Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
0
votes
1answer
32 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
3
votes
0answers
75 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
0
votes
1answer
41 views

How to parse the NT headers and section headers of a PE file using IDApython?

I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
0
votes
1answer
41 views

How to parse the IAT using IDApython?

Is it possible to parse the IAT using IDApython? i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
0
votes
0answers
37 views

Parsing binary file to Idb faster with Ida

When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores? Is there any way to make that process faster? run it on all ...
1
vote
1answer
76 views

Analyze stack with IDAPython

In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack. char buffer[XXX]; // [sp+YYh] How can I get that information (buffer size and place of this buffer ...
1
vote
2answers
62 views

Find assembly in binary with ida python

I want to find 2 consecutive instructions with Ida python move r2,r3 ; move r2 r4 What is the easy way to find the addresses of that with Ida python? I can Iterate on all Functions and for each ...
0
votes
1answer
49 views

Ida python find function address that using string

I have string at address 0xaaaa that I want to know the address of function that use this string import idautils len(list(idautils.XrefsTo(0xaaaa,1))) return 0 Why is that ? When I tried this code ...
0
votes
0answers
28 views

Use IDAPython to automatically attach to a remote GDB server

I would like to automate the process of connecting to a remote debug server. The following code worked for the remote win32 debugger: from ida_dbg import * set_remote_debugger(addr, port) ...
0
votes
2answers
25 views

Determine if there is a cross reference using idapython given a specific address

I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from) ea_start = # ea_end = # for ea in ...
0
votes
0answers
62 views

how to get all “called functions” in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
0
votes
0answers
87 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
1
vote
2answers
80 views

How to set conditional breakpoint to modify ZF (Zero flag)

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0. I don't know how to do it: I searched for example scripts in IDC or ...
0
votes
0answers
110 views

How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
1
vote
1answer
106 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
1answer
131 views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...
0
votes
0answers
15 views

How to get the color of a operand in IDApython?

Lets say there is a instruction, and the operand is pink, is there any API call that i can use to get the color of the operand? i searched in their documentation but only found GetColor API which ...
0
votes
0answers
25 views

Get the string usage sequence in each function with Idapython?

The only function i know for this task is idautils.Strings() but the problem is i need to get the sequence of string usage in each function, meaning that if string 1 was first referenced then string ...
0
votes
0answers
36 views

Checking if a call is a API/Library call in IDApython?

I asked the question a while ago but found no answer so I'm trying my luck again the only solution is this : Finding all API calls in a function but it doesn't work when the library call is a .NET ...
2
votes
1answer
395 views

Can I use python3 with IDA 7.0?

Got IDA Pro 7.0 (I can't update at the moment), I'm currently unable to use idapython. I have python3.8 installed on my machine and nothing else (I dont want any collisions). How can I use make ...
0
votes
0answers
23 views

How to check in IDApython that if a call is an API/Library call or not?

I want to check for every call instruction whether its an API call or library call (statically linked that flirt recognized) The only solution i found is this : Finding all API calls in a function but ...
0
votes
0answers
34 views

Using IDAPython Problem in finding string avalilable in .idata section

I am new to ida pro and idapython In the following case i want to find the string reference "x is less than zero" while processing a block. Tested with following script but doesn't seems to ...
0
votes
0answers
27 views

How to paint running code with Ida gdb-server

I running IDA that is connected to gdb-server and I am using idapython with sark. I want to paint all lines that are running (while debug) in IDA. How can I do that?
0
votes
1answer
88 views

How to run another IDA script using IDApython?

I'm using IDA batch scripting to run a script on a dataset of malware the problem is i need to run the VB6 idc script after auto analysis is finished, and wait for it to finish and find all the ...
1
vote
1answer
91 views

What is the easiest way to dump a REGION of memory in IDA pro?

I'm facing a problem that i need to dump a large region of memory with IDA pro using xdbg its easily done by going to memory map tab and just dumping a region, how can i do this in IDA pro? for ...
1
vote
0answers
58 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
1
vote
0answers
50 views

Is there any way to apply FLIRT signatures through a script like idapython?

