Questions tagged [idapython]
A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.
347
questions
4
votes
0
answers
71
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,707
3
votes
1
answer
87
views
How to highlight all external registers in a function
What I want:
detect all potentially usercall, userpurge - functions;
when entering the function, immediately see all external entities:
arguments passed through registers;
i.e., in order not to ...
user42316
1
vote
1
answer
55
views
IDAPython doesn't recognize function
I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
- 121
2
votes
0
answers
38
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
- 101
2
votes
0
answers
33
views
Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?
Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:
mov rax, cs:KeDelayExecutionThrea
lea r8, [rsp+28h+arg_0]
xor edx, ...
- 479
2
votes
0
answers
27
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 479
2
votes
0
answers
73
views
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
- 101
2
votes
1
answer
75
views
IDAPython's FlowChart wrong basic blocks
I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA.
As you ...
- 121
4
votes
2
answers
194
views
IDAPython set name of function using string passed to debug logging subfunction
IDA Pro 7.6
Static disassembly of ARM executable.
This binary has 40K functions or so, and no symbols. So all the functions are sub_49FFA etc.
However, 90% of these functions have a call to a debug ...
- 83
1
vote
0
answers
118
views
Access RTTI class hierarchy along with offsets from IDAPython
Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI.
When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
- 248
3
votes
0
answers
214
views
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.
Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.
refer:...
- 213
3
votes
1
answer
66
views
Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?
I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M).
Looking at the idapython documentation, it looks like maybe I can do this via the ...
- 206
2
votes
0
answers
128
views
IDA api: get function argument definition
So let's say we have the following code:
0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
- 41
2
votes
0
answers
184
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
1
vote
0
answers
18
views
How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
- 111
1
vote
1
answer
140
views
How to call the Color Picker window in Ida Pro from a script?
I'm going to make a python script that allows you to color selected functions - in the right colors.
To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
user42316
0
votes
1
answer
114
views
ida pro: scripting debugger with python fails on step_over/run_to
So I am trying to run an app and collect information at certain points.
No biggie, right? Wrong. Check this simple example:
import ida_dbg
ida_dbg.step_over() #or runto()
eax = ida_dbg.get_reg_val(&...
- 423
3
votes
1
answer
178
views
How to select an item in IDAPython, in decompilation view?
I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures).
I have changed the arguments types for a list of ...
- 248
1
vote
1
answer
93
views
Why does tif.get_func_details sometimes only starts to work after decompiling the function?
I am going through a huge executable and am fetching information about functions arguments this way:
tif, funcdata = ida_typeinf.tinfo_t(), ida_typeinf.func_type_data_t()
assert ida_nalt.get_tinfo(...
- 248
0
votes
1
answer
325
views
IDAPython Get Function Parameter Type Name
I'm currently trying to make a hotkey to rename example functions sub_123450(aType* this, void* a2) to aType::123450(aType* this, void* a2). I have code to rename etc. but how can I get the name of ...
- 85
0
votes
2
answers
155
views
Renaming a local stack variable with IDAPython
I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so...
In my ...
1
vote
0
answers
32
views
How to find prolog with idapython in non-disassambled function raw bytes?
I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?
- 11
1
vote
1
answer
289
views
idapython: how to reset pointer type for variables
I am using IDA Pro 7.6 on win32 x86 binaries.
I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
2
votes
1
answer
254
views
how to get indirect callsite function return type and arguments
I am using idapython to get function return type and arguments @ an indirect call instruction.
I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
- 1,707
2
votes
1
answer
242
views
How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?
TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc).
In order to explicitly load a type library I can use ...
- 10.8k
0
votes
1
answer
759
views
idapython: how to get decompiler output corresponding to the indirect call
For, e.g. disassembler or IDA view:
Decompiler or Hex View:
I can get the decompilation of whole function using something like:
decompiled = ida_hexrays.decompile(ea)
But, in this way I get the ...
- 1,707
0
votes
1
answer
748
views
How do I enable Python on IDA 6.8?
I have a python dir within IDA 6.8 folder with idaapi.py, idautils.py, and idc.py. IDA doesn't seem to pick the Python scripting by default.
How do I enable it?
- 326
2
votes
1
answer
477
views
How to print disassembly code with IDAPython when IDA doesn’t detect it as code
I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA:
I want to print ...
- 21
1
vote
1
answer
107
views
IDA API: obtain operand size prefix (x64)
I am trying to tell apart the following two instructions:
8D 02 lea eax, [rdx] // auxfix = 0x1810
67 8D 02 lea eax, [edx] // auxfix = 0x810
The only difference is in the insn_t....
- 423
2
votes
1
answer
2k
views
Is there a way to install Python 3 modules into IDAPython with pip?
I would like to use regular python packages in my IDAPython scripts, but I can't figure out how to install them into IDA's Python environment. I don't even know where this python environment is, or ...
