Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

68 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
759 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
5
votes
0answers
594 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
3
votes
1answer
232 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
3
votes
0answers
2k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
3
votes
0answers
359 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
3
votes
0answers
304 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
2
votes
0answers
77 views

Calculate stack layout with Ida Python

In Arm in the beginning of function push r4-r6,lr sub sp sp 0x4 In the end of function pop r4-r6,pc add sp sp 0x4 That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
2
votes
0answers
204 views

IDA rename argument in all xrefs to function

I have a function of the format: sub_ABCDEF(&global, "stringName", unimportantValue) push offset string mov ecx, offset global call sub_410010 That is called in several places, each ...
2
votes
0answers
449 views

API to force reanalyze of function (Alt-P)

Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml) Is there a way to do this through API?
2
votes
0answers
332 views

How do I read over an undefined function with IDAPython?

I have a pretty basic IDAPython script which finds indirect calls by using idc.FindText() and then extracts the arguments. It works great except that it does not find the indirect calls in undefined ...
2
votes
0answers
373 views

getting the flags of an IDA name

IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc). So far all is good and ...
2
votes
0answers
910 views

IDA Pro get line number in main view

I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
1
vote
0answers
26 views

How do I disassemble mips .o object files in ida elf 64bit

So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
1
vote
0answers
15 views

How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?

Lets say there is a variable x in f1, and f1 calls f2 with the variable x I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
1
vote
0answers
64 views

Replacing bytes from start of every function with IDA Pro

I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify. I want to just make each function return so I'm replacing ...
1
vote
0answers
68 views

Is there any way to apply FLIRT signatures through a script like idapython?

I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
1
vote
1answer
282 views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
1
vote
0answers
82 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
1
vote
0answers
126 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
1
vote
0answers
79 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
1
vote
1answer
227 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
1
vote
0answers
95 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
0answers
376 views

Getting R6034 error message when starting IDA Pro

I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
1
vote
0answers
102 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
1
vote
0answers
145 views

idapython:How can I get xref to a stack variable in the form of pseudocode

I have learned about how to get xref to a stack variable,but it is in the form of assembly:idapython - Get Xrefs to a stack variable This way works well on a variable like [ebp+var_0] but do not ...
1
vote
0answers
415 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
1
vote
0answers
311 views

Is there a from…import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
0answers
1k views

IDA: Extracting functions arguments from stripped binary

This thread describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0). Is it possible to extract such ...
1
vote
0answers
571 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
1
vote
0answers
249 views

IDAPython loading parameters bruteforce

I have a binary file for known hardware platform, but nothing more is known. When I load this file in IDA (with default parameters), nothing good happens - at least does not appear xrefs to readable ...
1
vote
0answers
299 views

Show IDAPython prompt

Subj hides itself on a mere Escape pressed in the input field. How to bring it back? I didn't find a way short of restarting IDA. It's IDA 6.1 x32 & IDAPython v1.5.2.
1
vote
0answers
149 views

Deducing register contents through IDA scripting

In some of my IDA scripts, it would be useful to be able to reason about which variables were stored in which registers at a given place in the program. One example is the following: mov rdx, [...
1
vote
0answers
459 views

Using MyNav Python Scripts With IDA Pro 6.1 On Windows 7

I just came across the MyNav Python scripts and would like to use some of their functionality on my IDA Pro database. I have IdaPython installed properly, but I cannot seem to get the plugins to show ...
1
vote
0answers
173 views

How can I parse VMTs in IDA if I have the base address?

I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API ...
1
vote
0answers
2k views

How to get opcodes for assembly using ppc processor (IDAPython)

In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the Assemble(ea, line) function. Here is an example using a PE-file / x86 processor type: Python>Assemble(...
1
vote
0answers
237 views

Changing the argument number in a macro in IDA Pro

Can I change argument number to macro in IDA pro Hex-rays? fd = open("a", 513, 0644); Like this. fd = open("a", O_WRONLY|O_CREAT, 0644); Is this possible?
0
votes
0answers
27 views

how highlight multiple word in ida assembly view? (already know method in graph view, but dont work in text view)

like set different bg or fg for two keyword : eax and ecx (or hex ) not line highlight .... in graph view , i found a plugin to do this by hook graph node text , but no search result for text mode ...
0
votes
0answers
24 views

propagate manually set types to redefine a function in IDA pro?

Is there anyway in IDA pro to propagate manually set types of variables to redefine function arguments? for example lets say IDA thinks Func1 takes 4 int as INPUT, now when i set the type of these 4 ...
0
votes
0answers
31 views

IDAPython NtCreateFile

Let's say I want to print the filenames on every call to NtCreateFile (With %any% exe loaded in IDA ) The first problem is to get the ntdll!NtCreateFile address Tried to do it like this ...
0
votes
0answers
26 views

HexRay API - Programatically rebaseing program on firmware

I am working on several firmwares (mostly ARM and PPC) that have no structure that IDA can decipher and so far I have been guessing BASE address until the functions and strings align with what I see ...
0
votes
0answers
49 views

Parsing binary file to Idb faster with Ida

When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores? Is there any way to make that process faster? run it on all ...
0
votes
2answers
133 views

Find assembly in binary with ida python

I want to find 2 consecutive instructions with Ida python move r2,r3 ; move r2 r4 What is the easy way to find the addresses of that with Ida python? I can Iterate on all Functions and for each ...
0
votes
1answer
64 views

Ida python find function address that using string

I have string at address 0xaaaa that I want to know the address of function that use this string import idautils len(list(idautils.XrefsTo(0xaaaa,1))) return 0 Why is that ? When I tried this code ...
0
votes
0answers
35 views

Use IDAPython to automatically attach to a remote GDB server

I would like to automate the process of connecting to a remote debug server. The following code worked for the remote win32 debugger: from ida_dbg import * set_remote_debugger(addr, port) ...
0
votes
2answers
36 views

Determine if there is a cross reference using idapython given a specific address

I want to end up in something like the following using idapython to determine if given a specific address there is an xref (without caring where the XREF comes from) ea_start = # ea_end = # for ea in ...
0
votes
0answers
84 views

how to get all “called functions” in idapython

I am using following function to generate a call graph using idapython: def generate_graph(): callees = dict() # loop through all functions for function_ea in idautils.Functions(): ...
0
votes
0answers
124 views

idapython: how to apply hexrays types to disassembly interface

I am using idapro 7.5 to get variable information from binaries. Consider following simple code: #include <stdio.h> #include <stdlib.h> int main(int argc, char *argv[]) { int i, N, ...
0
votes
0answers
255 views

How to change IDA to use Python 3.7 and not Python 2.7: “do not have the x86_64 architecture”

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
0
votes
0answers
15 views

How to get the color of a operand in IDApython?

Lets say there is a instruction, and the operand is pink, is there any API call that i can use to get the color of the operand? i searched in their documentation but only found GetColor API which ...
0
votes
0answers
29 views

Get the string usage sequence in each function with Idapython?

The only function i know for this task is idautils.Strings() but the problem is i need to get the sequence of string usage in each function, meaning that if string 1 was first referenced then string ...