Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
0
votes
0answers
7 views

How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)

In IDA Pro, when you create a custom struct, and apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable it only prints ...
0
votes
0answers
19 views

How to change the color of a graph edge and custom hints in IDA

I would like to access the API to change the color of graph edges to reflect my assessment of their correctness (I already know how to do this within the tool, I need to do it programmatically). There'...
1
vote
1answer
25 views

How to print custom name of an operand in IDA Python?

I'm starting to work on a plugin to port symbols(stack variable names, operand names, comments, etc) from functions in one database to functions in another database when function names match. I'm ...
1
vote
1answer
57 views

How to get function signature using IDA Python in IDA Pro

I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names. I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
1
vote
1answer
52 views

Can I get loaded pdb file path from IDAPython?

IDA Pro can automatically download and load .pdb files from symbol server. And now I want to write an IDAPython plugin to obtain some data from the .pdb file. But I don't know how to get the file path ...
1
vote
0answers
19 views

How to open watch view using IDAPython?

I want to open the watch view and add watch in code. Do you know how? I didn't find open_window_ for it. I couldn't understand which function to use with BWN_... or IWID_... constants ( IWID_WATCH ...
0
votes
1answer
52 views

idapython: type information with different prefixes

I checked how to get type information here - https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf.html Although, I am not sure what these different type prefixes mean. For e.g. BT_{...
0
votes
1answer
36 views

Functions and methods for working with AST tree

I am implementing deep search with Python Hex Ray API. Can someone say classes and methods for implementing this feature with the IDA Python API?
0
votes
1answer
52 views

IDAPython: function parameters and return value

I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using tif = idaapi.tinfo_t() ida_nalt.get_tinfo(tif, ea) function_type = tif....
1
vote
1answer
81 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
1
vote
1answer
72 views

IDA Pro: unknown warnings

I am using IDA pro to analyze an old nginx binary. I am getting following warnings which I have never seen before. Does anyone have an idea about these warnings? IDA is analysing the input file... You ...
3
votes
1answer
49 views

Find all x-ref with specific argument with IdaPython

I have a function at 0xabcd that is called a few times like Func(1,2,3) and Func(4,4,5). I want to find all the references where the third argument is 5. import idautils for f in list(idautils.XrefsTo(...
0
votes
1answer
66 views

Get instruction by address with IDAPython

I want to get an instruction with IDAPython by address of this instruction. For example from mov r0 r1 I want to get only mov. How can I do that with IDAPython?
0
votes
0answers
54 views

How to force IDA to analyze a function immediately?

I think my question is probably related to this one: API to force reanalyze of function (Alt-P) When I define a function at a certain location with IDAPython, I want IDA to analyze it immediately, ...
1
vote
0answers
22 views

Does COT_HELPER have arguments/operands?

I am trying to learn the hexrays ctree api. I am using the python bindings. The task I am trying to automate is tracing the arguments to wrmsr instructions. I notice that hexrays represents them like ...
1
vote
1answer
85 views

IDAPython: Is it possible to determine whether an instruction operand is a constant rather than a variable?

Here is my use case: I am trying to create a script that finds all instances of a particular instruction (in this case wrmsr) and traces back to find out whether the operands for the instruction are ...
1
vote
1answer
22 views

BaseHTTPRequestHandler + ThreadingMixin = unclosed port

In developing a RESTful API for IDA >= 7.5 [https://github.com/sfinktah/idarest75], I have observed that a standard threaded webserver does not release it's socket when IDA terminates, unless it is ...
0
votes
1answer
48 views

Creating table with IDAPython

I'd like to create the table like below, I could not found any clue while googling it. Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class? Any advises would ...
1
vote
0answers
48 views

How to print a manually defined struct in IDA pro while debugging?

Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members. Now if i have the variables'...
0
votes
1answer
32 views

Undo step with IdaPython?

With Ida I can press Control+Z to undo the last action Can I do that with IdaPython?
0
votes
0answers
112 views

IDAPython: error executing init.py:

When I open Ida Pro 7.3 I see an error message IDAPython: error executing init.py: nothing to repeat Refer to the message window to see the full error log. How can I understand what is the problem? ...
0
votes
0answers
34 views

Get first and last address of binary with IdaPython

How can I get the first and last address of binary with IdaPython?
0
votes
1answer
196 views

Add python to Ida Pro 7.3

I have Ida Pro 7.3 but in the bottom of windwos I see that I can run only IDC script. How can I add Python to Ida , So I can run Python script via IDA ?
0
votes
0answers
181 views

IDA Python global name 'idaapi' is not defined

I have IDA 7.2 and Python 2.7 installed. If I just have one file BaseImagePrinter.py like this: class BaseImagePrinter: def __init__(self): self.imageBase = idaapi.get_imagebase() ...
0
votes
0answers
38 views

How to get symbol in IDA like done in BN code

I am converting BN code into IDA Pro and stuck at this point, following are lines in the code which gives the symbol call #####Get call symbol (if it exists) dr.get_symbol(inst.tokens) and ####### ...
1
vote
0answers
36 views

