We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
0
votes
1answer
24 views

IDApython confused with get_32bit(ea) function behavior

I am using some code like this import idaapi print(idaapi.get_32bit(0x0055f4a0)) it must return 32 bit of address as int but it returns 1408011093 is it wrong conversion? its length is less ...
1
vote
1answer
92 views

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
1
vote
0answers
31 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
0
votes
1answer
54 views

How to set virtual `T` register programmatically in IDA Python?

It is trivial to do it with Alt+G command from GUI. However, when I set multiple breakpoints programmatically, IDA doesn't recognize them as "thumb" mode ones and sets T value at breakpoint address ...
1
vote
1answer
37 views

How to change IDA's name representation programmatically?

I've made a custom loader and processor. As I use segment to separate something, now I want my name automatically shows in the following form 9 dseg_1234 the same as 2, but without data type ...
0
votes
1answer
73 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
1
vote
1answer
65 views

How to get array size of a global variable using IDApython?

I can make an array using MakeArray. Is there a function to get the size of the array I've created? I've tried GetArrayId + GetLastIndex but it doesn't seem to work.
0
votes
0answers
67 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
0
votes
1answer
38 views

How do you get the operand data type using idapython?

I know I can set the operand data type of my disassembly using functions such as OpBinary, OpOctal,OpDecimal, etc. Now, I'm trying to get the current operand data type of my disassembly instead. For ...
1
vote
1answer
72 views

MakeArray from stack variables using idapython

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...
0
votes
1answer
74 views

IDAPython Export All Addresses Called by Specific Call

The following call gets executed many times and jumps to many subroutines. call [rbp+var_s38] What do I need to write in the breakline condition to export all the locations it jumps to? import ...
1
vote
2answers
89 views

Split IDA segment into sub segments

I'm reversing a firmware, that comes in one big binary chunk(.bin file). After some reversing, I could identify that the big bin has two segments - text and data. Now I want to split the original ...
0
votes
1answer
88 views

IdaPython aob search and rename example

Iv'e never used python before and in looking at other example I can't find what I'm looking for exactly so I have come here to humbly ask for an example script if anyone could be so kind, I am trying ...
0
votes
1answer
66 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
1
vote
1answer
71 views

IDA Copy structure from one database instance to another

This question sounds rather simple, but I can't seem to find any option for this. I'm basically re-creating another database instance of the same binary I already reversed and I want to copy some of ...
0
votes
0answers
53 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
0answers
26 views

Changing a string pointer while debugging

I'm facing an issue, and I'm not sure what is the best way to handle it. While debugging a program (x64, windows), the program copies certain string using errno_t strncpy_s(char *restrict dest, ...
0
votes
0answers
211 views

How to run python script in IDA PRO after each breakpoint?

I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error. I'm trying to find something like '...
0
votes
0answers
28 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...
0
votes
1answer
67 views

In IDA, i want to get symbol by using IDAPython

I'm currently reversing some C++ Binary (macOS Kernel Extension). But, there are a lot of vtable functions, so i want to make some vtable structures by using IDAPython. I know how to make structure ...
0
votes
0answers
37 views

Get and change function definition IDAPython

I was wondering if it is possible to retrieve the function definition at ea and eventually how to edit it. This feature should be in idaapi but unfortunately there's basically no documentation about ...
0
votes
1answer
647 views

How to deobfuscate native Android library obfuscated with OLLVM?

When I load the binay in IDA, all I can see are loads of .datadiv_decodeXXX... functions and this is because of OLLVM. I know it is possible as a Chinese article I found said they were able to ...
2
votes
2answers
498 views

Use idapython to print register or memory value when the debugger is running

I want to record the value of a certain register or specific memory location when the program is being debugged. e.g. in the following segment: .text:0FD6268D shr ecx, 4 .text:...
1
vote
1answer
125 views

How to get IOCTLs from all NtDeviceIoControlFile function call?