- 163
0
votes
1
answer
839
views
IDAPython - How can I read the value of a function argument? (IDA 7.6)
I'm trying to automate some of my debugging with a python script that automatically places breakpoints at the first and last instructions of the functions I want to analyze. I'm using the breakpoint's ...
- 163
1
vote
1
answer
332
views
Automatically propagate types in IDA pro when variables are assigned?
Let's say I have this code in the decompiler of IDA pro:
var1 = var2;
And assume the type of var1 is X (for example X could be char array with size 5). Is there anyway that I can tell IDA that ...
- 479
1
vote
1
answer
196
views
IDA: close without saving changes
In my work, I often end up with lots of IDA windows open concurrently. Once done with analysis, I would like to close them all. It is relatively easy to issue a command to all of them simultaneously e....
- 135
3
votes
1
answer
809
views
How to create and change variables at address in IDA Python?
I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it.
For structs, there's ...
- 266
0
votes
1
answer
291
views
How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)
In IDA Pro, when you create a custom struct, apply it to a local variable, and try to check every member of it in the decompiler mode, when you hover your mouse on the variable, it only prints limited ...
- 479
1
vote
1
answer
255
views
How to print custom name of an operand in IDA Python?
I'm starting to work on a plugin to port symbols(stack variable names, operand names, comments, etc) from functions in one database to functions in another database when function names match.
I'm ...
- 23
1
vote
1
answer
896
views
How to get function signature using IDA Python in IDA Pro
I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names.
I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
- 11
1
vote
1
answer
197
views
Can I get loaded pdb file path from IDAPython?
IDA Pro can automatically download and load .pdb files from symbol server.
And now I want to write an IDAPython plugin to obtain some data from the .pdb file.
But I don't know how to get the file path ...
- 127
2
votes
1
answer
130
views
How to open watch view using IDAPython?
I want to open the watch view and add watch in code. Do you know how? I didn't find open_window_ for it. I couldn't understand which function to use with BWN_... or IWID_... constants ( IWID_WATCH ...
- 21
0
votes
1
answer
166
views
idapython: type information with different prefixes
I checked how to get type information here - https://www.hex-rays.com/products/ida/support/idapython_docs/ida_typeinf.html
Although, I am not sure what these different type prefixes mean. For e.g. BT_{...
- 1,707
0
votes
1
answer
80
views
Functions and methods for working with AST tree
I am implementing deep search with Python Hex Ray API.
Can someone say classes and methods for implementing this feature with the IDA Python API?
- 43
0
votes
1
answer
749
views
IDAPython: function parameters and return value
I want to get a function's signature information: return type and parameters from x64 binaries. I am able to achieve so, using
tif = idaapi.tinfo_t()
ida_nalt.get_tinfo(tif, ea)
function_type = tif....
- 1,707
1
vote
1
answer
288
views
Analyze Arm Linux CPP binary in Ida Pro
I tried to open CPP binary with Ida. Most of the code analyze well .
The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
2
votes
1
answer
168
views
IDA Pro: unknown warnings
I am using IDA pro to analyze an old nginx binary. I am getting following warnings which I have never seen before. Does anyone have an idea about these warnings?
IDA is analysing the input file...
You ...
- 1,707
3
votes
1
answer
205
views
Find all x-ref with specific argument with IdaPython
I have a function at 0xabcd that is called a few times like Func(1,2,3) and Func(4,4,5).
I want to find all the references where the third argument is 5.
import idautils
for f in list(idautils.XrefsTo(...
- 183
0
votes
1
answer
1k
views
Get instruction by address with IDAPython
I want to get an instruction with IDAPython by address of this instruction.
For example from mov r0 r1 I want to get only mov.
How can I do that with IDAPython?
- 1
1
vote
1
answer
333
views
How to force IDA to analyze a function immediately? [duplicate]
I think my question is probably related to this one:
API to force reanalyze of function (Alt-P)
When I define a function at a certain location with IDAPython, I want IDA to analyze it immediately, ...
1
vote
1
answer
79
views
Does COT_HELPER have arguments/operands?
I am trying to learn the hexrays ctree api. I am using the python bindings.
The task I am trying to automate is tracing the arguments to wrmsr instructions.
I notice that hexrays represents them like ...
- 1,226
1
vote
1
answer
256
views
IDAPython: Is it possible to determine whether an instruction operand is a constant rather than a variable?
Here is my use case:
I am trying to create a script that finds all instances of a particular instruction (in this case wrmsr) and traces back to find out whether the operands for the instruction are ...
- 1,226
2
votes
1
answer
51
views
BaseHTTPRequestHandler + ThreadingMixin = unclosed port
In developing a RESTful API for IDA >= 7.5 [https://github.com/sfinktah/idarest75], I have observed that a standard threaded webserver does not release it's socket when IDA terminates, unless it is ...
- 300