Questions tagged [idapython]
A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.
68
questions with no upvoted or accepted answers
6
votes
0
answers
697
views
How to create HexRays variables in IDAPython correctly?
Let's assume we have a function which has a following variables in it:
Local variables on stack of different types, including types defined in local types window
Local variables of different types ...
- 8,343
5
votes
0
answers
915
views
Python library for linux to demangle MSVC decorated names
I am looking for a python library for linux which can demangle the function names which are mangled by MSVC.
for example :
Project!??0?$allocator@D@std@@QAE@XZ
to
Project!public: __thiscall
...
- 265
5
votes
0
answers
2k
views
Tracing function call args with IDA Pro
Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
- 171
4
votes
0
answers
109
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
- 1,767
4
votes
1
answer
486
views
How to make IDA processor for file format with tree structure
Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on.
However when it comes to tree-structured file format, I can't come up with a ...
- 428
4
votes
0
answers
319
views
funcap not capturing information in IDA debugger
I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
- 1,022
3
votes
0
answers
111
views
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
- 111
3
votes
0
answers
329
views
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.
Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.
refer:...
- 213
3
votes
0
answers
300
views
How to print a manually defined struct in IDA pro while debugging?
Lets say that i have manually defined a local struct while debugging in IDA pro, when i hover my mouse over any variable that is of that struct type, i can see its members.
Now if i have the variables'...
- 519
3
votes
0
answers
134
views
Calculate stack layout with Ida Python
In Arm in the beginning of function
push r4-r6,lr
sub sp sp 0x4
In the end of function
pop r4-r6,pc
add sp sp 0x4
That mean sp is decreased by 4 register*4 bytes+4 bytes for local variables , ...
- 31
3
votes
0
answers
1k
views
how to get all "called functions" in idapython
I am using following function to generate a call graph using idapython:
def generate_graph():
callees = dict()
# loop through all functions
for function_ea in idautils.Functions():
...
- 1,767
3
votes
0
answers
725
views
IDAPython Decompile - connect assembly to pseudo-code line
I'm trying to write a small application that can show for each
line of the de-compiled psuedo code of a certain function
the assembly instruction that responsible for it.
for example if we have a ...
- 131
3
votes
0
answers
507
views
getting the flags of an IDA name
IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc).
So far all is good and ...
- 11.7k
3
votes
0
answers
219
views
How can I parse VMTs in IDA if I have the base address?
I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API ...
3
votes
0
answers
390
views
Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA
I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
- 516
2
votes
0
answers
49
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
- 111
2
votes
0
answers
38
views
Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?
Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:
mov rax, cs:KeDelayExecutionThrea
lea r8, [rsp+28h+arg_0]
xor edx, ...
- 519
2
votes
0
answers
45
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
- 519
2
votes
0
answers
180
views
IDA api: get function argument definition
So let's say we have the following code:
0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
- 41
2
votes
0
answers
202
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
- 121
2
votes
1
answer
154
views
How to open watch view using IDAPython?
I want to open the watch view and add watch in code. Do you know how? I didn't find open_window_ for it. I couldn't understand which function to use with BWN_... or IWID_... constants ( IWID_WATCH ...
- 21
2
votes
0
answers
163
views
How do I disassemble mips .o object files in ida elf 64bit
So I’m trying to disassemble some object files in mips. I use IDA 7 on windows. These object files are loadable kernel modules. Mipself64 Is What ida auto sets to when they are dropped in. I’d like to ...
2
votes
0
answers
185
views
Checking if a call is a API/Library call in IDApython?
I asked the question a while ago but found no answer so I'm trying my luck again
the only solution is this :
Finding all API calls in a function
but it doesn't work when the library call is a .NET ...
- 519
2
votes
0
answers
389
views
IDA rename argument in all xrefs to function
I have a function of the format:
sub_ABCDEF(&global, "stringName", unimportantValue)
push offset string
mov ecx, offset global
call sub_410010
That is called in several places, each ...
- 85
2
votes
0
answers
496
views
How do I read over an undefined function with IDAPython?
I have a pretty basic IDAPython script which finds indirect calls by using idc.FindText() and then extracts the arguments. It works great except that it does not find the indirect calls in undefined ...
- 21
2
votes
0
answers
1k
views
IDA Pro get line number in main view
I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
- 61
1
vote
0
answers
45
views
How to remove a node in CTREE
Im learning about CTREE in IDA. Here is my ida decompiled code:
v3 = 0;
if ( !strcmp(Str1, "hello") )
v3 = 100;
return a1 + v3;
At this time, i just want to mess arround with CTREE ...
- 67
1
vote
0
answers
225
views
Access RTTI class hierarchy along with offsets from IDAPython
Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI.
