Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

How to check in IDApython that if a call is an API/Library call or not?

I want to check for every call instruction whether its an API call or library call (statically linked that flirt recognized) The only solution i found is this : Finding all API calls in a function but ...
0
votes
0answers
25 views

Using IDAPython Problem in finding string avalilable in .idata section

I am new to ida pro and idapython In the following case i want to find the string reference "x is less than zero" while processing a block. Tested with following script but doesn't seems to ...
0
votes
0answers
21 views

How to paint running code with Ida gdb-server

I running IDA that is connected to gdb-server and I am using idapython with sark. I want to paint all lines that are running (while debug) in IDA. How can I do that?
0
votes
1answer
46 views

How to run another IDA script using IDApython?

I'm using IDA batch scripting to run a script on a dataset of malware the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
1
vote
1answer
43 views

What is the easiest way to dump a REGION of memory in IDA pro?

I'm facing a problem that i need to dump a large region of memory with IDA pro using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for ...
1
vote
0answers
46 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
1
vote
0answers
38 views

Is there any way to apply FLIRT signatures through a script like idapython?

I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
1
vote
2answers
47 views

Defining operand as offset

I have an idapython script which automatically defines bytes as code by a predefined configuration. The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not ...
0
votes
1answer
44 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
0
votes
0answers
18 views

How to work on diffing result generated by bindiff

I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython. *work is like finding no basic blocks, no of edges
0
votes
0answers
40 views

Defeating Tall Call obfuscation or something similar

If you look at the image below, you will see that IDA Pro's static analysis fails because the function doesn't actually end up there. There is no ret, add esp, 0x20 or pop to free the arguments on the ...
0
votes
0answers
27 views

Ida pro 6.5 (BATCH MODE)

I have a question related to IDA pro 6.5 batch mode. I want to disassemble (.exe) files and generate (.asm) files. I have executed the cmd command for this and generated an asm file too. But it does ...
0
votes
0answers
24 views

Setting processor specific options in IDA Python loader

I'm writing an IDA loader in Python for a MIPS system that uses offsets from GP to reference data. By manually setting GP in "Processor specific options", xrefs are working. But, I'd like to ...
0
votes
0answers
35 views

how to calculate no basic blocks of a function using IDAPython

I am new to IDA Pro, IDAPython want to calculate no of basic blocks and its location in a function using IDAPython, please share the code with library needed to import.
1
vote
0answers
55 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
0
votes
2answers
63 views

Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?

So lets say i have these type of instructions in functions : x == constant value x = constant value x > constant value no matter if its just an assignment or compare or anything, i want to get the ...
1
vote
1answer
63 views

IDAPython: idaapi.get_highlight for demangled names

I'm using the following code to get the address of the selected function/variable: hightlight = idaapi.get_highlight(idaapi.get_current_viewer()) screen_ea = idaapi.get_screen_ea() ea = idaapi....
0
votes
0answers
25 views

Print Stacktrace when process read String

There is a process that prints HELLO , in Ida that simple to find it in Strings and watch with X-ref all the functions that read that strings. There is an option to put a hardware breakpoint on this ...
1
vote
1answer
67 views

Ida python No module named tempo

I tried to run tempo.py from ida python github , but I got error No module named tempo According to Igor Skochinsky answer , this script is wrong Apparently, tempo was an internal module used ...
0
votes
0answers
14 views

compile gdb with python 3 for gef-ida-interact

I'm trying to use GEF's IDA-interact which has issues with python2. I'm using android-ndk-r20b/prebuilt/linux-x86_64/bin/gdb - v7.11 using Python engine 2.7 How do I compile gdb with python 3.x ? I ...
2
votes
1answer
42 views

Names not populating from disassembly to decompiler

I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation. I have never noticed this ...
1
vote
1answer
241 views

Using Python 3.7 and 2.x in same IDA

I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7. Is there any way to run that Python 2.7 based plugin?
0
votes
0answers
30 views

