Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?

Lets say there is a variable x in f1, and f1 calls f2 with the variable x I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
0
votes
2answers
27 views

Import header files in IDA to get the struct definitions?

I am reversing a program that has a lot of internal structs in it. The problem is that there are a lot of structs, so i can't import them manually using local types->insert. Lets say i have some ...
-1
votes
0answers
37 views

Export / Convert Ghidra database (GZF) to IDA database (IDB)

I am deeply frustrated after spending the last days searching for a way to do what the title of the question says, but all I could find was IDA database -> Ghidra database conversions. I have found ...
0
votes
2answers
59 views

Is it possible to “jump” to another address when script detects jmp?

here is the original C++ source code of the executable that I've created to do simple RE #include <iostream> void myFunction() { printf("Hello!"); } int main() { myFunction()...
0
votes
2answers
40 views

How to get dynamically changing xrefs with IDAPython

There is a situation where the number of xrefs for a function is dynamically increasing due to the dynamic creation of memory with execution rights attached by VirtualAlloc. I want to get the xrefs of ...
0
votes
0answers
26 views

how highlight multiple word in ida assembly view? (already know method in graph view, but dont work in text view)

like set different bg or fg for two keyword : eax and ecx (or hex ) not line highlight .... in graph view , i found a plugin to do this by hook graph node text , but no search result for text mode ...
0
votes
1answer
33 views

How to show the save dialog box with IDAPython?

I want to some strings to the text-file which is chosen from the save dialog box. Is there any way to show the save dialog box by IDApython and how to write the script code about that ?
0
votes
1answer
29 views

Is there any way to STOP the loop of the IDApython?

Is there any way to STOP the loop of the IDApython ? I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
0
votes
1answer
61 views

(IDAPython)How to get the function name string from the Function address?

For example, in the Registers windows of IDA pro, It show the following. ( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.) EAX 766D32B0 WS2_32.dll:...
0
votes
1answer
43 views

how to call the function from IDAPython with passing arguments by manually push them to the stack

would you please tell me how to call the function from IDAPython code ?
 I want to simulate it by manually push to stack as the two arguments and calling the function.
1
vote
1answer
94 views

How to deal with IDA auto-analysis analyzing invalid paths?

Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis. There is some mention of ...
0
votes
0answers
23 views

propagate manually set types to redefine a function in IDA pro?

Is there anyway in IDA pro to propagate manually set types of variables to redefine function arguments? for example lets say IDA thinks Func1 takes 4 int as INPUT, now when i set the type of these 4 ...
0
votes
0answers
30 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
0answers
26 views

HexRay API - Programatically rebaseing program on firmware

I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
2
votes
0answers
75 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
0
votes
1answer
40 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
2
votes
1answer
99 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
0
votes
2answers
66 views

How to parse the NT headers and section headers of a PE file using IDApython?

I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
0
votes
1answer
51 views

How to parse the IAT using IDApython?

Is it possible to parse the IAT using IDApython? i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
0
votes
0answers
46 views

Parsing binary file to Idb faster with Ida

When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores? Is there any way to make that process faster? run it on all ...
1
vote
1answer
81 views

Analyze stack with IDAPython

In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack. char buffer[XXX]; // [sp+YYh] How can I get that information (buffer size and place of this buffer ...
0
votes
2answers
114 views

Find assembly in binary with ida python

I want to find 2 consecutive instructions with Ida python move r2,r3 ; move r2 r4 What is the easy way to find the addresses of that with Ida python? I can Iterate on all Functions and for each ...
0
votes
1answer
59 views

Ida python find function address that using string

I have string at address 0xaaaa that I want to know the address of function that use this string import idautils len(list(idautils.XrefsTo(0xaaaa,1))) return 0 Why is that ? When I tried this code ...
0
votes
0answers
33 views

Use IDAPython to automatically attach to a remote GDB server

I would like to automate the process of connecting to a remote debug server. The following code worked for the remote win32 debugger: from ida_dbg import * set_remote_debugger(addr, port) ...
0
votes
2answers
36 views

