Questions tagged [idapython]
A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.
366
questions
19
votes
3
answers
15k
views
In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?
The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
- 10.9k
17
votes
4
answers
15k
views
What are the essential IDA Plugins or IDA Python scripts that you use? [closed]
I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
- 7,542
17
votes
3
answers
6k
views
How to debug an IDAPython script from within IDA?
IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
- 173
12
votes
2
answers
5k
views
How to map an arbitrary address to its corresponding basic block in IDA?
Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that?
Edit:
more specifically, I want to know the beginning / end of ...
- 1,183
11
votes
2
answers
15k
views
Which python library for parsing Linux ELF files?
I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
- 1,550
10
votes
1
answer
6k
views
Extracting arguments from IDA
Let's say I have the following function in IDA:
int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>)
What's the fastest way to extract the argument information ...
- 2,317
9
votes
2
answers
7k
views
Good training for IDAPython [closed]
I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
- 238
9
votes
2
answers
5k
views
Is there a way to set the cursor address in IDA Pro?
In the same way that ScreenEA() returns the current cursor address, is there a way to set the address? Something that would resemble SetScreenEA()?
- 95
9
votes
2
answers
2k
views
Open-source equivalent for FLIRT
I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.
Right now, the only way I can do that is to use IDA's FLIRT (...
- 337
9
votes
2
answers
5k
views
How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type
I'm writing an IDA plugin using idapython in order to add comments (located in database) to variables of struct types. In order to do this, firstly, i need to get the list of cross-references to a ...
- 103
9
votes
1
answer
6k
views
How can I control the Hex-Rays decompiler plugin from IDA with scripts?
I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....
- 529
8
votes
2
answers
14k
views
IDA Pro List of Functions with Instruction
I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
- 183
8
votes
3
answers
638
views
How can I clean up strings built at runtime (stack strings)?
How can I clean up/simplify strings that are built at runtime?
I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
- 83
8
votes
2
answers
5k
views
idapython - Get Xrefs to a stack variable
I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so.
What I am trying to achieve is a code ...
- 337
8
votes
1
answer
3k
views
How is IDAPython API structured?
In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
- 1,361
8
votes
1
answer
4k
views
Getting IDAPro to analyse part of memory as PE-File
I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64.
There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
- 536
7
votes
2
answers
9k
views
How to get imge base of current setting through script in IDA pro？
As a beginner I'm trying to disassemble a file with IDA Pro 6.5.
I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program.
Now, I want to get the image base of ...
- 411
7
votes
3
answers
10k
views
Paste hex bytes into IDA Pro Hex View
Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
- 547
7
votes
4
answers
3k
views
Change block/node color with idapython
How can I change color of node (or block?) with idapython? I know about SetColor, but this function does not work with blocks/nodes.
EDIT: Solved, see the code snippet below.
def get_bb_id(graph, ea)...
- 191
7
votes
1
answer
24k
views
Using IDA Python Iterate Through All Functions and Their Instructions
I'm new to IDAPython. Basically I want to iterate through all functions in an IDB file and their instructions using ida python script. The final goal is to export the functions & their ...
- 205
7
votes
1
answer
12k
views
How can I set breakpoint and get value of a register with IDApython
How can I set a breakpoint and get the value of the EAX register with IDApython?
I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
- 73
7
votes
1
answer
3k
views
How to extract the input file offset of a byte in idapython?
For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
7
votes
2
answers
2k
views
Accessing Data Marked as Alignment Bytes in IDA
Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA.
.text:00401176 ...
- 1,062
7
votes
2
answers
10k
views
IDA python, write to specific memory location
I am looking for a way to modify memory location in IDA python script. We can read memory with these functions:
Byte(address)
Word(address)
Dword(address)
When I try to do something like this:
Byte(...
- 71
7
votes
1
answer
9k
views
How to automatically rename some IDA functions from a given list?
I have a text file which contains a list of function name and address pairs, structured like this :
194C:841B LoadMessage
194C:8429 ShowDialog
...
Is there a way (eg: script, automation, ...) to ...
- 371
7
votes
1
answer
868
views
Adding a toolbar to IDA using PySide
So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
- 193
7
votes
1
answer
3k
views
Is it possible to create data xrefs manually?
I have a binary with lots of indirect calls (call dword ptr [register + offset ]) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead ...
