Skip to main content

Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
1 vote
3 answers
606 views

IDAPython: error executing init.py

When I open Ida Pro 8.3 I see an error message IDAPython: error executing init.py: No module named imp Refer to the message window to see the full error log. i have python 3.12.3 and i ran as ...
0 votes
1 answer
111 views

IDA Pro Debugging GDB SendDbgCommand

I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging. Setting up the debug environment with IDA Pro using ...
4 votes
1 answer
7k views

Setting name of (newly created) functions via IDAPython

Is there a way to specify the name of a function when creating it with idc.MakeFunction()? If not, what is the best practice to rename a function? I found idc.GetFunctionName(ea) but no counterpart ...
0 votes
1 answer
255 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
2 votes
1 answer
191 views

How to open watch view using IDAPython?

I want to open the watch view and add watch in code. Do you know how? I didn't find open_window_ for it. I couldn't understand which function to use with BWN_... or IWID_... constants ( IWID_WATCH ...
4 votes
1 answer
594 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
0 votes
1 answer
156 views

idat.exe -S, path with spaces

I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so But I get an error. Among the logs is present the error: home\mypath: ...
1 vote
1 answer
849 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
0 votes
1 answer
89 views

IDA - Decoding this "XORed"? string automatically in psuedocode

__m128i ModuleName; __m128i ProcName; ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64; ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64; ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64; ProcName....
0 votes
0 answers
27 views

How to access the demangled auto comment?

In this example, IDA has demangled the boost::fibers::context::active name normally, and you can access that name with ida_name.get_ea_name(ea, GN_SHORT|GN_DEMANGLED|GN_VISIBLE). But the function name,...
0 votes
0 answers
19 views

How can I use ptr to ptr in idapython?

in hey-rays api there's a method: def find_def(self, *args) -> "minsn_t *": r""" find_def(self, op, p_i1, i2, fdflags) -> minsn_t @param op: mop_t const &...
0 votes
0 answers
37 views

Ida Pro: how do I iterate over all typedefs in python

I see how to iterate over all structs, unions, enums, functions. But I cannot find a way to iterate over all typedefs.
0 votes
1 answer
4k views

IDAPython: error executing init.py:

When I open Ida Pro 7.3 I see an error message IDAPython: error executing init.py: nothing to repeat Refer to the message window to see the full error log. How can I understand what is the problem? ...
0 votes
2 answers
114 views

How to change default pointer size in IDA Pro

so, I'm writing a script to automate analysis, and the code I'm working with is 64bit. the pointer size field shown here is the wrong one: I want to change it from within python to 64bit. I've ...
2 votes
2 answers
2k views

Batch rename functions knowing their prototypes in IDA Pro

I have a long list of mappings from IDA function names (sub_??????) to known function prototypes. The prototype is complete, I mean it contains the return type, the name as in the code and the ...
5 votes
1 answer
7k views

IDA python, list all imported functions

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions: import idc import idaapi import idautils def set_breakpoints(): ea = idc.ScreenEA() ...
0 votes
2 answers
188 views

How to make a plugin python function available to IDA's console?

I want to have utility functions shared between all databases, for example: from idautils import * from idaapi import * from idc import * from ida_name import * def FindFunctionImpl(...
0 votes
0 answers
67 views

Import function symbols from a reflection system into IDA

I'd like to import structs and functions from a reflection system into IDA. The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
1 vote
0 answers
366 views

How to use IDA environment to run python scripts?

I am trying out following technique: https://github.com/CMUSTRUDEL/DIRTY This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset. It ...
0 votes
1 answer
72 views

My ida.reg file got deleted, is there any way to restore ida?

I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed - Is there any way to restore ida? ...
1 vote
2 answers
551 views

IDAPython: Is it possible to determine whether an instruction operand is a constant rather than a variable?

