All Questions

Tagged with
Filter by
Sorted by
Tagged with
0
votes
0answers
5 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
1answer
109 views

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
0
votes
1answer
72 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
0
votes
0answers
29 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...
2
votes
2answers
540 views

Use idapython to print register or memory value when the debugger is running

I want to record the value of a certain register or specific memory location when the program is being debugged. e.g. in the following segment: .text:0FD6268D shr ecx, 4 .text:...
1
vote
1answer
858 views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
1
vote
0answers
69 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
3
votes
1answer
300 views

IDA 7.0 - combine sequence of assembly instructions to a macro

I'm solving this CTF with IDA Pro 7.0. At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it. The main problems are: the ...
-1
votes
1answer
473 views

Install and configure script language bar on IDA from IDC to Python

I'm new in the field of reverse engineering to detect malicious code in ELF file. I installed IDA on Ubuntu (https://www.hex-rays.com/products/ida/support/download_freeware.shtml) then follow guide ...
1
vote
0answers
172 views

Getting R6034 error message when starting IDA Pro

I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
-1
votes
1answer
333 views

Dis-assamble .exe file to .asm in IDA Python [closed]

I have 5K .exe files from different sources like C and C++. I want to Dis-assamble them into .asm file using IDA Python. Consider this .exe file opened in IDA with text view: I want this "Assembly" ...
2
votes
1answer
792 views

Identify the porcessor type of a binary

There are different ways to identify the processor type such as using IDA or file command in Linux. But sometimes the processor type is not detected by these tools. Besides I do not have the correct ...
2
votes
1answer
723 views

IDAPython: Change struct member content name

tl;dr I have an array of structs, I'd like to iterate over it and change fields content, (name, values), upon simple conditions. I can get the offset of the members, but I can't modify them due to the ...
2
votes
1answer
1k views

Batch mode of ida pro 6.5

i have tried almost all links about batch mode. My Question is that i did not get the user manual about batch mode of ida pro that how can i use the commands like -c -A -B and how i can run script on ...
3
votes
2answers
2k views

How can I call IDA Pro's MakeCode for one instruction at a time?

I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately. I ...
6
votes
1answer
7k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
2answers
2k views

How to Find All Switch Jump Tables in IDAPython

I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly: jmp ds:off_65018790[ecx*4] ; switch jump ...
4
votes
1answer
7k views

Executing an IDAPython script with arguments within IDA Pro

I have an IDAPython script x.py which takes some arguments, which prevents me from simply using alt + F7 and selecting my script. How can I execute this script within IDA Pro and specify the ...
1
vote
1answer
582 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
2
votes
1answer
1k views

Hex-Rays and IDA Python plugin loading order

I have made a plugin (using IDA Python) that requires the Hex-Rays plugin. As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
4
votes
3answers
2k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
2
votes
0answers
690 views

IDA Pro get line number in main view

I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
3
votes
1answer
912 views

IDA Pro Dump of instructions and offsets

I'm writing a plugin for IDA PRO with IDAPython and I need to make a dump of the full disassembled code with offsets. I know I can export a html file and then parse it but I cannot call the ...
7
votes
1answer
637 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
1
vote
0answers
409 views

Using MyNav Python Scripts With IDA Pro 6.1 On Windows 7

I just came across the MyNav Python scripts and would like to use some of their functionality on my IDA Pro database. I have IdaPython installed properly, but I cannot seem to get the plugins to show ...
4
votes
1answer
1k views

IDAPython Strings constantly returns NoneType with str()

I'm trying to automate disassembly of a firmware image using IDA Pro 6.5 and IDA Python. One of the process I want to implement is to locate strings and create a data segment around them. Using the ...
2
votes
2answers
2k views

Automatic generation of call graph in IDA Pro

I want to generate call graph from Ida pro but I want to do it automatically. I wrote these two scripts but they did not work. Could you help me what is the problem? 1: #include ida.idc; #include ...
2
votes
1answer
490 views

IDA Plugin/Script Output File Character Limit?

I am currently working on both a plugin and an ida-python script that export fairly big JSON files. I just noticed, that both will at times cut off the output files with no error message. Sometimes ...
1
vote
1answer
1k views

Calling functions from IDAPython

I wrote a script containing several functions, which I loaded in IDA pro. From IDAPython now I'd want to call a specific function. Is it possible? Which idaapi functions should I use to call my ...
1
vote
1answer
167 views

Is there anyway I can iterate all the C-level statements in IDA-Pro?

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. Suppose I only consider these statements: State :: = | if-else cond; |...
4
votes
1answer
2k views

Can I invoke IDA's plugin BinDiff from command line?

I am trying to evaluate a very large amount of binaries (thousands) using BinDiff, and currently I only need some instruction level statistics from BinDiff, which can be acquired from its dumped ...
2
votes
1answer
420 views

How to detect address changes in the IDA SDK?

I'm developing a custom memory viewer in Python for IDA. Obviously I need to know current EA. For now, I just ask user to supply it through AskAddr() and it works fine. However, I'd like my plugin to ...
1
vote
0answers
171 views

Changing the argument number in a macro in IDA Pro

Can I change argument number to macro in IDA pro Hex-rays? fd = open("a", 513, 0644); Like this. fd = open("a", O_WRONLY|O_CREAT, 0644); Is this possible?
5
votes
2answers
2k views

IDAPython for IDAFree 5.0

I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can ...
2
votes
2answers
979 views

Detecting epilogue/prologue of functions [closed]

I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
1
vote
1answer
2k views

Why I can not find all the functions using this IDC script?

On Linux 32 bit, I use IDA Pro + IDC script to dump all the functions. Here is part of the script: addr = 0; for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) { name = ...
1
vote
2answers
4k views

How to extract all the rodata data and bss section using IDC script in IDA Pro?

test Platform is 32 bit Linux ELF and 32 bit Windows PE. I use IDC script to extract all the functions from binary and dump into a file, then do the analysis based on the examples in IDA Pro book. ...
4
votes
1answer
2k views

IDA Pro/IDA Python, producing file via terminal

I am using IDA Pro 6.5 and running it via terminal with the following command line switches: -B (to run in batch mode, should automatically generate a .asm file containing results) -S running a ...
4
votes
2answers
2k views

IDA Pro converting to instruction functionality: how to automate.

I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit "c" in order to convert to instruction/code. However, I am ...
1
vote
2answers
572 views

Cross-referencing object fields

I'ld like to see which functions are operating with certain object's fields that I already processed, meaning I created the structure and assigned it to the correct places in the functions in IDA, ...
3
votes
0answers
294 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
4
votes
1answer
440 views

Formatting BinDiff results to a .txt

I have been using BinDiff as a plug-in for IDA Pro. I understand it is not possible to run this plug-in via terminal/batch mode. Is there a way I can export the results to a more readable format such ...
6
votes
2answers
1k views

IDA Pro/IDAPython automation through IDAPython

I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the ...
17
votes
3answers
9k views

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
5
votes
2answers
2k views

IDA [call $+5 / pop reg] cleaning

Can anyone tell me how to clean up the code which contains the following blocks: call $+5 pop reg add reg, 08BE96h [...] In other words I need to change all such blocks to: mov reg, offset Edit # ...
8
votes
1answer
5k views

How can I control the Hex-Rays decompiler plugin from IDA with scripts?

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....