Skip to main content

Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
1 vote
0 answers
23 views

IDAPython: Getting all arguments passed to function

I am working on getting two specific arguments from a function that is called around 1000 times in an executable. Is there any way of looping through all XREFs that reference the function and print ...
Surasia's user avatar
  • 11
1 vote
3 answers
1k views

IDAPython: error executing init.py

When I open Ida Pro 8.3 I see an error message IDAPython: error executing init.py: No module named imp Refer to the message window to see the full error log. i have python 3.12.3 and i ran as ...
alex 's user avatar
  • 13
0 votes
0 answers
29 views

How to access the demangled auto comment?

In this example, IDA has demangled the boost::fibers::context::active name normally, and you can access that name with ida_name.get_ea_name(ea, GN_SHORT|GN_DEMANGLED|GN_VISIBLE). But the function name,...
thejoelpatrol's user avatar
0 votes
0 answers
19 views

How can I use ptr to ptr in idapython?

in hey-rays api there's a method: def find_def(self, *args) -> "minsn_t *": r""" find_def(self, op, p_i1, i2, fdflags) -> minsn_t @param op: mop_t const &...
Ethan Xie's user avatar
0 votes
0 answers
37 views

Ida Pro: how do I iterate over all typedefs in python

I see how to iterate over all structs, unions, enums, functions. But I cannot find a way to iterate over all typedefs.
thatshowthe's user avatar
0 votes
1 answer
89 views

IDA - Decoding this "XORed"? string automatically in psuedocode

__m128i ModuleName; __m128i ProcName; ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64; ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64; ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64; ProcName....
lightersmash's user avatar
0 votes
2 answers
115 views

How to change default pointer size in IDA Pro

so, I'm writing a script to automate analysis, and the code I'm working with is 64bit. the pointer size field shown here is the wrong one: I want to change it from within python to 64bit. I've ...
serv0's user avatar
  • 21
0 votes
2 answers
188 views

How to make a plugin python function available to IDA's console?

I want to have utility functions shared between all databases, for example: from idautils import * from idaapi import * from idc import * from ida_name import * def FindFunctionImpl(...
KulaGGin's user avatar
  • 356
0 votes
0 answers
67 views

Import function symbols from a reflection system into IDA

I'd like to import structs and functions from a reflection system into IDA. The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
KulaGGin's user avatar
  • 356
1 vote
0 answers
378 views

How to use IDA environment to run python scripts?

I am trying out following technique: https://github.com/CMUSTRUDEL/DIRTY This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset. It ...
R4444's user avatar
  • 1,807
0 votes
1 answer
72 views

My ida.reg file got deleted, is there any way to restore ida?

I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed - Is there any way to restore ida? ...
R4444's user avatar
  • 1,807
0 votes
0 answers
78 views

IDA python : display not refreshing function parameters after type update

I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :) The issue : I have a ...
Jeremy's user avatar
  • 1
1 vote
1 answer
895 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
valaGQ237's user avatar
1 vote
1 answer
261 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33
0 votes
1 answer
117 views

IDA Pro Debugging GDB SendDbgCommand

I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging. Setting up the debug environment with IDA Pro using ...
Ballers's user avatar
  • 49
0 votes
1 answer
105 views

IDA python API set function chunk end

I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
Tomer Attali's user avatar
0 votes
1 answer
324 views

NameError: name 'ScreenEA' is not defined

Part of Practical malware analysis Lab5, is to run a python script in IDA Pro I have tried by going to Files-->Script command then I have pasted my python code: sea = ScreenEA() for i in range(...
Octo's user avatar
  • 1
-1 votes
1 answer
243 views

Simple Question About Reversing a Python

So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of ...
Roy Guzman's user avatar
0 votes
1 answer
97 views

How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?

Is there an API which lets me programmatically: set the default string type (Setup) and rebuild the string list (Rebuild) ???
0xC0000022L's user avatar
  • 10.9k
0 votes
1 answer
265 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
0 votes
1 answer
159 views

idat.exe -S, path with spaces

I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so But I get an error. Among the logs is present the error: home\mypath: ...
Dario B.'s user avatar
0 votes
1 answer
91 views

idat.exe -S -A close without error

I have developed a idapython script and I run it using the following command: idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so In myscript.py I appended the exit(0) in order to ...
Dario B.'s user avatar
1 vote
1 answer
251 views

How to quickly mark functions library in IDA Pro?

