Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
1
vote
1answer
45 views

IDApython - Turning a modified operand into a string reference

I am working on an IDAPython script that is supposed to fix the disassembly of a firmware, by resolving it's symbol table. The core of the script is working fine, but I have some issue when it comes ...
1
vote
1answer
109 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
3
votes
1answer
232 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
2
votes
2answers
470 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
2
votes
2answers
859 views

IDA Python - Find highlighted register

In IDA's Graph View, when we select some register (for example, esp in the image below), every location that the register occurs is highlighted. Is it possible to read what the selected operand is? (...
2
votes
2answers
74 views

ida_hexrays.lvar_t.stk.get_stkoff() incorrect ± 0x10

When using the stack offset for a variable obtained via ida_hexrays.lvar_t.stk.get_stkoff() or ida_hexrays.vdloc_t.stkoff() the results vary between "correct", and 8 or 16 bytes out as ...
1
vote
0answers
26 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
0
votes
1answer
33 views

How to work on diffing result generated by bindiff

I am new to reverse engineering, How to work on the diffing results(Similar function) generated by Bindiff using IDAPython. *work is like finding no basic blocks, no of edges
0
votes
2answers
52 views

Import header files in IDA to get the struct definitions?

I am reversing a program that has a lot of internal structs in it. The problem is that there are a lot of structs, so i can't import them manually using local types->insert. Lets say i have some ...
1
vote
0answers
15 views

How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?

Lets say there is a variable x in f1, and f1 calls f2 with the variable x I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
-1
votes
0answers
60 views

Export / Convert Ghidra database (GZF) to IDA database (IDB)

I am deeply frustrated after spending the last days searching for a way to do what the title of the question says, but all I could find was IDA database -> Ghidra database conversions. I have found ...
1
vote
3answers
3k views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
0
votes
2answers
63 views

Is it possible to “jump” to another address when script detects jmp?

here is the original C++ source code of the executable that I've created to do simple RE #include <iostream> void myFunction() { printf("Hello!"); } int main() { myFunction()...
0
votes
2answers
36 views

Determine if there is a cross reference using idapython given a specific address

I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from) ea_start = # ea_end = # for ea in ...
0
votes
2answers
71 views

How to parse the NT headers and section headers of a PE file using IDApython?

I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
0
votes
1answer
44 views

how to call the function from IDAPython with passing arguments by manually push them to the stack

would you please tell me how to call the function from IDAPython code ?
 I want to simulate it by manually push to stack as the two arguments and calling the function.
0
votes
2answers
40 views

How to get dynamically changing xrefs with IDAPython

There is a situation where the number of xrefs for a function is dynamically increasing due to the dynamic creation of memory with execution rights attached by VirtualAlloc. I want to get the xrefs of ...
1
vote
1answer
95 views

How to deal with IDA auto-analysis analyzing invalid paths?

Obfuscation techniques such as opaque predicates often trick IDA's auto-analysis into creating incorrect or contradicting interpretations of the code under analysis. There is some mention of ...
0
votes
0answers
27 views

how highlight multiple word in ida assembly view? (already know method in graph view, but dont work in text view)

like set different bg or fg for two keyword : eax and ecx (or hex ) not line highlight .... in graph view , i found a plugin to do this by hook graph node text , but no search result for text mode ...
0
votes
1answer
37 views

How to show the save dialog box with IDAPython?

I want to some strings to the text-file which is chosen from the save dialog box. Is there any way to show the save dialog box by IDApython and how to write the script code about that ?
0
votes
1answer
66 views

(IDAPython)How to get the function name string from the Function address?

For example, in the Registers windows of IDA pro, It show the following. ( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.) EAX 766D32B0 WS2_32.dll:...
0
votes
1answer
31 views

Is there any way to STOP the loop of the IDApython?

Is there any way to STOP the loop of the IDApython ? I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
0
votes
1answer
190 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
1
vote
1answer
282 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
3
votes
2answers
1k views

IDA basic block type fcb_cndret - what does it mean?