- 71
7
votes
1
answer
1k
views
Is there a way to set the number special purpose registers in IDA pro with a script?
IDA has this nifty habit that when it doesn't know what a special purpose register is, it just drops in the number of the register instead. While this is all well and fine, I'd like to be able to ...
- 71
7
votes
1
answer
786
views
Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?
Let's say I have lots of breakpoints at some push instructions.
I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + ...
- 71
6
votes
3
answers
4k
views
How to get the CPU architecture via Idapython?
I was not able to find an API function to get the CPU architecture of the loaded binary.
In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type.
...
- 1,550
6
votes
2
answers
2k
views
IDA [call $+5 / pop reg] cleaning
Can anyone tell me how to clean up the code which contains the following blocks:
call $+5
pop reg
add reg, 08BE96h
[...]
In other words I need to change all such blocks to:
mov reg, offset
Edit # ...
6
votes
1
answer
10k
views
IDAPython: How to get function argument values
I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example,...
- 4,470
6
votes
1
answer
3k
views
How can I extract the structure of an operand with displacement in IDAPython?
Consider the following instruction:
8D 8C 4E B0 2F FF FF LEA ECX, [ESI+ECX*2-0xD050]
Using IDAPython, how can I extract the structure of the second operand? I'd like to know things like:
ESI is ...
- 185
6
votes
2
answers
5k
views
Ida Pro: parsing complex operand expression using IDAPython
Say given the following line in Ida Pro:
mov [rsp+3F8h+var_3F8], 0
How can I parse and access the items inside the [ ]?
What I tried:
idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
- 1,550
6
votes
1
answer
561
views
A wiki for IDA? [closed]
Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the ...
- 2,010
6
votes
1
answer
4k
views
Idapython - undefining an instruction
I have an instructions defined from address+1 onward and a byte at address. I'd like to undefine the instructions from address+1 onward and redefine them from address using MakeCode or something ...
user1743
6
votes
2
answers
2k
views
IDA Pro/IDAPython automation through IDAPython
I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the ...
- 495
6
votes
0
answers
702
views
How to create HexRays variables in IDAPython correctly?
Let's assume we have a function which has a following variables in it:
Local variables on stack of different types, including types defined in local types window
Local variables of different types ...
- 8,408
5
votes
2
answers
4k
views
idapython - Determine if item is code or data
I need to determine whether an IDA's item is code or data.
Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff).
So in IDA, you can sometimes see ...
- 337
5
votes
1
answer
6k
views
IDA Script, get function that has random characters in its name
I was trying to figure out if there is a way I can get the address for a function name that has random characters in it.
For example the function name is "Player_GetStats_m29275" here the &...
- 53
5
votes
1
answer
3k
views
IDAPython script does not reload
I'm debugging an IDAPython script on my host machine and I have IDA running on my Windows VM. The folder containing the IDAPython script on the host machine is shared with the VM.
The first time I ...
user1743
5
votes
2
answers
6k
views
Use idapython to print register or memory value when the debugger is running
I want to record the value of a certain register or specific memory location when the program is being debugged.
e.g. in the following segment:
.text:0FD6268D shr ecx, 4
.text:...
- 275
5
votes
2
answers
3k
views
IDAPython for IDAFree 5.0
I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can ...
- 81
5
votes
1
answer
677
views
Formatting BinDiff results to a .txt
I have been using BinDiff as a plug-in for IDA Pro. I understand it is not possible to run this plug-in via terminal/batch mode. Is there a way I can export the results to a more readable format such ...
- 495
5
votes
3
answers
974
views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa = ...
- 215
5
votes
3
answers
5k
views
IDApython and IDA-decompiler commenting
Looking at the functions exposed by idaapi I see that functions like the following are exposed.
get_user_cmt
set_user_cmt
save_user_cmts
As these functions are exposed I'm hoping that I have a way ...
user1743
5
votes
0
answers
923
views
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :
Project!??0?$allocator@D@std@@QAE@XZ
to
Project!public: __thiscall
...
- 265
5
votes
0
answers
2k
views
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
- 171
4
votes
3
answers
4k
views
IDAPython: Get struct id defined at an address
Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't ...
4
votes
3
answers
6k
views
Is it possible to get a list of user-defined names in IDA?
IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
- 1,361