Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
0
votes
0answers
12 views

BaseHTTPRequestHandler + ThreadingMixin = unclosed port

In developing a RESTful API for IDA >= 7.5 [https://github.com/sfinktah/idarest75], I have observed that a standard threaded webserver does not release it's socket when IDA terminates, unless it is ...
0
votes
1answer
28 views

Creating table with IDAPython

I'd like to create the table like below, I could not found any clue while googling it. Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class? Any advises would ...
1
vote
0answers
29 views

How to print a manually defined struct in IDA pro while debugging?

Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members. Now if i have the variables'...
0
votes
1answer
29 views

Undo step with IdaPython?

With Ida I can press Control+Z to undo the last action Can I do that with IdaPython?
0
votes
0answers
44 views

IDAPython: error executing init.py:

When I open Ida Pro 7.3 I see an error message IDAPython: error executing init.py: nothing to repeat Refer to the message window to see the full error log. How can I understand what is the problem? ...
0
votes
0answers
24 views

Get first and last address of binary with IdaPython

How can I get the first and last address of binary with IdaPython?
0
votes
1answer
54 views

Add python to Ida Pro 7.3

I have Ida Pro 7.3 but in the bottom of windwos I see that I can run only IDC script. How can I add Python to Ida , So I can run Python script via IDA ?
0
votes
0answers
29 views

IDA Python global name 'idaapi' is not defined

I have IDA 7.2 and Python 2.7 installed. If I just have one file BaseImagePrinter.py like this: class BaseImagePrinter: def __init__(self): self.imageBase = idaapi.get_imagebase() ...
0
votes
0answers
29 views

How to get symbol in IDA like done in BN code

I am converting BN code into IDA Pro and stuck at this point, following are lines in the code which gives the symbol call #####Get call symbol (if it exists) dr.get_symbol(inst.tokens) and ####### ...
1
vote
0answers
28 views

Passing a pointer to a pointer to a string with IDA Pro's Appcall

I need to call an encryption function in a program with the following signature (the second argument is returned): char** __usercall decode(char** input, char** output) As far as I can tell, Appcall ...
1
vote
0answers
52 views

IDA script: How to properly undefine a byte and then redefine code

I'm trying to correct the following instructions in IDA using a script: jnb short near ptr loc_1C61B1+3 It order to do this I'm running a snippet like this in a script: ida_bytes.del_value(...
0
votes
0answers
42 views

Reconstructing "relative" import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
0
votes
0answers
38 views

Basic Block generated by IDAPython code are different compared to BN generated output file

I have a query regarding different BB count using two different tools. I have an output file (.txt) against a binary which contains different features about it. I have written IDAPython code to ...
0
votes
1answer
36 views

Paint path in Ida according to gdb log file

In Gdb I put script that print each instruction to gdb.txt file. I want to load this file to Ida to show and print/paint the path that the process has been running. The gdb script is # not strictly ...
0
votes
2answers
67 views

Try to parse all functions with IdaPython

Sometime Ida didn't parse some function into binary , so I search the beginning of function (in Arm it's PUSH {R4-*,LR} and press P -create a function. How can I do it automatically for all undefined ...
1
vote
1answer
29 views

Restoring original stack variable in IDA Pro?

I would like to convert an instruction like: lea ecx, [esp+150h+var_13E+2] to: lea ecx, [esp+14h] I know it's possible to do this with the key K. But I'm writing an IDAPython plugin that needs ...
0
votes
0answers
44 views

How can I connect basic blocks seperated by unconditional jmps?

I'm analyzing an obfuscated code which splits its code into multiple blocks seperated by many, many unconditional jmps. Here is a picture of what the obfuscation looks like: I wrote an IDAPython ...
1
vote
1answer
59 views

IDApython - Turning a modified operand into a string reference

I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table. The core of the script is working fine, but I have some issue when it comes ...
2
votes
2answers
91 views

ida_hexrays.lvar_t.stk.get_stkoff() incorrect ± 0x10

When using the stack offset for a variable obtained via ida_hexrays.lvar_t.stk.get_stkoff() or ida_hexrays.vdloc_t.stkoff() the results vary between "correct", and 8 or 16 bytes out as ...
1
vote
0answers
34 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
1
vote
0answers
20 views

How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?