IDA Pro's idaapi.BasicBlock objects returned by idaapi.FlowChart() can be of the following types (see gdl.hpp in the SDK sources): // flow chart block types enum fc_block_type_t { fcb_normal, // ...
2
votes
2answers
2k views

Hex-Rays and IDA Python plugin loading order

I have made a plugin (using IDA Python) that requires the Hex-Rays plugin. As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
0
votes
2answers
134 views

Find assembly in binary with ida python

I want to find 2 consecutive instructions with Ida python move r2,r3 ; move r2 r4 What is the easy way to find the addresses of that with Ida python? I can Iterate on all Functions and for each ...
0
votes
0answers
24 views

propagate manually set types to redefine a function in IDA pro?

Is there anyway in IDA pro to propagate manually set types of variables to redefine function arguments? for example lets say IDA thinks Func1 takes 4 int as INPUT, now when i set the type of these 4 ...
0
votes
0answers
31 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
0answers
26 views

HexRay API - Programatically rebaseing program on firmware

I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
2
votes
0answers
77 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
0
votes
1answer
133 views

IDAPython Export All Addresses Called by Specific Call

The following call gets executed many times and jumps to many subroutines. call [rbp+var_s38] What do I need to write in the breakline condition to export all the locations it jumps to? import ...
4
votes
3answers
6k views

How to get the list of strings within IDA's string window in my script?

I'm trying to write some scripts that do some string searching through the disassembly in IDA. Currently, I loop through all the disassembly, MinEA() to MaxEA() and use idc.FindText() to see if a ...
0
votes
1answer
42 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
0
votes
1answer
64 views

Ida python find function address that using string

I have string at address 0xaaaa that I want to know the address of function that use this string import idautils len(list(idautils.XrefsTo(0xaaaa,1))) return 0 Why is that ? When I tried this code ...
1
vote
1answer
227 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
0
votes
1answer
51 views

How to parse the IAT using IDApython?

Is it possible to parse the IAT using IDApython? i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
0
votes
0answers
49 views

Parsing binary file to Idb faster with Ida

When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores? Is there any way to make that process faster? run it on all ...
1
vote
1answer
84 views

Analyze stack with IDAPython

In Ida pseudo-code when I press at stack's variable I can see the place of this variable in stack. char buffer[XXX]; // [sp+YYh] How can I get that information (buffer size and place of this buffer ...
4
votes
3answers
2k views

Change block/node color with idapython

How can I change color of node (or block?) with idapython? I know about SetColor, but this function does not work with blocks/nodes. EDIT: Solved, see the code snippet below. def get_bb_id(graph, ea)...
0
votes
0answers
35 views

Use IDAPython to automatically attach to a remote GDB server

I would like to automate the process of connecting to a remote debug server. The following code worked for the remote win32 debugger: from ida_dbg import * set_remote_debugger(addr, port) ...
3
votes
2answers
232 views

MakeArray from stack variables using idapython

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...
0
votes
0answers
84 views

how to get all “called functions” in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
0
votes
0answers
124 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
1
vote
2answers
135 views

How to set conditional breakpoint to modify ZF (Zero flag)

In IDA I need to set a breakpoint that once it hit, I want to check if ZF is equal to 1, if it does, I want to change it to 0. I don't know how to do it: I searched for example scripts in IDC or ...
0
votes
0answers
255 views

How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
2
votes
1answer
716 views

Can I use python3 with IDA 7.0?

Got IDA Pro 7.0 (I can't update at the moment), I'm currently unable to use idapython. I have python3.8 installed on my machine and nothing else (I dont want any collisions). How can I use make ...
1
vote
1answer
146 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
0
votes
1answer
288 views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...
0
votes
0answers
52 views

Checking if a call is a API/Library call in IDApython?

I asked the question a while ago but found no answer so I'm trying my luck again the only solution is this : Finding all API calls in a function but it doesn't work when the library call is a .NET ...

1
2 3 4 5 6