Questions tagged [idapython]
A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.
360
questions
-1
votes
1
answer
125
views
Simple Question About Reversing a Python
So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of
...
- 426
1
vote
1
answer
91
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
- 9,088
0
votes
1
answer
36
views
IDA Pro Debugging GDB SendDbgCommand
I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging.
Setting up the debug environment with IDA Pro using ...
- 49
0
votes
1
answer
58
views
IDA python API set function chunk end
I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
- 9,088
0
votes
1
answer
55
views
NameError: name 'ScreenEA' is not defined
Part of Practical malware analysis Lab5, is to run a python script in IDA Pro
I have tried by going to Files-->Script command then I have pasted my python code:
sea = ScreenEA()
for i in range(...
- 8,343
0
votes
1
answer
58
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
CommunityBot
- 1
2
votes
1
answer
154
views
How to open watch view using IDAPython?
I want to open the watch view and add watch in code. Do you know how? I didn't find open_window_ for it. I couldn't understand which function to use with BWN_... or IWID_... constants ( IWID_WATCH ...
CommunityBot
- 1
4
votes
1
answer
486
views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
CommunityBot
- 1
0
votes
1
answer
64
views
idat.exe -S, path with spaces
I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so
But I get an error. Among the logs is present the error:
home\mypath: ...
CommunityBot
- 1
0
votes
1
answer
47
views
How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?
Is there an API which lets me programmatically:
set the default string type (Setup) and
rebuild the string list (Rebuild)
???
- 9,088
0
votes
1
answer
28
views
idat.exe -S -A close without error
I have developed a idapython script and I run it using the following command:
idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so
In myscript.py I appended the exit(0) in order to ...
- 885
1
vote
1
answer
128
views
How to quickly mark functions library in IDA Pro?
I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
- 552
2
votes
1
answer
146
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
- 36.2k
4
votes
3
answers
2k
views
How can I get the byte size of an operand in IDA Pro?
I am trying to get the byte size of all operands in a given instruction from IDA Pro. At first I tried using GetOperandValue(ea,n) to see how large the value was and calculate how many bytes were ...
- 10.9k
4
votes
2
answers
1k
views
idapython - assign a struct to a stack variable
I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do Alt+Q); Doing this for addresses in .data is not a problem, but I can't figure out a way to ...
- 10.9k
1
vote
2
answers
2k
views
Get current file name with IDApython
I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that.
the closest things ...
- 10.9k
0
votes
2
answers
1k
views
idapython: how to get decompiler output corresponding to the indirect call
For, e.g. disassembler or IDA view:
Decompiler or Hex View:
I can get the decompilation of whole function using something like:
decompiled = ida_hexrays.decompile(ea)
But, in this way I get the ...
- 1
3
votes
1
answer
78
views
IDAPython get current module name in a debugger
I have a script that catches say a value of 666 in the RDX register and pauses debugging. The problem is, that this value might be added to the register by other modules aside from the main ...
- 552
1
vote
0
answers
45
views
How to remove a node in CTREE
Im learning about CTREE in IDA. Here is my ida decompiled code:
v3 = 0;
if ( !strcmp(Str1, "hello") )
v3 = 100;
return a1 + v3;
At this time, i just want to mess arround with CTREE ...
- 67
6
votes
2
answers
5k
views
Ida Pro: parsing complex operand expression using IDAPython
Say given the following line in Ida Pro:
mov [rsp+3F8h+var_3F8], 0
How can I parse and access the items inside the [ ]?
What I tried:
idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
- 10.9k
5
votes
1
answer
6k
views
IDA Script, get function that has random characters in its name
I was trying to figure out if there is a way I can get the address for a function name that has random characters in it.
For example the function name is "Player_GetStats_m29275" here the &...
- 119
1
vote
1
answer
143
views
How to call the Color Picker window in Ida Pro from a script?
I'm going to make a python script that allows you to color selected functions - in the right colors.
To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
- 10.9k
4
votes
0
answers
109
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,767
2
votes
0
answers
45
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 255
3
votes
1
answer
107
views
How to highlight all external registers in a function
What I want:
detect all potentially usercall, userpurge - functions;
when entering the function, immediately see all external entities:
arguments passed through registers;
i.e., in order not to ...