Here is my use case: I am trying to create a script that finds all instances of a particular instruction (in this case wrmsr) and traces back to find out whether the operands for the instruction are ...
0 votes
0 answers
76 views

IDA python : display not refreshing function parameters after type update

I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :) The issue : I have a ...
-1 votes
1 answer
242 views

Simple Question About Reversing a Python

So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of ...
1 vote
1 answer
257 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
0 votes
1 answer
104 views

IDA python API set function chunk end

I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
0 votes
1 answer
309 views

NameError: name 'ScreenEA' is not defined

Part of Practical malware analysis Lab5, is to run a python script in IDA Pro I have tried by going to Files-->Script command then I have pasted my python code: sea = ScreenEA() for i in range(...
0 votes
1 answer
96 views

How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?

Is there an API which lets me programmatically: set the default string type (Setup) and rebuild the string list (Rebuild) ???
0 votes
1 answer
88 views

idat.exe -S -A close without error

I have developed a idapython script and I run it using the following command: idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so In myscript.py I appended the exit(0) in order to ...
1 vote
1 answer
245 views

How to quickly mark functions library in IDA Pro?

I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
2 votes
1 answer
447 views

IDA: Demangled name simplification in idapython

With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them. For example, the following function: Python> ida_name.demangle_name(idc....
4 votes
3 answers
2k views

How can I get the byte size of an operand in IDA Pro?

I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
4 votes
2 answers
1k views

idapython - assign a struct to a stack variable

I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do Alt+Q); Doing this for addresses in .data is not a problem, but I can't figure out a way to ...
1 vote
2 answers
2k views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...
0 votes
2 answers
2k views

idapython: how to get decompiler output corresponding to the indirect call

For, e.g. disassembler or IDA view: Decompiler or Hex View: I can get the decompilation of whole function using something like: decompiled = ida_hexrays.decompile(ea) But, in this way I get the ...
3 votes
1 answer
117 views

IDAPython get current module name in a debugger

I have a script that catches say a value of 666 in the RDX register and pauses debugging. The problem is, that this value might be added to the register by other modules aside from the main ...
1 vote
0 answers
88 views

How to remove a node in CTREE

Im learning about CTREE in IDA. Here is my ida decompiled code: v3 = 0; if ( !strcmp(Str1, "hello") ) v3 = 100; return a1 + v3; At this time, i just want to mess arround with CTREE ...
6 votes
2 answers
5k views

Ida Pro: parsing complex operand expression using IDAPython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
5 votes
1 answer
7k views

IDA Script, get function that has random characters in its name

I was trying to figure out if there is a way I can get the address for a function name that has random characters in it. For example the function name is "Player_GetStats_m29275" here the &...
1 vote
1 answer
153 views

How to call the Color Picker window in Ida Pro from a script?

I'm going to make a python script that allows you to color selected functions - in the right colors. To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
4 votes
0 answers
274 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
2 votes
0 answers
65 views

Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)

Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
3 votes
1 answer
121 views

How to highlight all external registers in a function

What I want: detect all potentially usercall, userpurge - functions; when entering the function, immediately see all external entities: arguments passed through registers; i.e., in order not to ...
7 votes
4 answers
3k views

Change block/node color with idapython

How can I change color of node (or block?) with idapython? I know about SetColor, but this function does not work with blocks/nodes. EDIT: Solved, see the code snippet below. def get_bb_id(graph, ea)...
2 votes
1 answer
5k views

Using Python 3.7 and 2.x in same IDA

I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7. Is there any way to run that Python 2.7 based plugin?
3 votes
1 answer
1k views

How to create and change variables at address in IDA Python?

I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it. For structs, there's ...
2 votes
0 answers
57 views

Is it possible to create nested memory mapped registers in IDA Processor Modules?

Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
1 vote
1 answer
229 views

IDAPython doesn't recognize function

I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
3 votes
0 answers
168 views

IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?

I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
2 votes
0 answers
59 views

Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?

Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following: mov rax, cs:KeDelayExecutionThrea lea r8, [rsp+28h+arg_0] xor edx, ...
2 votes
1 answer
210 views

IDAPython's FlowChart wrong basic blocks

I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA. As you ...

1
2 3 4 5
8