Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

44 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
698 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
4
votes
0answers
541 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
3
votes
0answers
134 views

how to calculate max possible stack size utilization

Is there any elegant way to calculate the maximum possible stack depth utilization of a program, using IDAPython? currently my best approach is iterating through all functions and counting stack-...
3
votes
0answers
1k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
3
votes
0answers
334 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
3
votes
0answers
294 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
2
votes
0answers
110 views

IDA rename argument in all xrefs to function

I have a function of the format: sub_ABCDEF(&global, "stringName", unimportantValue) push offset string mov ecx, offset global call sub_410010 That is called in several places, each ...
2
votes
2answers
260 views

Nested Structures in IDA

I'm trying to figure out how to explore structs in IDA, and getting stuck on the basics. I wrote a very basic test app; int main() { const int kBits = 1024; const int kExp = 3; RSA *rsa =...
2
votes
0answers
264 views

How do I read over an undefined function with IDAPython?

I have a pretty basic IDAPython script which finds indirect calls by using idc.FindText() and then extracts the arguments. It works great except that it does not find the indirect calls in undefined ...
2
votes
0answers
357 views

getting the flags of an IDA name

IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc). So far all is good and ...
2
votes
0answers
698 views

IDA Pro get line number in main view

I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
1
vote
1answer
109 views

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
1
vote
0answers
33 views

How Can I Clean Up After IDA Decompation with IDAPython or other resource

When I am working on a source code recovery project I am usually left with a lot of code that needs to be manually cleaned up by hand. This can take a lot of time and as projects get larger , I am ...
1
vote
1answer
73 views

MakeArray from stack variables using idapython

I want to MakeArray() to stack variables which can be done with IDA like so: MakeArray() Create an array. ea - linear address nitems - size of array in items This ...
1
vote
0answers
69 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
1
vote
0answers
261 views

API to force reanalyze of function (Alt-P)

Using Alt+P on a function and hitting enter will force a reanalysis of the function (https://www.hex-rays.com/products/ida/support/idadoc/485.shtml) Is there a way to do this through API?
1
vote
0answers
178 views

Getting R6034 error message when starting IDA Pro

I have installed Anaconda on Windows to replace standalone Python installation that was used by the IDA Pro. I have confirmed that all relevant environment variables and register keys were set to ...
1
vote
0answers
63 views

Are there tools or plugins for IDA Pro that can find ELF sections?

I'm trying to use data from one ELF to build another ELF, but I can't seem to find anything that gets what I need using IDA Pro. I'm trying to build a database out of Sections, Symbols, and Cross-...
1
vote
0answers
80 views

idapython:How can I get xref to a stack variable in the form of pseudocode

I have learned about how to get xref to a stack variable,but it is in the form of assembly:idapython - Get Xrefs to a stack variable This way works well on a variable like [ebp+var_0] but do not ...
1
vote
0answers
328 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
1
vote
0answers
258 views

Is there a from…import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
0answers
844 views

IDA: Extracting functions arguments from stripped binary

This thread describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0). Is it possible to extract such ...
1
vote
0answers
508 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
1
vote
0answers
216 views

IDAPython loading parameters bruteforce

I have a binary file for known hardware platform, but nothing more is known. When I load this file in IDA (with default parameters), nothing good happens - at least does not appear xrefs to readable ...
1
vote
0answers
290 views

Show IDAPython prompt

Subj hides itself on a mere Escape pressed in the input field. How to bring it back? I didn't find a way short of restarting IDA. It's IDA 6.1 x32 & IDAPython v1.5.2.
1
vote
0answers
118 views

Deducing register contents through IDA scripting

In some of my IDA scripts, it would be useful to be able to reason about which variables were stored in which registers at a given place in the program. One example is the following: mov rdx, [...
1
vote
0answers
409 views

Using MyNav Python Scripts With IDA Pro 6.1 On Windows 7

I just came across the MyNav Python scripts and would like to use some of their functionality on my IDA Pro database. I have IdaPython installed properly, but I cannot seem to get the plugins to show ...
1
vote
0answers
163 views

How can I parse VMTs in IDA if I have the base address?

I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API ...
1
vote
0answers
1k views

How to get opcodes for assembly using ppc processor (IDAPython)

In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the Assemble(ea, line) function. Here is an example using a PE-file / x86 processor type: Python>Assemble(...
1
vote
0answers
172 views

Changing the argument number in a macro in IDA Pro

Can I change argument number to macro in IDA pro Hex-rays? fd = open("a", 513, 0644); Like this. fd = open("a", O_WRONLY|O_CREAT, 0644); Is this possible?
0
votes
0answers
13 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
0
votes
0answers
20 views

How to dump a unpacked PE and still get the API names with IDA when they are called directly?

So i have a PE that unpacks itself and rewrites the entrypoint and so on (not the header) i unpacked it using scylla and x32dbg, i set the OEP to the previous OEP since it writes the unpacked one ...
0
votes
0answers
18 views

How to make library functions linked statically to extrn?

I want to write an IDAPython script which will identify all statically linked libraries (I think I got that part down - starting from a certain address they all seem to be library functions) - then ...
0
votes
1answer
60 views

How to set virtual `T` register programmatically in IDA Python?

It is trivial to do it with Alt+G command from GUI. However, when I set multiple breakpoints programmatically, IDA doesn't recognize them as "thumb" mode ones and sets T value at breakpoint address ...
0
votes
1answer
77 views

How to make IDA processor for file format with tree structure

Most of file formats IDA handles are structured in a linear way, for example EXE or ELF or Java's Class file and so on. However when it comes to tree-structured file format, I can't come up with a ...
0
votes
0answers
78 views

IDAPython - Find the start of an undefined code blob

I'm currently working on an IDAPython script that aims to remove various rogue-byte from the malware that I'm reversing. I'm in a case where some portions of my code contain this type of anti-...
0
votes
1answer
75 views

IDAPython Export All Addresses Called by Specific Call

The following call gets executed many times and jumps to many subroutines. call [rbp+var_s38] What do I need to write in the breakline condition to export all the locations it jumps to? import ...
0
votes
0answers
54 views

idapython - Scan all possible code paths between start and end addresses

I have a start and end address inside a function segment. How can I step through all the possible code paths easily, including jumps, function calls, etc that occur between the start and the end point?...
0
votes
0answers
27 views

Changing a string pointer while debugging

I'm facing an issue, and I'm not sure what is the best way to handle it. While debugging a program (x64, windows), the program copies certain string using errno_t strncpy_s(char *restrict dest, ...
0
votes
0answers
218 views

How to run python script in IDA PRO after each breakpoint?

I want to write a script which after breakpoint will change some values in running program. I've tried to write script into condition field but it generates error. I'm trying to find something like '...
0
votes
0answers
29 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...
0
votes
0answers
38 views

Get and change function definition IDAPython

I was wondering if it is possible to retrieve the function definition at ea and eventually how to edit it. This feature should be in idaapi but unfortunately there's basically no documentation about ...
0
votes
0answers
386 views

Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?

Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
0
votes
0answers
2k views

Modify memory without patching the database

Is there a way to modify one or more bytes in memory without making any changes in the database? I know about idc.PatchByte() in idapython, but it will print the message that states that 'This ...