- 9,088
7
votes
4
answers
3k
views
Change block/node color with idapython
How can I change color of node (or block?) with idapython? I know about SetColor, but this function does not work with blocks/nodes.
EDIT: Solved, see the code snippet below.
def get_bb_id(graph, ea)...
2
votes
1
answer
5k
views
Using Python 3.7 and 2.x in same IDA
I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7.
Is there any way to run that Python 2.7 based plugin?
- 36.2k
3
votes
1
answer
983
views
How to create and change variables at address in IDA Python?
I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it.
For structs, there's ...
- 1,073
2
votes
0
answers
49
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
- 111
1
vote
1
answer
92
views
IDAPython doesn't recognize function
I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
- 121
3
votes
0
answers
111
views
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
- 111
2
votes
0
answers
38
views
Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?
Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:
mov rax, cs:KeDelayExecutionThrea
lea r8, [rsp+28h+arg_0]
xor edx, ...
- 519
2
votes
1
answer
113
views
IDAPython's FlowChart wrong basic blocks
I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA.
As you ...
- 121
1
vote
2
answers
3k
views
Add python to Ida Pro 7.3
I have Ida Pro 7.3 but at the bottom of windows, I see that I can run only the IDC script.
How can I add Python to Ida ?
Can I run Python script via IDA ?
- 255
4
votes
2
answers
290
views
IDAPython set name of function using string passed to debug logging subfunction
IDA Pro 7.6
Static disassembly of ARM executable.
This binary has 40K functions or so, and no symbols. So all the functions are sub_49FFA etc.
However, 90% of these functions have a call to a debug ...
- 255
3
votes
1
answer
81
views
Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?
I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M).
Looking at the idapython documentation, it looks like maybe I can do this via the ...
0
votes
2
answers
3k
views
Modify memory without patching the database
Is there a way to modify one or more bytes in memory without making any changes in the database? I know about idc.PatchByte() in idapython, but it will print the message that states that 'This ...
- 459
5
votes
3
answers
929
views
Nested Structures in IDA
I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app;
int main() {
const int kBits = 1024;
const int kExp = 3;
RSA *rsa = ...
- 10.9k
1
vote
0
answers
225
views
Access RTTI class hierarchy along with offsets from IDAPython
Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI.
When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
- 258
1
vote
1
answer
113
views
Why does tif.get_func_details sometimes only starts to work after decompiling the function?
I am going through a huge executable and am fetching information about functions arguments this way:
tif, funcdata = ida_typeinf.tinfo_t(), ida_typeinf.func_type_data_t()
assert ida_nalt.get_tinfo(...
CommunityBot
- 1
2
votes
1
answer
303
views
How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?
TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc).
In order to explicitly load a type library I can use ...
- 10.9k
3
votes
0
answers
329
views
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.
Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.
refer:...
- 10.9k
3
votes
0
answers
219
views
How can I parse VMTs in IDA if I have the base address?
I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API ...
CommunityBot
- 1
2
votes
0
answers
180
views
IDA api: get function argument definition
So let's say we have the following code:
0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
- 41
2
votes
0
answers
202
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 10.9k
12
votes
2
answers
5k
views
How to map an arbitrary address to its corresponding basic block in IDA?
Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that?
Edit:
more specifically, I want to know the beginning / end of ...
1
vote
0
answers
18
views
How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
- 111
5
votes
1
answer
3k
views
IDAPython script does not reload
I'm debugging an IDAPython script on my host machine and I have IDA running on my Windows VM. The folder containing the IDAPython script on the host machine is shared with the VM.
The first time I ...
1
vote
1
answer
152
views
Creating table with IDAPython
I'd like to create the table like below, I could not found any clue while googling it.
Is it possible to make table with IDAPython, especially with idaapi.simplecustviewer_t class?
Any advises would ...
CommunityBot
- 1
0
votes
1
answer
182
views
ida pro: scripting debugger with python fails on step_over/run_to
So I am trying to run an app and collect information at certain points.
No biggie, right? Wrong. Check this simple example:
import ida_dbg
ida_dbg.step_over() #or runto()
eax = ida_dbg.get_reg_val(&...
- 453