Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
19 votes
3 answers
15k views

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
0xC0000022L's user avatar
  • 10.9k
17 votes
4 answers
15k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
Mick's user avatar
  • 7,542
17 votes
3 answers
6k views

How to debug an IDAPython script from within IDA?

IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
huyna's user avatar
  • 173
12 votes
2 answers
5k views

How to map an arbitrary address to its corresponding basic block in IDA?

Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that? Edit: more specifically, I want to know the beginning / end of ...
newgre's user avatar
  • 1,183
11 votes
2 answers
15k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
langlauf.io's user avatar
  • 1,550
10 votes
1 answer
6k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
Zach Riggle's user avatar
  • 2,317
9 votes
2 answers
7k views

Good training for IDAPython [closed]

I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
bravosierra99's user avatar
9 votes
2 answers
5k views

Is there a way to set the cursor address in IDA Pro?

In the same way that ScreenEA() returns the current cursor address, is there a way to set the address? Something that would resemble SetScreenEA()?
Derek's user avatar
  • 95
9 votes
2 answers
2k views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
Aviv's user avatar
  • 337
9 votes
2 answers
5k views

How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type

I'm writing an IDA plugin using idapython in order to add comments (located in database) to variables of struct types. In order to do this, firstly, i need to get the list of cross-references to a ...
Bingchang's user avatar
  • 103
9 votes
1 answer
6k views

How can I control the Hex-Rays decompiler plugin from IDA with scripts?

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....
nopnopgoose's user avatar
8 votes
2 answers
14k views

IDA Pro List of Functions with Instruction

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
WMIF's user avatar
  • 183
8 votes
3 answers
638 views

How can I clean up strings built at runtime (stack strings)?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
phoenix89's user avatar
8 votes
2 answers
5k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
Aviv's user avatar
  • 337
8 votes
1 answer
3k views

How is IDAPython API structured?

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
sherlock's user avatar
  • 1,361
8 votes
1 answer
4k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
defragger's user avatar
  • 536
7 votes
2 answers
9k views

How to get imge base of current setting through script in IDA pro?

As a beginner I'm trying to disassemble a file with IDA Pro 6.5. I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program. Now, I want to get the image base of ...
user6903's user avatar
  • 411
7 votes
3 answers
10k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
Ditmar Wendt's user avatar
7 votes
4 answers
3k views

Change block/node color with idapython

How can I change color of node (or block?) with idapython? I know about SetColor, but this function does not work with blocks/nodes. EDIT: Solved, see the code snippet below. def get_bb_id(graph, ea)...
DOD's user avatar
  • 191
7 votes
1 answer
24k views

Using IDA Python Iterate Through All Functions and Their Instructions

I'm new to IDAPython. Basically I want to iterate through all functions in an IDB file and their instructions using ida python script. The final goal is to export the functions & their ...
Dev.K.'s user avatar
  • 205
7 votes
1 answer
12k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
user121314's user avatar
7 votes
1 answer
3k views

How to extract the input file offset of a byte in idapython?

For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
Christopher Mann's user avatar
7 votes
2 answers
2k views

Accessing Data Marked as Alignment Bytes in IDA

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA. .text:00401176 ...
alexanderh's user avatar
  • 1,062
7 votes
2 answers
10k views

IDA python, write to specific memory location

I am looking for a way to modify memory location in IDA python script. We can read memory with these functions: Byte(address) Word(address) Dword(address) When I try to do something like this: Byte(...
user22310's user avatar
7 votes
1 answer
9k views

How to automatically rename some IDA functions from a given list?

I have a text file which contains a list of function name and address pairs, structured like this : 194C:841B LoadMessage 194C:8429 ShowDialog ... Is there a way (eg: script, automation, ...) to ...
tigrou's user avatar
  • 371
7 votes
1 answer
868 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
James's user avatar
  • 193
7 votes
1 answer
3k views

Is it possible to create data xrefs manually?

