Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
0 votes
1 answer
59 views

IDA - Decoding this "XORed"? string automatically in psuedocode

__m128i ModuleName; __m128i ProcName; ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64; ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64; ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64; ProcName....
lightersmash's user avatar
0 votes
2 answers
105 views

How to change default pointer size in IDA Pro

so, I'm writing a script to automate analysis, and the code I'm working with is 64bit. the pointer size field shown here is the wrong one: I want to change it from within python to 64bit. I've ...
serv0's user avatar
  • 21
0 votes
2 answers
136 views

How to make a plugin python function available to IDA's console?

I want to have utility functions shared between all databases, for example: from idautils import * from idaapi import * from idc import * from ida_name import * def FindFunctionImpl(...
KulaGGin's user avatar
  • 316
0 votes
0 answers
64 views

Import function symbols from a reflection system into IDA

I'd like to import structs and functions from a reflection system into IDA. The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
KulaGGin's user avatar
  • 316
1 vote
0 answers
263 views

How to use IDA environment to run python scripts?

I am trying out following technique: https://github.com/CMUSTRUDEL/DIRTY This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset. It ...
R4444's user avatar
  • 1,797
0 votes
1 answer
66 views

My ida.reg file got deleted, is there any way to restore ida?

I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed - Is there any way to restore ida? ...
R4444's user avatar
  • 1,797
0 votes
0 answers
65 views

IDA python : display not refreshing function parameters after type update

I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :) The issue : I have a ...
Jeremy's user avatar
  • 1
1 vote
1 answer
434 views

How to run exe program loaded into IDA Pro or Ghidra

I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
valaGQ237's user avatar
1 vote
1 answer
214 views

Retrieve & dump type information from IDA Pro

I want to retrieve IDA Pro .idb database's each type info, such as: size and name of a structure; each member variable type and name; each member variable size and offset; And dump it to a .h file ...
void_17's user avatar
  • 33
0 votes
1 answer
85 views

IDA Pro Debugging GDB SendDbgCommand

I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging. Setting up the debug environment with IDA Pro using ...
Ballers's user avatar
  • 49
0 votes
1 answer
91 views

IDA python API set function chunk end

I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
Tomer Attali's user avatar
0 votes
1 answer
230 views

NameError: name 'ScreenEA' is not defined

Part of Practical malware analysis Lab5, is to run a python script in IDA Pro I have tried by going to Files-->Script command then I have pasted my python code: sea = ScreenEA() for i in range(...
Octo's user avatar
  • 1
-1 votes
1 answer
196 views

Simple Question About Reversing a Python

So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of ...
Roy Guzman's user avatar
0 votes
1 answer
79 views

How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?

Is there an API which lets me programmatically: set the default string type (Setup) and rebuild the string list (Rebuild) ???
0xC0000022L's user avatar
  • 10.9k
0 votes
1 answer
190 views

How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?

I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
Konstantinos's user avatar
0 votes
1 answer
123 views

idat.exe -S, path with spaces

I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so But I get an error. Among the logs is present the error: home\mypath: ...
Dario B.'s user avatar
0 votes
1 answer
74 views

idat.exe -S -A close without error

I have developed a idapython script and I run it using the following command: idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so In myscript.py I appended the exit(0) in order to ...
Dario B.'s user avatar
1 vote
1 answer
216 views

How to quickly mark functions library in IDA Pro?

I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
void_17's user avatar
  • 33
2 votes
1 answer
350 views

IDA: Demangled name simplification in idapython

With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them. For example, the following function: Python> ida_name.demangle_name(idc....
Blub's user avatar
  • 123
1 vote
0 answers
80 views

How to remove a node in CTREE

Im learning about CTREE in IDA. Here is my ida decompiled code: v3 = 0; if ( !strcmp(Str1, "hello") ) v3 = 100; return a1 + v3; At this time, i just want to mess arround with CTREE ...
Brian MJ's user avatar
3 votes
1 answer
99 views