Lets say there is a variable x in f1, and f1 calls f2 with the variable x I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
0
votes
2answers
87 views

Import header files in IDA to get the struct definitions?

I am reversing a program that has a lot of internal structs in it. The problem is that there are a lot of structs, so i can't import them manually using local types->insert. Lets say i have some ...
0
votes
2answers
79 views

Is it possible to "jump" to another address when script detects jmp?

here is the original C++ source code of the executable that I've created to do simple RE #include <iostream> void myFunction() { printf("Hello!"); } int main() { myFunction()...
0
votes
2answers
45 views

How to get dynamically changing xrefs with IDAPython

There is a situation where the number of xrefs for a function is dynamically increasing due to the dynamic creation of memory with execution rights attached by VirtualAlloc. I want to get the xrefs of ...
0
votes
0answers
31 views

how highlight multiple word in ida assembly view? (already know method in graph view, but dont work in text view)

like set different bg or fg for two keyword : eax and ecx (or hex ) not line highlight .... in graph view , i found a plugin to do this by hook graph node text , but no search result for text mode ...
0
votes
1answer
65 views

How to show the save dialog box with IDAPython?

I want to some strings to the text-file which is chosen from the save dialog box. Is there any way to show the save dialog box by IDApython and how to write the script code about that ?
0
votes
1answer
36 views

Is there any way to STOP the loop of the IDApython?

Is there any way to STOP the loop of the IDApython ? I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
0
votes
1answer
167 views

(IDAPython)How to get the function name string from the Function address?

For example, in the Registers windows of IDA pro, It show the following. ( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.) EAX 766D32B0 WS2_32.dll:...
0
votes
1answer
50 views

how to call the function from IDAPython with passing arguments by manually push them to the stack

would you please tell me how to call the function from IDAPython code ?
 I want to simulate it by manually push to stack as the two arguments and calling the function.
1
vote
1answer
104 views

How to deal with IDA auto-analysis analyzing invalid paths?

Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis. There is some mention of ...
0
votes
0answers
46 views

propagate manually set types to redefine a function in IDA pro?

Is there anyway in IDA pro to propagate manually set types of variables to redefine function arguments? for example lets say IDA thinks Func1 takes 4 int as INPUT, now when i set the type of these 4 ...
0
votes
0answers
33 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
0answers
28 views

HexRay API - Programatically rebaseing program on firmware

I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
2
votes
0answers
81 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
0
votes
1answer
49 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
1
vote
1answer
118 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
0
votes
2answers
149 views

How to parse the NT headers and section headers of a PE file using IDApython?

I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
0
votes
1answer
65 views

How to parse the IAT using IDApython?

Is it possible to parse the IAT using IDApython? i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
0
votes
0answers
82 views

Parsing binary file to Idb faster with Ida

When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores? Is there any way to make that process faster? run it on all ...
1
vote
1answer
97 views

Analyze stack with IDAPython

In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack. char buffer[XXX]; // [sp+YYh] How can I get that information (buffer size and place of this buffer ...
1
vote
2answers
285 views

Find assembly in binary with ida python

I want to find 2 consecutive instructions with Ida python move r2,r3 ; move r2 r4 What is the easy way to find the addresses of that with Ida python? I can Iterate on all Functions and for each ...
1
vote
1answer
139 views

Ida python find function address that using string

I have string at address 0xaaaa that I want to know the address of function that use this string import idautils len(list(idautils.XrefsTo(0xaaaa,1))) return 0 Why is that ? When I tried this code ...
0
votes
0answers
46 views

Use IDAPython to automatically attach to a remote GDB server

I would like to automate the process of connecting to a remote debug server. The following code worked for the remote win32 debugger: from ida_dbg import * set_remote_debugger(addr, port) ...
0
votes
2answers
48 views

Determine if there is a cross reference using idapython given a specific address

I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from) ea_start = # ea_end = # for ea in ...
0
votes
0answers
211 views

how to get all "called functions" in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
0
votes
0answers
191 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
1
vote
2answers
209 views

How to set conditional breakpoint to modify ZF (Zero flag)

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0. I don't know how to do it: I searched for example scripts in IDC or ...
0
votes
0answers
598 views

How to change IDA to use Python 3.7 and not Python 2.7: "do not have the x86_64 architecture"

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
1
vote
1answer
214 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
1answer
508 views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...

1
2 3 4 5
7