I have a binary with lots of indirect calls (call dword ptr [register + offset ]) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead ...
xrefsfrom's user avatar
7 votes
1 answer
1k views

Is there a way to set the number special purpose registers in IDA pro with a script?

IDA has this nifty habit that when it doesn't know what a special purpose register is, it just drops in the number of the register instead. While this is all well and fine, I'd like to be able to ...
Wyatt's user avatar
  • 71
7 votes
1 answer
786 views

Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?

Let's say I have lots of breakpoints at some push instructions. I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + ...
algotroll's user avatar
6 votes
3 answers
4k views

How to get the CPU architecture via Idapython?

I was not able to find an API function to get the CPU architecture of the loaded binary. In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type. ...
langlauf.io's user avatar
  • 1,550
6 votes
2 answers
2k views

IDA [call $+5 / pop reg] cleaning

Can anyone tell me how to clean up the code which contains the following blocks: call $+5 pop reg add reg, 08BE96h [...] In other words I need to change all such blocks to: mov reg, offset Edit # ...
Ilya Matveychikov's user avatar
6 votes
1 answer
10k views

IDAPython: How to get function argument values

I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example,...
joxeankoret's user avatar
  • 4,470
6 votes
1 answer
3k views

How can I extract the structure of an operand with displacement in IDAPython?

Consider the following instruction: 8D 8C 4E B0 2F FF FF LEA ECX, [ESI+ECX*2-0xD050] Using IDAPython, how can I extract the structure of the second operand? I'd like to know things like: ESI is ...
Willi Ballenthin's user avatar
6 votes
2 answers
5k views

Ida Pro: parsing complex operand expression using IDAPython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
langlauf.io's user avatar
  • 1,550
6 votes
1 answer
561 views

A wiki for IDA? [closed]

Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the ...
DarthGizka's user avatar
  • 2,010
6 votes
1 answer
4k views

Idapython - undefining an instruction

I have an instructions defined from address+1 onward and a byte at address. I'd like to undefine the instructions from address+1 onward and redefine them from address using MakeCode or something ...
user avatar
6 votes
2 answers
2k views

IDA Pro/IDAPython automation through IDAPython

I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the ...
user3119546's user avatar
6 votes
0 answers
702 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
w s's user avatar
  • 8,408
5 votes
2 answers
4k views

idapython - Determine if item is code or data

I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see ...
Aviv's user avatar
  • 337
5 votes
1 answer
6k views

IDA Script, get function that has random characters in its name

I was trying to figure out if there is a way I can get the address for a function name that has random characters in it. For example the function name is "Player_GetStats_m29275" here the &...
Arsalan Awan's user avatar
5 votes
1 answer
3k views

IDAPython script does not reload

I'm debugging an IDAPython script on my host machine and I have IDA running on my Windows VM. The folder containing the IDAPython script on the host machine is shared with the VM. The first time I ...
user avatar
5 votes
2 answers
6k views

Use idapython to print register or memory value when the debugger is running

I want to record the value of a certain register or specific memory location when the program is being debugged. e.g. in the following segment: .text:0FD6268D shr ecx, 4 .text:...
dandan's user avatar
  • 275
5 votes
2 answers
3k views

IDAPython for IDAFree 5.0

I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can ...
user3403765's user avatar
5 votes
1 answer
677 views

Formatting BinDiff results to a .txt

I have been using BinDiff as a plug-in for IDA Pro. I understand it is not possible to run this plug-in via terminal/batch mode. Is there a way I can export the results to a more readable format such ...
user3119546's user avatar
5 votes
3 answers
974 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa = ...
XeroxDucati's user avatar
5 votes
3 answers
5k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
user avatar
5 votes
0 answers
923 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
in3o's user avatar
  • 265
5 votes
0 answers
2k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
vdudouyt's user avatar
  • 171
4 votes
3 answers
4k views

IDAPython: Get struct id defined at an address

Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't ...
Dmitry Janushkevich's user avatar
4 votes
3 answers
6k views

Is it possible to get a list of user-defined names in IDA?

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
sherlock's user avatar
  • 1,361

1
2 3 4 5
8