When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
- 258
1
vote
0
answers
32
views
How to find prolog with idapython in non-disassambled function raw bytes?
I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?
- 11
1
vote
0
answers
151
views
Passing a pointer to a pointer to a string with IDA Pro's Appcall
I need to call an encryption function in a program with the following signature (the second argument is returned):
char** __usercall decode(char** input, char** output)
As far as I can tell, Appcall ...
- 111
1
vote
0
answers
451
views
IDA script: How to properly undefine a byte and then redefine code
I'm trying to correct the following instructions in IDA using a script:
jnb short near ptr loc_1C61B1+3
It order to do this I'm running a snippet like this in a script:
ida_bytes.del_value(...
- 103
1
vote
0
answers
124
views
How to propagate the new variable type and redefine all the functions that are using it with the new type in IDA?
Lets say there is a variable x in f1, and f1 calls f2 with the variable x
I want ida to automatically redefine the definition of any function like f2, that is using the variable that i just changed ...
- 176
1
vote
0
answers
183
views
propagate manually set types to redefine a function in IDA pro?
Is there anyway in IDA pro to propagate manually set types of variables to redefine function arguments?
for example lets say IDA thinks Func1 takes 4 int as INPUT, now when i set the type of these 4 ...
- 176
1
vote
0
answers
284
views
Parsing binary file to Idb faster with Ida
When Ida parsing big file(50 MB) its can take few hours to parse binary file to IDB even with Intel I9 CPU, Maybe Ida doesn't use all cores?
Is there any way to make that process faster? run it on all ...
- 11
1
vote
0
answers
365
views
idapython: how to apply hexrays types to disassembly interface
I am using idapro 7.5 to get variable information from binaries.
Consider following simple code:
#include <stdio.h>
#include <stdlib.h>
int main(int argc, char *argv[])
{
int i, N, ...
- 1,767
1
vote
0
answers
5k
views
How to change IDA to use Python 3.7 and not Python 2.7: "do not have the x86_64 architecture"
I have IDA 6.95, Python 2.7 and Python 3.7.
Currently when I start IDA it uses Python 2.7:
-----------------------------------------------------------------------------------------
Python 2.7.12 (v2.7....
- 573
1
vote
0
answers
159
views
Replacing bytes from start of every function with IDA Pro
I want to fix a .plt segment in IDA Pro by replacing 12 bytes from start of every function in the .plt segment with the ones I specify.
I want to just make each function return so I'm replacing ...
- 73
1
vote
0
answers
296
views
How to load a library at a specific address in IDA and re-analyze the program statically?
I have a dumped PE that has calls like
call ds:dword_4010B4
now these are actually addresses of APIs in kernel32.dll
my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
- 519
1
vote
0
answers
275
views
How to dump a unpacked PE and still get the API names with IDA when they are called directly?
So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header)
i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
- 519
1
vote
0
answers
312
views
How Can I Clean Up After IDA Decompation with IDAPython or other resource
When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
- 773
1
vote
0
answers
326
views
Get and change function definition IDAPython
I was wondering if it is possible to retrieve the function definition at ea and eventually how to edit it. This feature should be in idaapi but unfortunately there's basically no documentation about ...
- 171
1
vote
0
answers
174
views
Argument types not identified when parsing declarations
I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
0
answers
574
views
Getting R6034 error message when starting IDA Pro
I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
- 11
1
vote
0
answers
177
views
Are there tools or plugins for IDA Pro that can find ELF sections?
I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
- 380
1
vote
0
answers
274
views
idapython：How can I get xref to a stack variable in the form of pseudocode
I have learned about how to get xref to a stack variable,but it is in the form of
assembly:idapython - Get Xrefs to a stack variable
This way works well on a variable like [ebp+var_0] but do not ...
- 31
1
vote
0
answers
384
views
Is there a from...import * equivalent of idaapi.require()?
Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
- 1,351
1
vote
0
answers
1k
views
IDA: Extracting functions arguments from stripped binary
This thread describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0).
Is it possible to extract such ...
1
vote
0
answers
769
views
Determine ARM architecture from IDA plugin
Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues:
1) How can I distinct specific ARM architecture (e.g. ARMv5,...
- 139
1
vote
0
answers
279
views
IDAPython loading parameters bruteforce
I have a binary file for known hardware platform, but nothing more is known.
When I load this file in IDA (with default parameters), nothing good happens - at least does not appear xrefs to readable ...
- 21
1
vote
0
answers
353
views
Show IDAPython prompt
Subj hides itself on a mere Escape pressed in the input field. How to bring it back? I didn't find a way short of restarting IDA.
It's IDA 6.1 x32 & IDAPython v1.5.2.
- 111