Questions tagged [idapro-sdk]
Software development kit of the IDAPro software suite, allow to develop processor modules, loaders and various extensions.
75
questions
2
votes
1
answer
226
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 123
1
vote
1
answer
146
views
IDAPython doesn't recognize function
I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
- 121
2
votes
0
answers
50
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
- 111
2
votes
0
answers
42
views
Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?
Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:
mov rax, cs:KeDelayExecutionThrea
lea r8, [rsp+28h+arg_0]
xor edx, ...
- 519
2
votes
0
answers
53
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 519
3
votes
0
answers
141
views
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
- 111
2
votes
1
answer
157
views
IDAPython's FlowChart wrong basic blocks
I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA.
As you ...
- 121
2
votes
1
answer
88
views
Is it possible to tap into IDAPython from within a (C) plugin? ... or at least use that Python instance?
I'm wondering whether it is possible to write a plugin for IDA and/or Hex-Rays which would use Python callbacks to perform certain tasks.
In particular I am wondering if there is an official way to ...
- 10.9k
2
votes
0
answers
212
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
1
vote
1
answer
123
views
IDA API: obtain operand size prefix (x64)
I am trying to tell apart the following two instructions:
8D 02 lea eax, [rdx] // auxfix = 0x1810
67 8D 02 lea eax, [edx] // auxfix = 0x810
The only difference is in the insn_t....
- 463
1
vote
1
answer
117
views
Removing empty blocks ida api
i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues.
mba_t *mba;
mba->remove_empty_blocks();
It throws following error
"...
- 73
1
vote
1
answer
555
views
How to force IDA to analyze a function immediately? [duplicate]
I think my question is probably related to this one:
API to force reanalyze of function (Alt-P)
When I define a function at a certain location with IDAPython, I want IDA to analyze it immediately, ...
1
vote
1
answer
255
views
Display open handles in IDA pro, just like xdbg?
I want to know for example that if a ReadFile is happening and the handle number is 100, which file or whatever this handle belongs to?
lets assume for whatever reason i cannot trace CreateFiles to ...
- 176
3
votes
1
answer
2k
views
32 bit vs 64 bit IDA Pro
I am confused on the differences between using 64 bit and 32 bit IDA versions on a 32 bit application.
If I use 64 bit IDA on the 32 bit application, will it make use of 64 bit or 32 bit architecture?
- 31
2
votes
0
answers
81
views
Getting all instances of Local type in Ida
I create a local type in Ida and put in some places this local type.
How can I got all the references to dhat Local type?
3
votes
2
answers
903
views
Force IDA to reanalyze a function recursively?
How can i force IDA to re analyze a function recursively (meaning including every function inside of it and so on) and recognize all the functions inside of all the functions? because right now when a ...
- 176
1
vote
0
answers
131
views
How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?
Lets say there is a variable x in f1, and f1 calls f2 with the variable x
I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
- 176
0
votes
2
answers
3k
views
Import header files in IDA to get the struct definitions?
I am reversing a program that has a lot of internal structs in it.
The problem is that there are a lot of structs, so i can't import them manually using local types->insert.
Lets say i have some ...
- 519
1
vote
0
answers
48
views
How to replace a segment with a single structure consisting of the data in that segment - programmatically?
So I have something like this (I copied this from my other plugin functionality which simply creates a copy paste structure from the frame containing stack variables, while deleting them and then ...
- 455
0
votes
0
answers
69
views
Is there a way to aid the IDA decompiling process?
I want to make all local variables contained in a structure with appropriate padding put in the gaps (unused parts of the frame). I want to do the same for the global data. And I want to rename ...
- 455
1
vote
1
answer
118
views
IDA SDK - can't understand the output of displacement query functions?
OK so I want to parse x86 instructions with IDA SDK. However I can't understand the output, I have this code (that is executed after decode_insn at each operand that is present (type not 0)):
//op is ...
- 455
1
vote
1
answer
282
views
How to retrieve an `insn_t`?
So I was looking around the IDA SDK and I saw insn_t - it looked useful - any ideas how can I retrieve it - I wasn't able to find any function that returns it.
- 455
0
votes
0
answers
54
views
IDAPython NtCreateFile
Let's say I want to print the filenames on every call to NtCreateFile
(With %any% exe loaded in IDA )
The first problem is to get the ntdll!NtCreateFile address
Tried to do it like this ...
- 1
0
votes
1
answer
150
views
IDAPython, parse IDA DB as PE file [duplicate]
I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
- 39
1
vote
1
answer
175
views
Try to parse buffer as PE with IDAPython
file_buffer = requests.get(file_url)
buf_size = len(file_buffer)
pe_file = pefile.PE(data=file_buffer)
print("This is really a pe imphash %s." % pe_file.get_imphash())
addr = hex(id(...
- 39
1
vote
1
answer
544
views
Get a networkx graph from the the function call-graph of the file using IDApython?
Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
- 519
1
vote
2
answers
2k
views
Get current file name with IDApython
I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that.
the closest things ...
- 519
1
vote
1
answer
486
views
IDAPython: idaapi.get_highlight for demangled names
I'm using the following code to get the address of the selected function/variable:
hightlight = idaapi.get_highlight(idaapi.get_current_viewer())
screen_ea = idaapi.get_screen_ea()
ea = idaapi....
- 33
2
votes
1
answer
278
views
Names not populating from disassembly to decompiler
I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation.
I have never noticed this ...
1
vote
1
answer
330
views
IDA Pro SDK APIs inf.is_64bit() and inf.is_32bit() are not working as expected!
As per this already answered question How to get the CPU architecture via Idapython?, for reasons I'm unable to figure out, both inf.is_64bit() and inf.is_32bit() are not working for me. I'm using IDA ...
- 21
2
votes
1
answer
863
views
Extracting instruction and operand information in IDA Python
I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
- 141
0
votes
2
answers
1k
views
What's happening in the assembly main function?
I'm currently inspecting a 32-bit malware executable in a WinXP VM using IDA Pro (free version). I don't understand what's happening in the main function here.
Where should I set the breakpoints (...
- 96
1
vote
0
answers
184
views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
3
votes
1
answer
2k
views
IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?
I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
- 1,083
1
vote
1
answer
2k
views
Can't find debugger in IDA PRO menu
I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files.
This is an example when I didn't load any .exe:
This is another example when ...
1
vote
0
answers
764
views
IDA SDK: How to add a struct (pointer) field to a struct?
I'm new to the IDA 7.0 SDK, trying to automate creating structs to represent a C++ (MSVC) class in IDA with a plugin. For this, I create 3 structs as follows:
00000000 SomeClass struc
00000000 ...
- 1,083
0
votes
0
answers
342
views
How to get index register from the instruction in IDA?
I have the instruction:
add edx, ds:dword_7BFC7A50[eax*4]
i.e.
add edx, [eax*4+7BFC7A50h]
And I decode it via decode_insn(). Then I try to get the information about the second operand. I ...
- 1,840
2
votes
2
answers
245
views
How to get closing message from IDA Pro?
Is there any way to get SDK API message when Ida Pro is closing?
I write plug-in that connect with other application and I need to close connections when IDA is closing.
- 31
1
vote
3
answers
2k
views
IDA SDK - Rename Variable permanently
I'm using ida 6.8 SDK and i have an problem with saving changed variables names,
I used many functions like set_reg_name(C++), setMemberName(in python),
they change the name but not permanently, ...
- 272
1
vote
1
answer
2k
views
How to force IDA pro to list some bytes as a specified instruction?
Please first read this My previous question, and then continue the following:
****
The binary file size loaded into IDA is 0x1e400 = 123k, and when I try to only change the "Loading address" to ...
1
vote
1
answer
123
views
IDA SDK: Event when database created / opened?
I'm writing a plugin which is available at all times (PLUGIN_FIX flag).
However, I also need to be notified when a database is created or opened, as if I would handle the moment when init() is called ...
- 1,083
-2
votes
1
answer
932
views
(Hex-Rays) How to define C macro?
Im want create reverse macro for constant integers, how i can do it?
Example:
#define MU_ITEM(x, y) (x * 512 + y)
My goal is make result of number format like: before & after.
- 11
1
vote
0
answers
844
views
Functions window empty for some ipa using ida pro
I suddenly noticed that my c file produced by ida pro for some of the ipa files is zero bytes. However, I'm able to decompile other ipa files, but I got some which is not being decompiled properly it ...
- 233
2
votes
4
answers
6k
views
How to decompile with Hex Rays via a Python API?
If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python?
I see there is IDA Python
And I see Hex-rays has a C++ SDK
Is there a python Hex-...
- 125
8
votes
2
answers
5k
views
idapython - Get Xrefs to a stack variable
I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so.
What I am trying to achieve is a code ...
- 337
3
votes
0
answers
516
views
getting the flags of an IDA name
IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc).
So far all is good and ...
- 11.7k
4
votes
2
answers
5k
views
How can I call IDA Pro's MakeCode for one instruction at a time?
I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately.
I ...
- 43
8
votes
1
answer
3k
views
How is IDAPython API structured?
In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
- 1,371
3
votes
1
answer
841
views
How to get the file format via Idapython?
I am working on a reverse engineering project on android apk. I would like to check if the file being analyzed is a binary file such as .so file or elf file. Is it possible to get it from idapro?
- 31
1
vote
1
answer
806
views
How can I force-update IDA's action_handler_t object's state?
context about action_handler_t
IDA provides multiple features and APIs to extend and enhance it's usability, one of those features is the creation of user defined action_handler_t objects by ...
- 11.7k