Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
0 votes
0 answers
23 views

How to find prolog with idapython in non-disassambled function raw bytes?

I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?
user avatar
1 vote
1 answer
88 views

idapython: how to reset pointer type for variables

I am using IDA Pro 7.6 on win32 x86 binaries. I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
user avatar
1 vote
1 answer
69 views

how to get indirect callsite function return type and arguments

I am using idapython to get function return type and arguments @ an indirect call instruction. I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
user avatar
  • 1,437
0 votes
1 answer
51 views

How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?

TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc). In order to explicitly load a type library I can use ...
user avatar
  • 10.5k
0 votes
1 answer
100 views

idapython: how to get decompiler output corresponding to the indirect call

For, e.g. disassembler or IDA view: Decompiler or Hex View: I can get the decompilation of whole function using something like: decompiled = ida_hexrays.decompile(ea) But, in this way I get the ...
user avatar
  • 1,437
0 votes
1 answer
101 views

How do I enable Python on IDA 6.8?

I have a python dir within IDA 6.8 folder with idaapi.py, idautils.py, and idc.py. IDA doesn't seem to pick the Python scripting by default. How do I enable it?
user avatar
  • 146
1 vote
1 answer
122 views

How to print disassembly code with IDAPython when IDA doesn’t detect it as code

I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA: I want to print ...
user avatar
1 vote
1 answer
77 views

IDA API: obtain operand size prefix (x64)

I am trying to tell apart the following two instructions: 8D 02 lea eax, [rdx] // auxfix = 0x1810 67 8D 02 lea eax, [edx] // auxfix = 0x810 The only difference is in the insn_t....
user avatar
1 vote
1 answer
233 views

Is there a way to install Python 3 modules into IDAPython with pip?

I would like to use regular python packages in my IDAPython scripts, but I can't figure out how to install them into IDA's Python environment. I don't even know where this python environment is, or ...
user avatar
0 votes
1 answer
203 views

IDAPython - How can I read the value of a function argument? (IDA 7.6)

I'm trying to automate some of my debugging with a python script that automatically places breakpoints at the first and last instructions of the functions I want to analyze. I'm using the breakpoint's ...
user avatar
0 votes
0 answers
43 views

ida python: get raw, clean dissassembly without names

Because the exposed DecodeInstruction functionality in IDA is quiet sucky, it can be easier to operate on textual representation. However, IDA even foils this as there doesnt seem to be a good way to ...
user avatar
0 votes
0 answers
61 views

how to get register size in ida python

I am aware i can decode the instruction, then check the op.dtype. But this doesnt work in cases such as mov eax, dword [rax] because the second operand will be of dtype dword, while the basereg ...
user avatar
1 vote
1 answer
104 views

Automatically propagate types in IDA pro when variables are assigned?

Let's say I have this code in the decompiler of IDA pro: var1 = var2; And assume the type of var1 is X (for example X could be char array with size 5). Is there anyway that I can tell IDA that ...
user avatar
1 vote
1 answer
57 views

IDA: close without saving changes

In my work, I often end up with lots of IDA windows open concurrently. Once done with analysis, I would like to close them all. It is relatively easy to issue a command to all of them simultaneously e....
user avatar
  • 135
1 vote
1 answer
215 views

How to create and change variables at address in IDA Python?

I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it. For structs, there's ...
user avatar
  • 206
0 votes
0 answers
36 views

Is it possible to rebase direct calls and jmps when i rebase the IDB in IDA pro?

When i rebase the IDB file, it doesn't effect the direct calls, so something like call dword ptr ds:851F3020h Will not get rebased and all of the sudden all my direct calls are pointing to ...
user avatar
0 votes
1 answer
56 views

How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)

In IDA Pro, when you create a custom struct, apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable, it only prints limited ...
user avatar
0 votes
0 answers
27 views

How to change the color of a graph edge and custom hints in IDA

I would like to access the API to change the color of graph edges to reflect my assessment of their correctness (I already know how to do this within the tool, I need to do it programmatically). There'...
user avatar
  • 101
1 vote
1 answer
62 views

How to print custom name of an operand in IDA Python?

I'm starting to work on a plugin to port symbols(stack variable names, operand names, comments, etc) from functions in one database to functions in another database when function names match. I'm ...
user avatar
1 vote
1 answer
285 views

How to get function signature using IDA Python in IDA Pro

I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names. I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
user avatar
  • 11
1 vote
1 answer
86 views

Can I get loaded pdb file path from IDAPython?

IDA Pro can automatically download and load .pdb files from symbol server. And now I want to write an IDAPython plugin to obtain some data from the .pdb file. But I don't know how to get the file path ...
user avatar
  • 117
1 vote
1 answer
49 views

How to open watch view using IDAPython?

I want to open the watch view and add watch in code. Do you know how? I didn't find open_window_ for it. I couldn't understand which function to use with BWN_... or IWID_... constants ( IWID_WATCH ...
user avatar
  • 11
0 votes
1 answer
69 views

idapython: type information with different prefixes

I checked how to get type information here - https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf.html Although, I am not sure what these different type prefixes mean. For e.g. BT_{...
user avatar
  • 1,437
0 votes
1 answer
46 views

Functions and methods for working with AST tree

I am implementing deep search with Python Hex Ray API. Can someone say classes and methods for implementing this feature with the IDA Python API?
user avatar
0 votes
1 answer
191 views

IDAPython: function parameters and return value

I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using tif = idaapi.tinfo_t() ida_nalt.get_tinfo(tif, ea) function_type = tif....
user avatar
  • 1,437
1 vote
1 answer
114 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
user avatar
2 votes
1 answer
98 views

