Skip to main content

Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
10 votes
1 answer
6k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
Zach Riggle's user avatar
  • 2,357
8 votes
3 answers
656 views

How can I clean up strings built at runtime (stack strings)?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
phoenix89's user avatar
3 votes
1 answer
6k views

Finding all API calls in a function

is there a way to get a listing of all called APIs in a function via IDAPython. For example I have the below code from a function. .text:003A33D9 call esi ; _snwprintf .text:...
alexanderh's user avatar
  • 1,062
3 votes
1 answer
940 views

API to force reanalyze of function (Alt-P)

Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml) Is there a way to do this through API?
Pororo's user avatar
  • 135
8 votes
2 answers
15k views

IDA Pro List of Functions with Instruction

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
WMIF's user avatar
  • 183
4 votes
2 answers
4k views

Automating a Decryption function call in IDA Python

I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times. The function takes three arguments and is a simple xor decryption. However it ...
gandolf's user avatar
  • 355
4 votes
1 answer
5k views

How to get the disassembly line without offset translations in IDAPython?

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name. For example, when raw assembly is: mov %r15, 0x20b062(%rip)` GetDisasm()'s ...
liubenxi's user avatar
  • 115
19 votes
3 answers
15k views

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
0xC0000022L's user avatar
  • 10.9k
17 votes
4 answers
15k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
Mick's user avatar
  • 7,582
9 votes
2 answers
7k views

Good training for IDAPython [closed]

I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
bravosierra99's user avatar
9 votes
2 answers
2k views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
Aviv's user avatar
  • 337
8 votes
2 answers
5k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
Aviv's user avatar
  • 337
7 votes
1 answer
9k views

How to automatically rename some IDA functions from a given list?

I have a text file which contains a list of function name and address pairs, structured like this : 194C:841B LoadMessage 194C:8429 ShowDialog ... Is there a way (eg: script, automation, ...) to ...
tigrou's user avatar
  • 371
7 votes
1 answer
902 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
James's user avatar
  • 193
7 votes
1 answer
3k views

How to extract the input file offset of a byte in idapython?

For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
Christopher Mann's user avatar
7 votes
3 answers
11k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
Ditmar Wendt's user avatar
7 votes
2 answers
10k views

How to get imge base of current setting through script in IDA pro?

As a beginner I'm trying to disassemble a file with IDA Pro 6.5. I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program. Now, I want to get the image base of ...
user6903's user avatar
  • 411
6 votes
1 answer
4k views

Idapython - undefining an instruction

I have an instructions defined from address+1 onward and a byte at address. I'd like to undefine the instructions from address+1 onward and redefine them from address using MakeCode or something ...
user avatar
6 votes
2 answers
5k views

Ida Pro: parsing complex operand expression using IDAPython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
langlauf.io's user avatar
  • 1,560
6 votes
3 answers
5k views

How to get the CPU architecture via Idapython?

I was not able to find an API function to get the CPU architecture of the loaded binary. In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type. ...
langlauf.io's user avatar
  • 1,560
6 votes
1 answer
10k views

IDAPython: How to get function argument values

I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example,...
joxeankoret's user avatar
  • 4,488
4 votes
1 answer
7k views

Setting name of (newly created) functions via IDAPython

Is there a way to specify the name of a function when creating it with idc.MakeFunction()? If not, what is the best practice to rename a function? I found idc.GetFunctionName(ea) but no counterpart ...
langlauf.io's user avatar
  • 1,560
4 votes
3 answers
4k views

IDAPython: Get struct id defined at an address

Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't ...
Dmitry Janushkevich's user avatar
4 votes
2 answers
6k views

Get a list of global variables with IDA python

I am trying to use IDA python to get a list of all variables in .data section because I want to extract a list of cross references to each global variables from IDA. Is it possible to do this with IDA ...
ajoha's user avatar
  • 43
3 votes
2 answers
3k views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
Greg Doe's user avatar
3 votes
1 answer
1k views

How to create and change variables at address in IDA Python?

I'd like to be able to create and change global variables at addresses with IDA Python: if variable doesn't exist, create it, if it exists, change it, set its name, undefine it. For structs, there's ...
KulaGGin's user avatar
  • 356
3 votes
1 answer
4k views

Can I use python3 with IDA 7.0?

Got IDA Pro 7.0 (I can't update at the moment), I'm currently unable to use idapython. I have python3.8 installed on my machine and nothing else (I dont want any collisions). How can I use make ...
Trigosin Darom's user avatar
2 votes
2 answers
1k views

How to setup VSCode with IDAPython?

Is it possible to remotely debug IDAPyhton scripts using VSCode and ptvsd? I found a few tutorials on the net, but no one is working. In the past, using the same protocol I was able to connect to Maya ...
saiwa's user avatar
  • 21
2 votes
1 answer
2k views

idapython find functions that contain a loop

How can I color functions that contain loops in IDApython ? If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i ...
Vision's user avatar
  • 21
2 votes
1 answer
878 views

How to modify strings and funtions reference detection in IDA pro?

I have loaded a binary file into IDA which is for Motorola 6800 series. The strings are referenced like this: pea ($2017A99).l. The actual address of the referenced string in above command is ...
Gholi GholiZade's user avatar
1 vote
2 answers
6k views

How can I step through instructions in IDA and know the current EIP?

import idaapi x=0 while x<10: idaapi.step_into() rv = idaapi.regval_t() idaapi.get_reg_val('EIP',rv) ea = rv.ival print hex(ea) x+=1 Hi. Here is a script to step-into 10 ...
Antiusninja's user avatar
1 vote
1 answer
183 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
BlackRussian's user avatar
1 vote
1 answer
987 views

Accesssing xmm registers in IDAPython

I'm trying to write a Python script for IDA that hooks into debugging events, and prints some info about the xmm registers. I tried idc.GetRegValue("xmm0") But that returns a random long, which ...
cmpxchg8b's user avatar
  • 113
1 vote
1 answer
2k views

IDA Pro Export C style array using Python instead of GUI menu

IDA Pro 6.95. From the menu I can use Edit... Export data... C unsigned char array (hex). I want to do this in a Python script without rewriting what already works. I have looked for a way to find a ...
John Banks's user avatar
0 votes
2 answers
2k views

idapython: how to get decompiler output corresponding to the indirect call

For, e.g. disassembler or IDA view: Decompiler or Hex View: I can get the decompilation of whole function using something like: decompiled = ida_hexrays.decompile(ea) But, in this way I get the ...
R4444's user avatar
  • 1,807
0 votes
2 answers
3k views

Modify memory without patching the database

Is there a way to modify one or more bytes in memory without making any changes in the database? I know about idc.PatchByte() in idapython, but it will print the message that states that 'This ...
vdudouyt's user avatar
  • 171
0 votes
0 answers
665 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
Guillaume's user avatar
  • 709