Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
18
votes
3answers
11k views

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
15
votes
4answers
14k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...
15
votes
3answers
5k views

How to debug an IDAPython script from within IDA?

IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
10
votes
2answers
4k views

How to map an arbitrary address to its corresponding basic block in IDA?

Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that? Edit: more specifically, I want to know the beginning / end of ...
10
votes
1answer
4k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
8
votes
2answers
6k views

Good training for IDAPython

I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
8
votes
2answers
12k views

IDA Pro List of Functions with Instruction

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
8
votes
2answers
994 views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
8
votes
1answer
3k views

Is there a way to set the cursor address in IDA Pro?

In the same way that ScreenEA() returns the current cursor address, is there a way to set the address? Something that would resemble SetScreenEA()?
8
votes
2answers
3k views

How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type

I'm writing an IDA plugin using idapython in order to add comments (located in database) to variables of struct types. In order to do this, firstly, i need to get the list of cross-references to a ...
8
votes
1answer
5k views

How can I control the Hex-Rays decompiler plugin from IDA with scripts?

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....
7
votes
2answers
3k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
7
votes
1answer
710 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
7
votes
1answer
3k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
7
votes
1answer
909 views

Is there a way to set the number special purpose registers in IDA pro with a script?

IDA has this nifty habit that when it doesn't know what a special purpose register is, it just drops in the number of the register instead. While this is all well and fine, I'd like to be able to ...
7
votes
1answer
671 views

Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?

Let's say I have lots of breakpoints at some push instructions. I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + ...
6
votes
3answers
3k views

How to get the CPU architecture via Idapython?

I was not able to find an API function to get the CPU architecture of the loaded binary. In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type. ...
6
votes
2answers
5k views

How to get imge base of current setting through script in IDA pro?

As a beginner I'm trying to disassemble a file with IDA Pro 6.5. I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program. Now, I want to get the image base of ...
6
votes
3answers
8k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
6
votes
3answers
517 views

How can I clean up strings built at runtime?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
6
votes
1answer
2k views

How to extract the input file offset of a byte in idapython?

For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
6
votes
1answer
8k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
6
votes
1answer
523 views

A wiki for IDA? [closed]

Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the ...
6
votes
1answer
6k views

How to automatically rename some IDA functions from a given list?

I have a text file which contains a list of function name and address pairs, structured like this : 194C:841B LoadMessage 194C:8429 ShowDialog ... Is there a way (eg: script, automation, ...) to ...
6
votes
2answers
1k views

IDA Pro/IDAPython automation through IDAPython

I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the ...
6
votes
1answer
10k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
6
votes
1answer
3k views

Idapython - undefining an instruction

I have an instructions defined from address+1 onward and a byte at address. I'd like to undefine the instructions from address+1 onward and redefine them from address using MakeCode or something ...
6
votes
2answers
6k views

IDA python, write to specific memory location

I am looking for a way to modify memory location in IDA python script. We can read memory with these functions: Byte(address) Word(address) Dword(address) When I try to do something like this: Byte(...
5
votes
2answers
3k views

idapython - Determine if item is code or data

I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see ...
5
votes
2answers
2k views

IDA [call $+5 / pop reg] cleaning

Can anyone tell me how to clean up the code which contains the following blocks: call $+5 pop reg add reg, 08BE96h [...] In other words I need to change all such blocks to: mov reg, offset Edit # ...
5
votes
1answer
3k views

How is IDAPython API structured?

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
5
votes
1answer
15k views

Using IDA Python Iterate Through All Functions and Their Instructions

I'm new to IDAPython. Basically I want to iterate through all functions in an IDB file and their instructions using ida python script. The final goal is to export the functions & their ...
5
votes
2answers
4k views

Ida Pro: parsig complex operand expression using Idapython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
5
votes
2answers
2k views

Accessing Data Marked as Alignment Bytes in IDA

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA. .text:00401176 ...
5
votes
1answer
2k views

Is it possible to create data xrefs manually?

I have a binary with lots of indirect calls (call dword ptr [register + offset ]) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead ...
5
votes
2answers
3k views

IDAPython for IDAFree 5.0

I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can ...
5
votes
0answers
726 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
5
votes
0answers
568 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
4
votes
3answers
4k views

Is it possible to get a list of user-defined names in IDA?

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
4
votes
3answers
1k views

Automatically decode PUSH+RET call into JMP

While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here. So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
4
votes
1answer
3k views

Can I invoke IDA's plugin BinDiff from command line?

I am trying to evaluate a very large amount of binaries (thousands) using BinDiff, and currently I only need some instruction level statistics from BinDiff, which can be acquired from its dumped ...
4
votes
2answers
3k views

Automating a Decryption function call in IDA Python

I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times. The function takes three arguments and is a simple xor decryption. However it ...
4
votes
1answer
3k views

IDA Pro/IDA Python, producing file via terminal

I am using IDA Pro 6.5 and running it via terminal with the following command line switches: -B (to run in batch mode, should automatically generate a .asm file containing results) -S running a ...
4
votes
2answers
2k views

Setting an IDA function pointer in a struct via script

The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member ...
4
votes
2answers
3k views

IDA Pro converting to instruction functionality: how to automate.

I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit "c" in order to convert to instruction/code. However, I am ...
4
votes
2answers
646 views

idapython - assign a struct to a stack variable

I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do Alt+Q); Doing this for addresses in .data is not a problem, but I can't figure out a way to ...
4
votes
1answer
1k views

IDA: Changing type of arguments to local type

I have functions foo_0(...,_ v0,...) foo_1(...,_ v1,...) ... And, for each (foo_x, _ v_x) pair, I would like to change the type of v_x in the declaration to ANIMAL *, where ANIMAL is a local type. ...
4
votes
1answer
4k views

IDA python, list all imported functions

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions: import idc import idaapi import idautils def set_breakpoints(): ea = idc.ScreenEA() ...
4
votes
1answer
7k views

Executing an IDAPython script with arguments within IDA Pro

I have an IDAPython script x.py which takes some arguments, which prevents me from simply using alt + F7 and selecting my script. How can I execute this script within IDA Pro and specify the ...
4
votes
1answer
992 views

IDA Pro: Platform-independent way to check if an instruction is a jump

I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures. I thought one may ...

1
2 3 4 5 6