Passing a pointer to a pointer to a string with IDA Pro's Appcall

I need to call an encryption function in a program with the following signature (the second argument is returned): char** __usercall decode(char** input, char** output) As far as I can tell, Appcall ...
1
vote
0answers
65 views

IDA script: How to properly undefine a byte and then redefine code

I'm trying to correct the following instructions in IDA using a script: jnb short near ptr loc_1C61B1+3 It order to do this I'm running a snippet like this in a script: ida_bytes.del_value(...
0
votes
0answers
79 views

Reconstructing "relative" import functions in IDA

Apologies in advance if any premises of my question are incorrect, I'm rebuilding imports for the first time and I'm frankly pretty overwhelmed. I'm reverse engineering a packed win32 executable, so I ...
0
votes
0answers
52 views

Basic Block generated by IDAPython code are different compared to BN generated output file

I have a query regarding different BB count using two different tools. I have an output file (.txt) against a binary which contains different features about it. I have written IDAPython code to ...
0
votes
1answer
42 views

Paint path in Ida according to gdb log file

In Gdb I put script that print each instruction to gdb.txt file. I want to load this file to Ida to show and print/paint the path that the process has been running. The gdb script is # not strictly ...
0
votes
2answers
112 views

Try to parse all functions with IdaPython

Sometime Ida didn't parse some function into binary , so I search the beginning of function (in Arm it's PUSH {R4-*,LR} and press P -create a function. How can I do it automatically for all undefined ...
1
vote
1answer
32 views

Restoring original stack variable in IDA Pro?

I would like to convert an instruction like: lea ecx, [esp+150h+var_13E+2] to: lea ecx, [esp+14h] I know it's possible to do this with the key K. But I'm writing an IDAPython plugin that needs ...
0
votes
0answers
46 views

How can I connect basic blocks seperated by unconditional jmps?

I'm analyzing an obfuscated code which splits its code into multiple blocks seperated by many, many unconditional jmps. Here is a picture of what the obfuscation looks like: I wrote an IDAPython ...
1
vote
1answer
81 views

IDApython - Turning a modified operand into a string reference

I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table. The core of the script is working fine, but I have some issue when it comes ...
2
votes
2answers
104 views

ida_hexrays.lvar_t.stk.get_stkoff() incorrect ± 0x10

When using the stack offset for a variable obtained via ida_hexrays.lvar_t.stk.get_stkoff() or ida_hexrays.vdloc_t.stkoff() the results vary between "correct", and 8 or 16 bytes out as ...
1
vote
0answers
46 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
1
vote
0answers
24 views

How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?

Lets say there is a variable x in f1, and f1 calls f2 with the variable x I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
0
votes
2answers
257 views

Import header files in IDA to get the struct definitions?

I am reversing a program that has a lot of internal structs in it. The problem is that there are a lot of structs, so i can't import them manually using local types->insert. Lets say i have some ...
0
votes
2answers
91 views

Is it possible to "jump" to another address when script detects jmp?

here is the original C++ source code of the executable that I've created to do simple RE #include <iostream> void myFunction() { printf("Hello!"); } int main() { myFunction()...
0
votes
2answers
57 views

How to get dynamically changing xrefs with IDAPython

There is a situation where the number of xrefs for a function is dynamically increasing due to the dynamic creation of memory with execution rights attached by VirtualAlloc. I want to get the xrefs of ...
0
votes
0answers
37 views

how highlight multiple word in ida assembly view? (already know method in graph view, but dont work in text view)

like set different bg or fg for two keyword : eax and ecx (or hex ) not line highlight .... in graph view , i found a plugin to do this by hook graph node text , but no search result for text mode ...
0
votes
1answer
100 views

How to show the save dialog box with IDAPython?

I want to some strings to the text-file which is chosen from the save dialog box. Is there any way to show the save dialog box by IDApython and how to write the script code about that ?
0
votes
1answer
48 views

Is there any way to STOP the loop of the IDApython?

Is there any way to STOP the loop of the IDApython ? I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
0
votes
1answer
325 views

(IDAPython)How to get the function name string from the Function address?

For example, in the Registers windows of IDA pro, It show the following. ( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.) EAX 766D32B0 WS2_32.dll:...
0
votes
1answer
56 views

how to call the function from IDAPython with passing arguments by manually push them to the stack

would you please tell me how to call the function from IDAPython code ?
 I want to simulate it by manually push to stack as the two arguments and calling the function.
1
vote
1answer
111 views

How to deal with IDA auto-analysis analyzing invalid paths?

Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis. There is some mention of ...
0
votes
0answers
79 views

propagate manually set types to redefine a function in IDA pro?

Is there anyway in IDA pro to propagate manually set types of variables to redefine function arguments? for example lets say IDA thinks Func1 takes 4 int as INPUT, now when i set the type of these 4 ...
0
votes
0answers
36 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
0answers
35 views

HexRay API - Programatically rebaseing program on firmware

I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
2
votes
0answers
86 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...

1
2 3 4 5
7