Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

1
vote
2answers
55 views

Get Multiple Function Names for One Address in IDA

I am trying to get a complete list of symbol names in IDA. All functions that return names operate primarily around looking at particular addresses and there corresponding entries in the symbol table, ...
1
vote
2answers
88 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
0
votes
0answers
24 views

How to start remote debugging in IDA Pro use IDC or IDAPython?

IDA Pro has remote debugging function. Some parameters are invisible characters and cannot be copied into the “parameter” edit box. So I want to start remote debugging with IDC or IDAPython. Do you ...
0
votes
0answers
41 views

Adding new type libraries in IDA

While I'm reversing a binary, I found out that the binary is dynamically loading a GetHashFromFileW function from mscoree.dll, using LoadLibrary and GetProcAddress. The type information of this ...
0
votes
0answers
26 views

Getting function arguments with IDA: When do function prototypes exist?

This post explains how to get function arguments using idapython. However, I read here that get_arg_addrs() requires the prototype of the called function to be present. My question: In which cases ...
0
votes
0answers
30 views

IDA Pro idapython miss to recognize the functions?

When I use the above idapython script to output all functions which belong to '.text' segments, it is missing some functions. For example, from the screenshot, the script will miss the function "...
0
votes
0answers
35 views

IDA 6.6 + Python

A reaaaally dumb question. I have IDA 6.6 (x64) and Anaconda Python 2 installed in various environments in Anaconda. If I export it to IDA via %PATH%, it tells me: LoadLibrary(<path>\ida66\...
1
vote
0answers
63 views

API to force reanalyze of function (Alt-P)

Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml) Is there a way to do this through API?
1
vote
1answer
24 views

idapython cfunc_t.treeitems always empty

I am using the hexray api to get all the items of the AST tree (the ctree) obtained by decompiling a function. Unfortunately, the treeitems vector is always empty. Specifically, the function paaaa in ...
3
votes
1answer
114 views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
3
votes
1answer
84 views

IDA 7.0 - combine sequence of assembly instructions to a macro

I'm solving this CTF with IDA Pro 7.0. At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it. The main problems are: the ...
0
votes
0answers
23 views

Specify address as a string using IDAPython [duplicate]

I have the following instruction: LOAD:8F64EC7C MOV R2, #0x8F687ED4 Address 0x8F687ED4 is the string "%08x%08x%08x%08x". If I wanted to manually declare the address as a ...
0
votes
0answers
55 views

How can I find a sequence of opcodes in IDA?

I want to search for the following sequence of instructions in IDA: push 0 retn I tried: FindInstructions.py using: find("push 0; retn") This failed with the following error: Python>find("...
1
vote
1answer
71 views

How can I update IDAPython for IDA Pro?

IDA Pro currently runs with IDAPython 1.0. How can I update the IDAPython version? Will IDA Pro also run with later versions of IDAPython?
0
votes
2answers
97 views

How to search for Opcode 0xFF25 in IDA Pro?

I want to search for opcodes in IDA Pro like the following: 0xFF25 How can I do that?
1
vote
2answers
57 views

IdaPython Get Call Destination for Register Operand

I'm trying to determine the destination address for call instructions. I can get this for calls that use an immediate but not for a call to an immediate-assigned register. How can I get the address of ...
1
vote
0answers
26 views

IDAPython: Get the operand string without any substitutions [duplicate]

I would like to get the operands of assembly instructions; represented as strings, without any local-variable substitution (e.g. instead of [rbp+var_200] I want to get the actual [rbp+XXXX] offset ...
0
votes
0answers
18 views

IDC - How to apply type - ApplyType?

How do I apply a type to function - no-matter what input I always get 0. Here is my script: // // This example shows how to get list of functions. // #include <idc.idc> static main() { ...
0
votes
1answer
58 views

IDAPython Script works from “Script File” but not when run with -S from Terminal

I'm trying to run an IDAPython script in IDA 7.1 on Windows 10 and it runs just fine when I run it from the Script File... command, but if when I run it from the command line it isn't working properly....
2
votes
1answer
131 views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
1
vote
1answer
66 views

IDA Python call func from idb names with specific arguments

I'm new in IDA Python, so the question is hard for me. I didn't find any solution in google, so I have to ask for the help there. During code analysis I found decryption function. There are about 1000 ...
3
votes
0answers
61 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
-1
votes
1answer
128 views

Install and configure script language bar on IDA from IDC to Python

I'm new in the field of reverse engineering to detect malicious code in ELF file. I installed IDA on Ubuntu (https://www.hex-rays.com/products/ida/support/download_freeware.shtml) then follow guide ...
1
vote
0answers
48 views

Getting R6034 error message when starting IDA Pro

I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
1
vote
0answers
42 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
4
votes
2answers
240 views

idapython - assign a struct to a stack variable

I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do Alt+Q); Doing this for addresses in .data is not a problem, but I can't figure out a way to ...
2
votes
1answer
100 views

IDC: Get structure id under cursor in “Structures” window?

