Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

71 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
6 votes
0 answers
712 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
w s's user avatar
  • 8,448
5 votes
0 answers
928 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
in3o's user avatar
  • 265
5 votes
0 answers
2k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
vdudouyt's user avatar
  • 171
4 votes
0 answers
226 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
R4444's user avatar
  • 1,797
4 votes
0 answers
511 views

Does IDA Freeware 8.x support plugins?

According to the information I searched, it is not supported in IDA 7.x and before. Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before. refer:...
huang's user avatar
  • 223
4 votes
1 answer
542 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
Misty's user avatar
  • 428
4 votes
0 answers
319 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
Fewmitz's user avatar
  • 1,022
3 votes
0 answers
147 views

IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?

I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
none32's user avatar
  • 111
3 votes
0 answers
324 views

How to print a manually defined struct in IDA pro while debugging?

Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members. Now if i have the variables'...
OneAndOnly's user avatar
3 votes
0 answers
145 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
Kolopoi's user avatar
  • 31
3 votes
0 answers
2k views

how to get all "called functions" in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
R4444's user avatar
  • 1,797
3 votes
0 answers
773 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
sborpo's user avatar
  • 131
3 votes
0 answers
527 views

getting the flags of an IDA name

IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc). So far all is good and ...
NirIzr's user avatar
  • 11.8k
3 votes
0 answers
227 views

How can I parse VMTs in IDA if I have the base address?

I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API ...
question_asker_777's user avatar
3 votes
0 answers
392 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
jbh's user avatar
  • 516
2 votes
0 answers
54 views

Is it possible to create nested memory mapped registers in IDA Processor Modules?

Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
none32's user avatar
  • 111
2 votes
0 answers
51 views

Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?

Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following: mov rax, cs:KeDelayExecutionThrea lea r8, [rsp+28h+arg_0] xor edx, ...
OneAndOnly's user avatar
2 votes
0 answers
61 views

Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)

Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
OneAndOnly's user avatar
2 votes
0 answers
277 views

IDA api: get function argument definition

So let's say we have the following code: 0: lea rax, [rbp+8] 1: mov rcx, rax 2: mov rdx, 5 3: call my_fun i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
xar3's user avatar
  • 41
2 votes
0 answers
218 views

Convert instructions to op code bytes in python script for IDA Pro

I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work. This is my python ...
Luca's user avatar
  • 121
2 votes
1 answer
175 views

How to open watch view using IDAPython?

I want to open the watch view and add watch in code. Do you know how? I didn't find open_window_ for it. I couldn't understand which function to use with BWN_... or IWID_... constants ( IWID_WATCH ...
Eyal's user avatar
  • 21
2 votes
0 answers
195 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
Peter Robertson's user avatar
2 votes
0 answers
211 views

Checking if a call is a API/Library call in IDApython?

I asked the question a while ago but found no answer so I'm trying my luck again the only solution is this : Finding all API calls in a function but it doesn't work when the library call is a .NET ...
OneAndOnly's user avatar
2 votes
0 answers
412 views

IDA rename argument in all xrefs to function

I have a function of the format: sub_ABCDEF(&global, "stringName", unimportantValue) push offset string mov ecx, offset global call sub_410010 That is called in several places, each ...
Stewart's user avatar
  • 95
2 votes
0 answers
520 views

How do I read over an undefined function with IDAPython?

I have a pretty basic IDAPython script which finds indirect calls by using idc.FindText() and then extracts the arguments. It works great except that it does not find the indirect calls in undefined ...
Roastbits's user avatar
2 votes
0 answers
1k views

IDA Pro get line number in main view

I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
zemnl's user avatar
  • 61
1 vote
0 answers
222 views

How to use IDA environment to run python scripts?

I am trying out following technique: https://github.com/CMUSTRUDEL/DIRTY This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset. It ...
R4444's user avatar
  • 1,797
1 vote
1 answer
360 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
valaGQ237's user avatar
1 vote
0 answers
70 views

How to remove a node in CTREE

Im learning about CTREE in IDA. Here is my ida decompiled code: v3 = 0; if ( !strcmp(Str1, "hello") ) v3 = 100; return a1 + v3; At this time, i just want to mess arround with CTREE ...
Brian MJ's user avatar
1 vote
0 answers
403 views

Access RTTI class hierarchy along with offsets from IDAPython

Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI. When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
overflo's user avatar
  • 268
1 vote
0 answers
34 views

How to find prolog with idapython in non-disassambled function raw bytes?

I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?
Jôsùå's user avatar
1 vote
0 answers
160 views

Passing a pointer to a pointer to a string with IDA Pro's Appcall

I need to call an encryption function in a program with the following signature (the second argument is returned): char** __usercall decode(char** input, char** output) As far as I can tell, Appcall ...
hacker1024's user avatar
1 vote
0 answers
594 views

IDA script: How to properly undefine a byte and then redefine code

I'm trying to correct the following instructions in IDA using a script: jnb short near ptr loc_1C61B1+3 It order to do this I'm running a snippet like this in a script: ida_bytes.del_value(...
user3238415's user avatar
1 vote
0 answers
140 views

How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?

Lets say there is a variable x in f1, and f1 calls f2 with the variable x I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
Notoriouss's user avatar
1 vote
0 answers
195 views

propagate manually set types to redefine a function in IDA pro?

Is there anyway in IDA pro to propagate manually set types of variables to redefine function arguments? for example lets say IDA thinks Func1 takes 4 int as INPUT, now when i set the type of these 4 ...
Notoriouss's user avatar
1 vote
0 answers
324 views

Parsing binary file to Idb faster with Ida

When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores? Is there any way to make that process faster? run it on all ...
Ida's user avatar
  • 11
1 vote
0 answers
399 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
R4444's user avatar
  • 1,797
1 vote
0 answers
6k views

How to change IDA to use Python 3.7 and not Python 2.7: "do not have the x86_64 architecture"

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
E235's user avatar
  • 583
1 vote
0 answers
169 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
Ronny's user avatar
  • 73
1 vote
0 answers
339 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
OneAndOnly's user avatar
1 vote
0 answers
290 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
OneAndOnly's user avatar
1 vote
0 answers
358 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
LUser's user avatar
  • 783
1 vote
0 answers
363 views

Get and change function definition IDAPython

I was wondering if it is possible to retrieve the function definition at ea and eventually how to edit it. This feature should be in idaapi but unfortunately there's basically no documentation about ...
G. Ramistella's user avatar
1 vote
0 answers
191 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
naveen namani's user avatar
1 vote
0 answers
588 views

Getting R6034 error message when starting IDA Pro

I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
pigeek's user avatar
  • 11
1 vote
0 answers
194 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
theTheodidact's user avatar
1 vote
0 answers
287 views

idapython:How can I get xref to a stack variable in the form of pseudocode

I have learned about how to get xref to a stack variable,but it is in the form of assembly:idapython - Get Xrefs to a stack variable This way works well on a variable like [ebp+var_0] but do not ...
YaFeng  Luo's user avatar
1 vote
0 answers
403 views

Is there a from...import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
sherlock's user avatar
  • 1,371
1 vote
0 answers
1k views

IDA: Extracting functions arguments from stripped binary

This thread describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0). Is it possible to extract such ...
Vahag Vardanyan's user avatar
1 vote
0 answers
788 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
agg3l's user avatar
  • 139