ida Plugin Batch analysis issue.
I overcame recent issues with a redefinition and finished my Plugin.
In short this plugin uses Hex-Rays Decompiler to decompile a given file, analyzes properties of the pseudocode and then appends ...
- 93
4
votes
1
answer
1k
views
Unload plugin without closing the .IDB?
IDC has a RunPlugin() function but there seems to be no way to unload a plugin explicitly. I searched high and wide - including the Hex-Rays forums - but found no answers. And judging by this post I'm ...
- 2,010
4
votes
1
answer
907
views
IDA IDC Get memory reference in instruction
How can I get the memory referenced in the first operand of the instruction:
mov [ebp+__GetProcAddress], eax ; I want to get 0x0133FD48
I want to do it while tracing over the code so the ...
- 149
3
votes
1
answer
7k
views
Idapython: How to get the opcode bytes corresponding to an instruction?
How do I get the 8B 45 FC corresponding to the mov eax, [rbp+var_4]
etc. via idapython?
I did not come up with a better solution than
Getting the instruction via idautils.DecodeInstruction()
...
- 1,540
3
votes
1
answer
2k
views
IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?
I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
- 1,073
3
votes
1
answer
819
views
How to get the file format via Idapython?
I am working on a reverse engineering project on android apk. I would like to check if the file being analyzed is a binary file such as .so file or elf file. Is it possible to get it from idapro?
- 31
3
votes
1
answer
2k
views
IDA Pro only recognizes my files as BINARY
I am trying to disassemble some various files, and IDA does not recognize them. Is there anyway to add more file types to IDA Pro? I am running ida 6.5
- 495
3
votes
2
answers
790
views
Force IDA to reanalyze a function recursively?
How can i force IDA to re analyze a function recursively (meaning including every function inside of it and so on) and recognize all the functions inside of all the functions? because right now when a ...
- 176
3
votes
1
answer
2k
views
32 bit vs 64 bit IDA Pro
I am confused on the differences between using 64 bit and 32 bit IDA versions on a 32 bit application.
If I use 64 bit IDA on the 32 bit application, will it make use of 64 bit or 32 bit architecture?
- 31
3
votes
0
answers
113
views
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
- 111
3
votes
0
answers
507
views
getting the flags of an IDA name
IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc).
So far all is good and ...
- 11.7k
3
votes
0
answers
97
views
Catch function flags change event in IDA plugin
Is there a way for plugin to understand that function flags were changed (e.g. through function-edit menu, by setting 'library' or 'static' flag)? There is idb_event::func_noret_changed, but seems it ...
- 131
2
votes
4
answers
6k
views
How to decompile with Hex Rays via a Python API?
If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python?
I see there is IDA Python
And I see Hex-rays has a C++ SDK
Is there a python Hex-...
- 125
2
votes
1
answer
150
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 123
2
votes
2
answers
241
views
How to get closing message from IDA Pro?
Is there any way to get SDK API message when Ida Pro is closing?
I write plug-in that connect with other application and I need to close connections when IDA is closing.
- 31
2
votes
1
answer
2k
views
Check for multiple strings in IDAPython
I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,"Bob") to ...
- 97
2
votes
1
answer
6k
views
Attaching debugger to process IDA Pro privilege problem
I am trying to attach the WinDBG to particular process but I constantly get the error below :
I am using win 7 x64 and am trying to debug x64 application.
I run the IDA Pro with admin privileges. I ...
- 619
2
votes
1
answer
2k
views
Compiling plugins for use with IDA 5.0 free?
Is there a tutorial somewhere on how to make plugins work with IDA 5.0 free?
Plugins built against the normal SDK libs don't work because the WLL of free IDA exports everything by ordinal and not by ...
- 2,010
2
votes
1
answer
86
views
Is it possible to tap into IDAPython from within a (C) plugin? ... or at least use that Python instance?
I'm wondering whether it is possible to write a plugin for IDA and/or Hex-Rays which would use Python callbacks to perform certain tasks.
In particular I am wondering if there is an official way to ...
- 10.9k
2
votes
1
answer
247
views
Names not populating from disassembly to decompiler
I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation.
I have never noticed this ...
2
votes
1
answer
798
views
Extracting instruction and operand information in IDA Python
I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
- 141
2
votes
2
answers
3k
views
How to Find All Switch Jump Tables in IDAPython
I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly:
jmp ds:off_65018790[ecx*4] ; switch jump
...
- 133
2
votes
1
answer
116
views
IDAPython's FlowChart wrong basic blocks
I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA.
As you ...
- 121
2
votes
1
answer
489
views
Issue with Hex-Ray's Decompiler Plugin, redefinition of 'vsscanf'
I am currently writing a plugin for the Hex-Ray's Decompiler to be used on IDA 6.2. The basic gist is that it is supposed to get the decompiled functions and run some automated analysis on it, nothing ...
- 93
2
votes
0
answers
49
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
- 111
2
votes
0
answers
38
views
Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?
Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:
mov rax, cs:KeDelayExecutionThrea
lea r8, [rsp+28h+arg_0]
xor edx, ...
- 519
2
votes
0
answers
46
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 519
2
votes
0
answers
203
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
2
votes
0
answers
61
views
Getting all instances of Local type in Ida
I create a local type in Ida and put in some places this local type.
How can I got all the references to dhat Local type?
1
vote
3
answers
579
views
IDA SDK Extract Offset From Instruction
get_screen_ea( ) is ==
.text:000000014000B065 mov cs:qword_142167D38, rcx
Is there a function in the SDK to extract qword_142167D38? Preferably as a hexadecimal value rather than a string.
- 81
1
vote
2
answers
2k
views
Get current file name with IDApython
I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that.
the closest things ...
- 519
1
vote
1
answer
116
views
IDA API: obtain operand size prefix (x64)
I am trying to tell apart the following two instructions:
8D 02 lea eax, [rdx] // auxfix = 0x1810
67 8D 02 lea eax, [edx] // auxfix = 0x810
The only difference is in the insn_t....
- 453
1
vote
1
answer
110
views
Removing empty blocks ida api
i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues.
mba_t *mba;
mba->remove_empty_blocks();
It throws following error
"...
- 73
1
vote
3
answers
2k
views
IDA SDK - Rename Variable permanently
I'm using ida 6.8 SDK and i have an problem with saving changed variables names,
I used many functions like set_reg_name(C++), setMemberName(in python),
they change the name but not permanently, ...
- 272
1
vote
1
answer
789
views
How can I force-update IDA's action_handler_t object's state?
context about action_handler_t
IDA provides multiple features and APIs to extend and enhance it's usability, one of those features is the creation of user defined action_handler_t objects by ...
- 11.7k
1
vote
1
answer
114
views
IDA SDK - can't understand the output of displacement query functions?
OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)):
//op is ...
- 455
1
vote
1
answer
173
views
Try to parse buffer as PE with IDAPython
file_buffer = requests.get(file_url)
buf_size = len(file_buffer)
pe_file = pefile.PE(data=file_buffer)
print("This is really a pe imphash %s." % pe_file.get_imphash())
addr = hex(id(...
- 39
1
vote
1
answer
2k
views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...