I'm writing an IDC script which accepts a structure and does some processing. Currently, I have to call it by typing structure names. What I want is to make it use the structure under cursor in "...
4
votes
1answer
290 views

IDA: Changing type of arguments to local type

I have functions foo_0(...,_ v0,...) foo_1(...,_ v1,...) ... And, for each (foo_x, _ v_x) pair, I would like to change the type of v_x in the declaration to ANIMAL *, where ANIMAL is a local type. ...
1
vote
0answers
41 views

idapython:How can I get xref to a stack variable in the form of pseudocode

I have learned about how to get xref to a stack variable,but it is in the form of assembly:idapython - Get Xrefs to a stack variable This way works well on a variable like [ebp+var_0] but do not ...
2
votes
2answers
459 views

IDA Pro - how to export a listing file in batch mode

I am using IDA Pro 6 and I'm looking for a way to automatically export an analysed file into a listing (.lst) file. The interface of IDA enables to do this action using the menu File > Produce File > ...
1
vote
1answer
179 views

How can I mark a global variable as an offset using IDAPython?

I have a four byte global variable that is a pointer to some other data. How can I mark this to be an offset (like pressing o) using IDAPython? .text:00436FF3 dd 43702Ch ida_offset.op_offset_ex ...
1
vote
0answers
176 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
0
votes
1answer
191 views

How to force IDA pro to list some bytes as a specified instruction?

Please first read this My previous question, and then continue the following: **** The binary file size loaded into IDA is 0x1e400 = 123k, and when I try to only change the "Loading address" to ...
2
votes
1answer
153 views

How to modify strings and funtions reference detection in IDA pro?

I have loaded a binary file into IDA which is for Motorola 6800 series. The strings are referenced like this: pea ($2017A99).l. The actual address of the referenced string in above command is ...
2
votes
1answer
1k views

IDAPython: How to get function argument values

I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example,...
0
votes
1answer
115 views

calc_switch_cases() in IDApython, can't iterate over results

i'm actually quite new to IDApython programing and i'm trying to get, for a "switch-case" jump table, the list of basic blocks for a given value of the case. While experimenting, i was trying to ...
0
votes
0answers
251 views

IDAPython: get memory address from an instruction operand

do you know how to get the memory address from an instruction operand in idapython? for example if i have mov eax, [ebp+16] can I know the value of ebp+16? idc.GetOperandValue return 16 and not the ...
-1
votes
1answer
180 views

Dis-assamble .exe file to .asm in IDA Python [closed]

I have 5K .exe files from different sources like C and C++. I want to Dis-assamble them into .asm file using IDA Python. Consider this .exe file opened in IDA with text view: I want this "Assembly" ...
1
vote
1answer
750 views

Running script on the command line with IDA Pro 7.0

I'm trying to run a script with IDAPython on Windows: PS: C:\Users\user\Downloads> ida.exe -S"tmp.py" -t >> PS: C:\Users\user\Downloads> and I had to press Ctrl+C to get out of the >&...
1
vote
1answer
266 views

IDA Pro using Brew installed Python

Has anyone found a way to change the python installation used by IDA Pro? Using the system python on a Mac isn't terribly exciting.
0
votes
0answers
85 views

How can I identify the type of instructions and the type of operand

I was wondering how can I identify whether one insrtuction is a transfer instruction or an arithmetic instruction and how can I identify whether one operand is a string constant or a numeric constant?
0
votes
1answer
230 views

How to extract the automatic comment for these data items in IDA?

So I'm seeing this a lot in an IDA database: ; wchar_t off_BADF00D off_BADF00D dd offset loc_6F0062 dd offset loc_740074 dd offset loc_6D006E+1 ...
1
vote
1answer
170 views

What is an efficient way to scan for a given import function across modules in IDAPython?

I am writing a script which should first place a breakpoint on start, _start, _main, or main and then start the IDA Pro debugger. It then should enumerate the modules looking for "kernel32.dll" and ...
4
votes
1answer
970 views

IDA Script, Get Function Name That has random Characters involved in name

I was trying to figure out if there is a way I can get the address for a function name that has random characters in it. For example the function name is "Player_GetStats_m29275" here the "m292755" is ...
1
vote
2answers
564 views

How can I load C header file with IDAPython in IDA Pro?

How can I load C header file with IDAPython in IDA Pro? I'm trying automatically load C header file with IDAPython, such as Load("filename.h").
1
vote
2answers
423 views

IDAPython: How to check if an instruction is a conditional branch or jump?

I want to know using IDAPython if an instruction at the end of a basic block is a jump/branch instruction (like B or JNZ) and also determine if it's conditional or not. I need it in a CPU agnostic way,...
3
votes
1answer
698 views

How do you rename a memory address operand in IDAPython?

I need to rename some memory address "names" in IDAPython. I'm talking about the dword_805672 formatted ones. Please see the screenshot below: I've placed red boxes around the names which I would ...
1
vote
2answers
178 views

What is a more efficient way to locate disasm patterns in IDAPython?

This is my first "serious" IDAPython script. As I sorta suspected, it's performing waaaayyyyy too slow so I wanted to ask for some pointers on this: fp = MinEA() end = MaxEA() while fp < end: ...
5
votes
2answers
2k views

IDA python, write to specific memory location

I am looking for a way to modify memory location in IDA python script. We can read memory with these functions: Byte(address) Word(address) Dword(address) When I try to do something like this: Byte(...
2
votes
0answers
131 views

How do I read over an undefined function with IDAPython?

I have a pretty basic IDAPython script which finds indirect calls by using idc.FindText() and then extracts the arguments. It works great except that it does not find the indirect calls in undefined ...