I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
1
vote
2answers
59 views

Defining operand as offset

I have an idapython script which automatically defines bytes as code by a predefined configuration. The problem is that when it defines the block of bytes as code (by idc.create_insn) it does not ...
0
votes
1answer
107 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
0
votes
0answers
24 views

How to work on diffing result generated by bindiff

I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython. *work is like finding no basic blocks, no of edges
0
votes
0answers
40 views

Defeating Tall Call obfuscation or something similar

If you look at the image below, you will see that IDA Pro's static analysis fails because the function doesn't actually end up there. There is no ret, add esp, 0x20 or pop to free the arguments on the ...
0
votes
0answers
31 views

Ida pro 6.5 (BATCH MODE)

I have a question related to IDA pro 6.5 batch mode. I want to disassemble (.exe) files and generate (.asm) files. I have executed the cmd command for this and generated an asm file too. But it does ...
0
votes
0answers
33 views

Setting processor specific options in IDA Python loader

I'm writing an IDA loader in Python for a MIPS system that uses offsets from GP to reference data. By manually setting GP in "Processor specific options", xrefs are working. But, I'd like to ...
0
votes
0answers
45 views

how to calculate no basic blocks of a function using IDAPython

I am new to IDA Pro, IDAPython want to calculate no of basic blocks and its location in a function using IDAPython, please share the code with library needed to import.
1
vote
1answer
177 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
0
votes
2answers
118 views

Is there any way to write a IDA script that finds constant values used in all functions, no matter the instruction?

So lets say i have these type of instructions in functions : x == constant value x = constant value x > constant value no matter if its just an assignment or compare or anything, i want to get the ...
1
vote
1answer
96 views

IDAPython: idaapi.get_highlight for demangled names

I'm using the following code to get the address of the selected function/variable: hightlight = idaapi.get_highlight(idaapi.get_current_viewer()) screen_ea = idaapi.get_screen_ea() ea = idaapi....
0
votes
0answers
31 views

Print Stacktrace when process read String

There is a process that prints HELLO , in Ida that simple to find it in Strings and watch with X-ref all the functions that read that strings. There is an option to put a hardware breakpoint on this ...
1
vote
1answer
78 views

Ida python No module named tempo

I tried to run tempo.py from ida python github , but I got error No module named tempo According to Igor Skochinsky answer , this script is wrong Apparently, tempo was an internal module used ...
0
votes
0answers
24 views

compile gdb with python 3 for gef-ida-interact

I'm trying to use GEF's IDA-interact which has issues with python2. I'm using android-ndk-r20b/prebuilt/linux-x86_64/bin/gdb - v7.11 using Python engine 2.7 How do I compile gdb with python 3.x ? I ...
2
votes
1answer
47 views

Names not populating from disassembly to decompiler

I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation. I have never noticed this ...
1
vote
1answer
843 views

Using Python 3.7 and 2.x in same IDA

I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7. Is there any way to run that Python 2.7 based plugin?
0
votes
0answers
32 views

IDA plugin handles signal only on hotkey press

IDA plugin handles signal only when I click the "hotkey" and not when I execute signal with $ echo "test" > /tmp/fifo & # created w/ `mkfifo /tmp/fifo` $ kill -SUIGUSR2 $(pidof ida) Plugin ...
1
vote
1answer
71 views

Link to function with IdaPython

In my IdaPython script I print function that I found. print(func_address) How can I do that if user click on this function (in output windows) Ida will jump to this function?
0
votes
1answer
248 views

Get input with IdaPython

How can I get input from user with IdaPython? When I tried str = input() ,I got error RuntimeError: input(): lost.sys.stdin
1
vote
1answer
97 views

How to get the current offset use IDC or IDAPython?

When writing an IDA script, how to use IDC or IDAPython to get the file offset for a memory address?
1
vote
1answer
79 views

IDAPython api which get indirect memory address reference

I'm currently learning to use IDAPython for automated analysing on many binaries. Some binaries load memory address into register by adding base address with offset, that idautils.XrefsTo() cannot ...
1
vote
2answers
502 views

running IDA python without gui

I am trying to run IDA without GUI. My purpose is to run a specific script that receives arguments via my main program against multiple files, but for some reason, it does not work for me. Sometimes ...
1
vote
0answers
63 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
2
votes
0answers
96 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...

1
2 3 4 5 6