Questions tagged [idapython]
A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.
37
questions
10
votes
1
answer
6k
views
Extracting arguments from IDA
Let's say I have the following function in IDA:
int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>)
What's the fastest way to extract the argument information ...
- 2,307
8
votes
3
answers
634
views
How can I clean up strings built at runtime (stack strings)?
How can I clean up/simplify strings that are built at runtime?
I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
- 83
3
votes
1
answer
5k
views
Finding all API calls in a function
is there a way to get a listing of all called APIs in a function via IDAPython. For example I have the below code from a function.
.text:003A33D9 call esi ; _snwprintf
.text:...
- 1,062
3
votes
1
answer
821
views
API to force reanalyze of function (Alt-P)
Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml)
Is there a way to do this through API?
- 135
8
votes
2
answers
14k
views
IDA Pro List of Functions with Instruction
I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
- 183
4
votes
1
answer
5k
views
How to get the disassembly line without offset translations in IDAPython?
When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name.
For example, when raw assembly is:
mov %r15, 0x20b062(%rip)`
GetDisasm()'s ...
- 115
4
votes
2
answers
4k
views
Automating a Decryption function call in IDA Python
I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times.
The function takes three arguments and is a simple xor decryption. However it ...
- 355
19
votes
3
answers
15k
views
In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?
The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
- 10.9k
17
votes
4
answers
15k
views
What are the essential IDA Plugins or IDA Python scripts that you use? [closed]
I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
- 7,512
9
votes
2
answers
2k
views
Open-source equivalent for FLIRT
I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program.
Right now, the only way I can do that is to use IDA's FLIRT (...
- 337
9
votes
2
answers
7k
views
Good training for IDAPython [closed]
I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
- 238
8
votes
2
answers
5k
views
idapython - Get Xrefs to a stack variable
I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so.
What I am trying to achieve is a code ...
- 337
7
votes
1
answer
9k
views
How to automatically rename some IDA functions from a given list?
I have a text file which contains a list of function name and address pairs, structured like this :
194C:841B LoadMessage
194C:8429 ShowDialog
...
Is there a way (eg: script, automation, ...) to ...
- 371
7
votes
1
answer
863
views
Adding a toolbar to IDA using PySide
So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
- 193
7
votes
3
answers
10k
views
Paste hex bytes into IDA Pro Hex View
Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
- 547
7
votes
2
answers
9k
views
How to get imge base of current setting through script in IDA pro？
As a beginner I'm trying to disassemble a file with IDA Pro 6.5.
I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program.
Now, I want to get the image base of ...
- 411
7
votes
1
answer
3k
views
How to extract the input file offset of a byte in idapython?
For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
6
votes
1
answer
9k
views
IDAPython: How to get function argument values
I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example,...
- 4,425
6
votes
1
answer
4k
views
Idapython - undefining an instruction
I have an instructions defined from address+1 onward and a byte at address. I'd like to undefine the instructions from address+1 onward and redefine them from address using MakeCode or something ...
user1743
6
votes
2
answers
5k
views
Ida Pro: parsing complex operand expression using IDAPython
Say given the following line in Ida Pro:
mov [rsp+3F8h+var_3F8], 0
How can I parse and access the items inside the [ ]?
What I tried:
idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
- 1,540
6
votes
3
answers
4k
views
How to get the CPU architecture via Idapython?
I was not able to find an API function to get the CPU architecture of the loaded binary.
In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type.
...
- 1,540
4
votes
3
answers
4k
views
IDAPython: Get struct id defined at an address
Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't ...
4
votes
1
answer
6k
views
Setting name of (newly created) functions via IDAPython
Is there a way to specify the name of a function when creating it with idc.MakeFunction()?
If not, what is the best practice to rename a function?
I found idc.GetFunctionName(ea) but no counterpart ...
- 1,540
4
votes
2
answers
5k
views
Get a list of global variables with IDA python
I am trying to use IDA python to get a list of all variables in .data section because I want to extract a list of cross references to each global variables from IDA.
Is it possible to do this with IDA ...
- 43
3
votes
1
answer
983
views
How to create and change variables at address in IDA Python?
I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it.
For structs, there's ...
- 276
3
votes
1
answer
4k
views
Can I use python3 with IDA 7.0?
Got IDA Pro 7.0 (I can't update at the moment),
I'm currently unable to use idapython.
I have python3.8 installed on my machine and nothing else (I dont want any collisions).
How can I use make ...
2
votes
2
answers
1k
views
How to setup VSCode with IDAPython?
Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
- 21
2
votes
2
answers
2k
views
Getting function arguments in ida
I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line:
ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func`
...
- 31
2
votes
1
answer
788
views
How to modify strings and funtions reference detection in IDA pro?
I have loaded a binary file into IDA which is for Motorola 6800 series.
The strings are referenced like this: pea ($2017A99).l.
The actual address of the referenced string in above command is ...
2
votes
1
answer
2k
views
idapython find functions that contain a loop
How can I color functions that contain loops in IDApython ?
If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i ...
- 21
1
vote
1
answer
173
views
Try to parse buffer as PE with IDAPython
file_buffer = requests.get(file_url)
buf_size = len(file_buffer)
pe_file = pefile.PE(data=file_buffer)
print("This is really a pe imphash %s." % pe_file.get_imphash())
addr = hex(id(...
- 39
1
vote
1
answer
2k
views
IDA Pro Export C style array using Python instead of GUI menu
IDA Pro 6.95. From the menu I can use Edit... Export data... C unsigned char array (hex).
I want to do this in a Python script without rewriting what already works.
I have looked for a way to find a ...
- 133
1
vote
2
answers
6k
views
How can I step through instructions in IDA and know the current EIP?
import idaapi
x=0
while x<10:
idaapi.step_into()
rv = idaapi.regval_t()
idaapi.get_reg_val('EIP',rv)
ea = rv.ival
print hex(ea)
x+=1
Hi. Here is a script to step-into 10 ...
- 61
1
vote
1
answer
886
views
Accesssing xmm registers in IDAPython
I'm trying to write a Python script for IDA that hooks into debugging events, and prints some info about the xmm registers. I tried
idc.GetRegValue("xmm0")
But that returns a random long, which ...
- 113
0
votes
2
answers
1k
views
idapython: how to get decompiler output corresponding to the indirect call
For, e.g. disassembler or IDA view:
Decompiler or Hex View:
I can get the decompilation of whole function using something like:
decompiled = ida_hexrays.decompile(ea)
But, in this way I get the ...
- 1,767
0
votes
0
answers
567
views
IDAPython - Find the start of an undefined code blob
I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing.
I'm in a case where some portions of my code contain this type of anti-...
- 709
0
votes
2
answers
3k
views
Modify memory without patching the database
Is there a way to modify one or more bytes in memory without making any changes in the database? I know about idc.PatchByte() in idapython, but it will print the message that states that 'This ...
- 171