I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
void_17's user avatar
  • 33
2 votes
1 answer
456 views

IDA: Demangled name simplification in idapython

With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them. For example, the following function: Python> ida_name.demangle_name(idc....
Blub's user avatar
  • 123
1 vote
0 answers
88 views

How to remove a node in CTREE

Im learning about CTREE in IDA. Here is my ida decompiled code: v3 = 0; if ( !strcmp(Str1, "hello") ) v3 = 100; return a1 + v3; At this time, i just want to mess arround with CTREE ...
Brian MJ's user avatar
3 votes
1 answer
121 views

IDAPython get current module name in a debugger

I have a script that catches say a value of 666 in the RDX register and pauses debugging. The problem is, that this value might be added to the register by other modules aside from the main ...
MartinRøde's user avatar
4 votes
0 answers
287 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
R4444's user avatar
  • 1,807
3 votes
1 answer
122 views

How to highlight all external registers in a function

What I want: detect all potentially usercall, userpurge - functions; when entering the function, immediately see all external entities: arguments passed through registers; i.e., in order not to ...
user avatar
1 vote
1 answer
230 views

IDAPython doesn't recognize function

I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
Luca's user avatar
  • 121
2 votes
0 answers
58 views

Is it possible to create nested memory mapped registers in IDA Processor Modules?

Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
none32's user avatar
  • 111
2 votes
0 answers
60 views

Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?

Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following: mov rax, cs:KeDelayExecutionThrea lea r8, [rsp+28h+arg_0] xor edx, ...
OneAndOnly's user avatar
2 votes
0 answers
65 views

Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)

Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
OneAndOnly's user avatar
3 votes
0 answers
172 views

IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?

I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
none32's user avatar
  • 111
2 votes
1 answer
211 views

IDAPython's FlowChart wrong basic blocks

I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA. As you ...
Luca's user avatar
  • 121
4 votes
2 answers
619 views

IDAPython set name of function using string passed to debug logging subfunction

IDA Pro 7.6 Static disassembly of ARM executable. This binary has 40K functions or so, and no symbols. So all the functions are sub_49FFA etc. However, 90% of these functions have a call to a debug ...
Tis Me's user avatar
  • 83
1 vote
0 answers
492 views

Access RTTI class hierarchy along with offsets from IDAPython

Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI. When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
overflo's user avatar
  • 268
4 votes
0 answers
600 views

Does IDA Freeware 8.x support plugins?

According to the information I searched, it is not supported in IDA 7.x and before. Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before. refer:...
huang's user avatar
  • 223
3 votes
1 answer
104 views

Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?

I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M). Looking at the idapython documentation, it looks like maybe I can do this via the ...
Bill B's user avatar
  • 206
2 votes
0 answers
310 views

IDA api: get function argument definition

So let's say we have the following code: 0: lea rax, [rbp+8] 1: mov rcx, rax 2: mov rdx, 5 3: call my_fun i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
xar3's user avatar
  • 41
2 votes
0 answers
231 views

Convert instructions to op code bytes in python script for IDA Pro

I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work. This is my python ...
Luca's user avatar
  • 121
1 vote
0 answers
20 views

How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]

I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
0xh3xa's user avatar
  • 113
1 vote
1 answer
153 views

How to call the Color Picker window in Ida Pro from a script?

I'm going to make a python script that allows you to color selected functions - in the right colors. To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
user avatar
0 votes
1 answer
351 views

ida pro: scripting debugger with python fails on step_over/run_to

So I am trying to run an app and collect information at certain points. No biggie, right? Wrong. Check this simple example: import ida_dbg ida_dbg.step_over() #or runto() eax = ida_dbg.get_reg_val(&...
bernd feinman's user avatar
3 votes
1 answer
366 views

How to select an item in IDAPython, in decompilation view?

I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures). I have changed the arguments types for a list of ...
overflo's user avatar
  • 268
1 vote
1 answer
163 views

Why does tif.get_func_details sometimes only starts to work after decompiling the function?

I am going through a huge executable and am fetching information about functions arguments this way: tif, funcdata = ida_typeinf.tinfo_t(), ida_typeinf.func_type_data_t() assert ida_nalt.get_tinfo(...
overflo's user avatar
  • 268
1 vote
1 answer
740 views

IDAPython Get Function Parameter Type Name

I'm currently trying to make a hotkey to rename example functions sub_123450(aType* this, void* a2) to aType::123450(aType* this, void* a2). I have code to rename etc. but how can I get the name of ...
Stewart's user avatar
  • 95
1 vote
2 answers
346 views

Renaming a local stack variable with IDAPython

I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so... In my ...
rotem.salinas's user avatar
1 vote
0 answers
34 views

How to find prolog with idapython in non-disassambled function raw bytes?

I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?
Jôsùå's user avatar
1 vote
1 answer
493 views

idapython: how to reset pointer type for variables

I am using IDA Pro 7.6 on win32 x86 binaries. I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
coolthingsforme's user avatar
2 votes
1 answer
531 views

how to get indirect callsite function return type and arguments

I am using idapython to get function return type and arguments @ an indirect call instruction. I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
R4444's user avatar
  • 1,807

1
2 3 4 5
8