IDA plugin handles signal only on hotkey press

IDA plugin handles signal only when I click the "hotkey" and not when I execute signal with $ echo "test" > /tmp/fifo & # created w/ `mkfifo /tmp/fifo` $ kill -SUIGUSR2 $(pidof ida) Plugin ...
1
vote
1answer
60 views

Link to function with IdaPython

In my IdaPython script I print function that I found. print(func_address) How can I do that if user click on this function (in output windows) Ida will jump to this function?
0
votes
1answer
113 views

Get input with IdaPython

How can I get input from user with IdaPython? When I tried str = input() ,I got error RuntimeError: input(): lost.sys.stdin
1
vote
1answer
56 views

How to get the current offset use IDC or IDAPython?

When writing an IDA script, how to use IDC or IDAPython to get the file offset for a memory address?
1
vote
1answer
59 views

IDAPython api which get indirect memory address reference

I'm currently learning to use IDAPython for automated analysing on many binaries. Some binaries load memory address into register by adding base address with offset, that idautils.XrefsTo() cannot ...
0
votes
2answers
236 views

running IDA python without gui

I am trying to run IDA without GUI. My purpose is to run a specific script that receives arguments via my main program against multiple files, but for some reason, it does not work for me. Sometimes ...
1
vote
0answers
35 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
0answers
53 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
0
votes
0answers
25 views

How to make library functions linked statically to extrn?

I want to write an IDAPython script which will identify all statically linked libraries (I think I got that part down - starting from a certain address they all seem to be library functions) - then ...
0
votes
1answer
36 views

IDApython confused with get_32bit(ea) function behavior

I am using some code like this import idaapi print(idaapi.get_32bit(0x0055f4a0)) it must return 32 bit of address as int but it returns 1408011093 is it wrong conversion? its length is less ...
1
vote
1answer
193 views

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
1
vote
0answers
57 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
1
vote
1answer
180 views

How to set virtual `T` register programmatically in IDA Python?

It is trivial to do it with Alt+G command from GUI. However, when I set multiple breakpoints programmatically, IDA doesn't recognize them as "thumb" mode ones and sets T value at breakpoint address ...
1
vote
1answer
57 views

How to change IDA's name representation programmatically?

I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form 9 dseg_1234 the same as 2, but without data type ...
1
vote
1answer
150 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
1
vote
1answer
220 views

How to get array size of a global variable using IDApython?

I can make an array using MakeArray. Is there a function to get the size of the array I've created? I've tried GetArrayId + GetLastIndex but it doesn't seem to work.
0
votes
0answers
184 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
0
votes
1answer
81 views

How do you get the operand data type using idapython?

I know I can set the operand data type of my disassembly using functions such as OpBinary, OpOctal,OpDecimal, etc. Now, I'm trying to get the current operand data type of my disassembly instead. For ...
1
vote
1answer
147 views

MakeArray from stack variables using idapython

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...
0
votes
1answer
104 views

IDAPython Export All Addresses Called by Specific Call

The following call gets executed many times and jumps to many subroutines. call [rbp+var_s38] What do I need to write in the breakline condition to export all the locations it jumps to? import ...
1
vote
2answers
217 views

Split IDA segment into sub segments

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
0
votes
1answer
174 views

IdaPython aob search and rename example

Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying ...
0
votes
1answer
123 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
1
vote
1answer
198 views

IDA Copy structure from one database instance to another

This question sounds rather simple, but I can't seem to find any option for this. I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
0
votes
0answers
61 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
0answers
37 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...
0
votes
1answer
342 views

In IDA, i want to get symbol by using IDAPython

I'm currently reversing some C++ Binary (macOS Kernel Extension). But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython. I know how to make structure ...
0
votes
0answers
92 views

Get and change function definition IDAPython

I was wondering if it is possible to retrieve the function definition at ea and eventually how to edit it. This feature should be in idaapi but unfortunately there's basically no documentation about ...

1
2 3 4 5 6