Determine if there is a cross reference using idapython given a specific address

I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from) ea_start = # ea_end = # for ea in ...
0
votes
0answers
70 views

how to get all “called functions” in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
0
votes
0answers
114 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
1
vote
2answers
121 views

How to set conditional breakpoint to modify ZF (Zero flag)

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0. I don't know how to do it: I searched for example scripts in IDC or ...
0
votes
0answers
222 views

How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
1
vote
1answer
133 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
1answer
249 views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...
0
votes
0answers
15 views

How to get the color of a operand in IDApython?

Lets say there is a instruction, and the operand is pink, is there any API call that i can use to get the color of the operand? i searched in their documentation but only found GetColor API which ...
0
votes
0answers
29 views

Get the string usage sequence in each function with Idapython?

The only function i know for this task is idautils.Strings() but the problem is i need to get the sequence of string usage in each function, meaning that if string 1 was first referenced then string ...
0
votes
0answers
51 views

Checking if a call is a API/Library call in IDApython?

I asked the question a while ago but found no answer so I'm trying my luck again the only solution is this : Finding all API calls in a function but it doesn't work when the library call is a .NET ...
2
votes
1answer
633 views

Can I use python3 with IDA 7.0?

Got IDA Pro 7.0 (I can't update at the moment), I'm currently unable to use idapython. I have python3.8 installed on my machine and nothing else (I dont want any collisions). How can I use make ...
0
votes
0answers
24 views

How to check in IDApython that if a call is an API/Library call or not?

I want to check for every call instruction whether its an API call or library call (statically linked that flirt recognized) The only solution i found is this : Finding all API calls in a function but ...
0
votes
0answers
35 views

Using IDAPython Problem in finding string avalilable in .idata section

I am new to ida pro and idapython In the following case i want to find the string reference "x is less than zero" while processing a block. Tested with following script but doesn't seems to ...
0
votes
0answers
27 views

How to paint running code with Ida gdb-server

I running IDA that is connected to gdb-server and I am using idapython with sark. I want to paint all lines that are running (while debug) in IDA. How can I do that?
0
votes
1answer
125 views

How to run another IDA script using IDApython?

I'm using IDA batch scripting to run a script on a dataset of malware the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
1
vote
1answer
132 views

What is the easiest way to dump a REGION of memory in IDA pro?

I'm facing a problem that i need to dump a large region of memory with IDA pro using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for ...
1
vote
0answers
63 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
1
vote
0answers
60 views

Is there any way to apply FLIRT signatures through a script like idapython?

I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
1
vote
2answers
69 views

Defining operand as offset

I have an idapython script which automatically defines bytes as code by a predefined configuration. The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not ...
0
votes
1answer
166 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
0
votes
0answers
25 views

How to work on diffing result generated by bindiff

I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython. *work is like finding no basic blocks, no of edges
0
votes
0answers
40 views

Defeating Tall Call obfuscation or something similar

If you look at the image below, you will see that IDA Pro's static analysis fails because the function doesn't actually end up there. There is no ret, add esp, 0x20 or pop to free the arguments on the ...
0
votes
0answers
35 views

Ida pro 6.5 (BATCH MODE)

I have a question related to IDA pro 6.5 batch mode. I want to disassemble (.exe) files and generate (.asm) files. I have executed the cmd command for this and generated an asm file too. But it does ...
0
votes
0answers
35 views

Setting processor specific options in IDA Python loader

I'm writing an IDA loader in Python for a MIPS system that uses offsets from GP to reference data. By manually setting GP in "Processor specific options", xrefs are working. But, I'd like to ...
0
votes
0answers
57 views

how to calculate no basic blocks of a function using IDAPython

I am new to IDA Pro, IDAPython want to calculate no of basic blocks and its location in a function using IDAPython, please share the code with library needed to import.
1
vote
1answer
259 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...

1
2 3 4 5 6