IDA Pro: unknown warnings

I am using IDA pro to analyze an old nginx binary. I am getting following warnings which I have never seen before. Does anyone have an idea about these warnings? IDA is analysing the input file... You ...
user avatar
  • 1,437
3 votes
1 answer
76 views

Find all x-ref with specific argument with IdaPython

I have a function at 0xabcd that is called a few times like Func(1,2,3) and Func(4,4,5). I want to find all the references where the third argument is 5. import idautils for f in list(idautils.XrefsTo(...
user avatar
  • 173
0 votes
1 answer
318 views

Get instruction by address with IDAPython

I want to get an instruction with IDAPython by address of this instruction. For example from mov r0 r1 I want to get only mov. How can I do that with IDAPython?
user avatar
  • 1
1 vote
1 answer
100 views

How to force IDA to analyze a function immediately? [duplicate]

I think my question is probably related to this one: API to force reanalyze of function (Alt-P) When I define a function at a certain location with IDAPython, I want IDA to analyze it immediately, ...
user avatar
1 vote
1 answer
46 views

Does COT_HELPER have arguments/operands?

I am trying to learn the hexrays ctree api. I am using the python bindings. The task I am trying to automate is tracing the arguments to wrmsr instructions. I notice that hexrays represents them like ...
user avatar
  • 1,196
1 vote
1 answer
114 views

IDAPython: Is it possible to determine whether an instruction operand is a constant rather than a variable?

Here is my use case: I am trying to create a script that finds all instances of a particular instruction (in this case wrmsr) and traces back to find out whether the operands for the instruction are ...
user avatar
  • 1,196
1 vote
1 answer
25 views

BaseHTTPRequestHandler + ThreadingMixin = unclosed port

In developing a RESTful API for IDA >= 7.5 [https://github.com/sfinktah/idarest75], I have observed that a standard threaded webserver does not release it's socket when IDA terminates, unless it is ...
user avatar
0 votes
1 answer
68 views

Creating table with IDAPython

I'd like to create the table like below, I could not found any clue while googling it. Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class? Any advises would ...
user avatar
  • 123
2 votes
0 answers
128 views

How to print a manually defined struct in IDA pro while debugging?

Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members. Now if i have the variables'...
user avatar
0 votes
1 answer
38 views

Undo step with IdaPython?

With Ida I can press Control+Z to undo the last action Can I do that with IdaPython?
user avatar
  • 1
0 votes
0 answers
257 views

IDAPython: error executing init.py:

When I open Ida Pro 7.3 I see an error message IDAPython: error executing init.py: nothing to repeat Refer to the message window to see the full error log. How can I understand what is the problem? ...
user avatar
  • 1
0 votes
0 answers
81 views

Get first and last address of binary with IdaPython

How can I get the first and last address of binary with IdaPython?
user avatar
  • 1
0 votes
2 answers
674 views

Add python to Ida Pro 7.3

I have Ida Pro 7.3 but in the bottom of windwos I see that I can run only IDC script. How can I add Python to Ida , So I can run Python script via IDA ?
user avatar
0 votes
0 answers
65 views

How to get symbol in IDA like done in BN code

I am converting BN code into IDA Pro and stuck at this point, following are lines in the code which gives the symbol call #####Get call symbol (if it exists) dr.get_symbol(inst.tokens) and ####### ...
user avatar
  • 1
1 vote
0 answers
71 views

Passing a pointer to a pointer to a string with IDA Pro's Appcall

I need to call an encryption function in a program with the following signature (the second argument is returned): char** __usercall decode(char** input, char** output) As far as I can tell, Appcall ...
user avatar
1 vote
0 answers
102 views

IDA script: How to properly undefine a byte and then redefine code

I'm trying to correct the following instructions in IDA using a script: jnb short near ptr loc_1C61B1+3 It order to do this I'm running a snippet like this in a script: ida_bytes.del_value(...
user avatar
0 votes
0 answers
134 views

Reconstructing "relative" import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
user avatar
0 votes
0 answers
58 views

Basic Block generated by IDAPython code are different compared to BN generated output file

I have a query regarding different BB count using two different tools. I have an output file (.txt) against a binary which contains different features about it. I have written IDAPython code to ...
user avatar
  • 1
1 vote
1 answer
56 views

Paint path in Ida according to gdb log file

In Gdb I put script that print each instruction to gdb.txt file. I want to load this file to Ida to show and print/paint the path that the process has been running. The gdb script is # not strictly ...
user avatar
0 votes
2 answers
254 views

Try to parse all functions with IdaPython

Sometime Ida didn't parse some function into binary , so I search the beginning of function (in Arm it's PUSH {R4-*,LR} and press P -create a function. How can I do it automatically for all undefined ...
user avatar
1 vote
1 answer
34 views

Restoring original stack variable in IDA Pro?

I would like to convert an instruction like: lea ecx, [esp+150h+var_13E+2] to: lea ecx, [esp+14h] I know it's possible to do this with the key K. But I'm writing an IDAPython plugin that needs ...
user avatar
1 vote
1 answer
112 views

IDApython - Turning a modified operand into a string reference

I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table. The core of the script is working fine, but I have some issue when it comes ...
user avatar
  • 619
2 votes
2 answers
126 views

ida_hexrays.lvar_t.stk.get_stkoff() incorrect ± 0x10

When using the stack offset for a variable obtained via ida_hexrays.lvar_t.stk.get_stkoff() or ida_hexrays.vdloc_t.stkoff() the results vary between "correct", and 8 or 16 bytes out as ...
user avatar
1 vote
0 answers
64 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
user avatar

1
2 3 4 5
7