Inspired by this answer about RE-ing IOCTLs, I tried to get the IOCTLs from NtDeviceIoControlFile() syscall. Here is an example of that syscall in Beep() function in KernelBase.dll file: In x86_64 (...
2
votes
1answer
105 views

Get all ordinals from local types view [closed]

Is there a way to get all ordinals of the local types view with the ida python api? i have tried to get all ordinals for structs with: [ida_struct.get_struc(id).ordinal for _, id, _ in Structs()]. ...
1
vote
2answers
67 views

Idapython: adding links where a function address is loaded into a register

I'm writing an Idapython loader script to help reverse-engineer the firmware on an embedded system with a 68000 processor. Unfortunately I can't get a copy of the original C compiler used in order to ...
1
vote
1answer
811 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
1
vote
0answers
67 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
1answer
338 views

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

I've recently started writing a few IDAPython plugins or scripts instead of using the native SDK, but I think I did not really figure out which module(s) are recommended to be imported. Typically, my ...
2
votes
0answers
109 views

IDA rename argument in all xrefs to function

I have a function of the format: sub_ABCDEF(&global, "stringName", unimportantValue) push offset string mov ecx, offset global call sub_410010 That is called in several places, each ...
1
vote
2answers
170 views

Get Multiple Function Names for One Address in IDA

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
2
votes
2answers
251 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
0
votes
0answers
161 views

Getting function arguments with IDA: When do function prototypes exist?

This post explains how to get function arguments using idapython. However, I read here that get_arg_addrs() requires the prototype of the called function to be present. My question: In which cases ...
1
vote
0answers
253 views

API to force reanalyze of function (Alt-P)

Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml) Is there a way to do this through API?
1
vote
1answer
73 views

idapython cfunc_t.treeitems always empty

I am using the hexray api to get all the items of the AST tree (the ctree) obtained by decompiling a function. Unfortunately, the treeitems vector is always empty. Specifically, the function paaaa in ...
3
votes
1answer
363 views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
3
votes
1answer
290 views

IDA 7.0 - combine sequence of assembly instructions to a macro

I'm solving this CTF with IDA Pro 7.0. At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it. The main problems are: the ...
1
vote
1answer
127 views

How can I update IDAPython for IDA Pro?

IDA Pro currently runs with IDAPython 1.0. How can I update the IDAPython version? Will IDA Pro also run with later versions of IDAPython?
1
vote
2answers
1k views

How to search for Opcode 0xFF25 in IDA Pro?

I want to search for opcodes in IDA Pro like the following: 0xFF25 How can I do that?
1
vote
2answers
253 views

IdaPython Get Call Destination for Register Operand

I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of ...
1
vote
0answers
29 views

IDAPython: Get the operand string without any substitutions [duplicate]

I would like to get the operands of assembly instructions; represented as strings, without any local-variable substitution (e.g. instead of [rbp+var_200] I want to get the actual [rbp+XXXX] offset ...
0
votes
1answer
391 views

IDAPython Script works from “Script File” but not when run with -S from Terminal

I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....
2
votes
1answer
463 views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
1
vote
1answer
193 views

IDA Python call func from idb names with specific arguments

I'm new in IDA Python, so the question is hard for me. I didn't find any solution in google, so I have to ask for the help there. During code analysis I found decryption function. There are about 1000 ...
3
votes
0answers
131 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
-1
votes
1answer
463 views

Install and configure script language bar on IDA from IDC to Python

I'm new in the field of reverse engineering to detect malicious code in ELF file. I installed IDA on Ubuntu (https://www.hex-rays.com/products/ida/support/download_freeware.shtml) then follow guide ...
1
vote
0answers
169 views

Getting R6034 error message when starting IDA Pro

I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
1
vote
0answers
61 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
4
votes
2answers
461 views

idapython - assign a struct to a stack variable

I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do Alt+Q); Doing this for addresses in .data is not a problem, but I can't figure out a way to ...
2
votes
1answer
265 views

IDC: Get structure id under cursor in “Structures” window?

I'm writing an IDC script which accepts a structure and does some processing. Currently, I have to call it by typing structure names. What I want is to make it use the structure under cursor in "...