IDAPython get current module name in a debugger

I have a script that catches say a value of 666 in the RDX register and pauses debugging. The problem is, that this value might be added to the register by other modules aside from the main ...
MartinRøde's user avatar
4 votes
0 answers
240 views

idapython: variable instruction references (def-use) for data flow analysis

Let's consider a code snippet: I can get disassembler variables- def get_function_vars(function) -> list: frameId = idc.get_frame_id(function) if frameId: varStruct = ida_struct....
R4444's user avatar
  • 1,797
3 votes
1 answer
117 views

How to highlight all external registers in a function

What I want: detect all potentially usercall, userpurge - functions; when entering the function, immediately see all external entities: arguments passed through registers; i.e., in order not to ...
user avatar
1 vote
1 answer
211 views

IDAPython doesn't recognize function

I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
Luca's user avatar
  • 121
2 votes
0 answers
55 views

Is it possible to create nested memory mapped registers in IDA Processor Modules?

Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
none32's user avatar
  • 111
2 votes
0 answers
54 views

Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?

Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following: mov rax, cs:KeDelayExecutionThrea lea r8, [rsp+28h+arg_0] xor edx, ...
OneAndOnly's user avatar
2 votes
0 answers
61 views

Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)

Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
OneAndOnly's user avatar
3 votes
0 answers
152 views

IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?

I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
none32's user avatar
  • 111
2 votes
1 answer
197 views

IDAPython's FlowChart wrong basic blocks

I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA. As you ...
Luca's user avatar
  • 121
4 votes
2 answers
549 views

IDAPython set name of function using string passed to debug logging subfunction

IDA Pro 7.6 Static disassembly of ARM executable. This binary has 40K functions or so, and no symbols. So all the functions are sub_49FFA etc. However, 90% of these functions have a call to a debug ...
Tis Me's user avatar
  • 83
1 vote
0 answers
426 views

Access RTTI class hierarchy along with offsets from IDAPython

Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI. When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
overflo's user avatar
  • 268
4 votes
0 answers
534 views

Does IDA Freeware 8.x support plugins?

According to the information I searched, it is not supported in IDA 7.x and before. Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before. refer:...
huang's user avatar
  • 223
3 votes
1 answer
98 views

Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?

I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M). Looking at the idapython documentation, it looks like maybe I can do this via the ...
Bill B's user avatar
  • 206
2 votes
0 answers
285 views

IDA api: get function argument definition

So let's say we have the following code: 0: lea rax, [rbp+8] 1: mov rcx, rax 2: mov rdx, 5 3: call my_fun i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
xar3's user avatar
  • 41
2 votes
0 answers
221 views

Convert instructions to op code bytes in python script for IDA Pro

I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work. This is my python ...
Luca's user avatar
  • 121
1 vote
0 answers
18 views

How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]

I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
0xh3xa's user avatar
  • 111
1 vote
1 answer
150 views

How to call the Color Picker window in Ida Pro from a script?

I'm going to make a python script that allows you to color selected functions - in the right colors. To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
user avatar
0 votes
1 answer
304 views

ida pro: scripting debugger with python fails on step_over/run_to

So I am trying to run an app and collect information at certain points. No biggie, right? Wrong. Check this simple example: import ida_dbg ida_dbg.step_over() #or runto() eax = ida_dbg.get_reg_val(&...
bernd feinman's user avatar
3 votes
1 answer
335 views

How to select an item in IDAPython, in decompilation view?

I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures). I have changed the arguments types for a list of ...
overflo's user avatar
  • 268
1 vote
1 answer
141 views

Why does tif.get_func_details sometimes only starts to work after decompiling the function?

I am going through a huge executable and am fetching information about functions arguments this way: tif, funcdata = ida_typeinf.tinfo_t(), ida_typeinf.func_type_data_t() assert ida_nalt.get_tinfo(...
overflo's user avatar
  • 268
1 vote
1 answer
645 views

IDAPython Get Function Parameter Type Name

I'm currently trying to make a hotkey to rename example functions sub_123450(aType* this, void* a2) to aType::123450(aType* this, void* a2). I have code to rename etc. but how can I get the name of ...
Stewart's user avatar
  • 95
1 vote
2 answers
311 views

Renaming a local stack variable with IDAPython

I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so... In my ...
rotem.salinas's user avatar
1 vote
0 answers
34 views

How to find prolog with idapython in non-disassambled function raw bytes?

I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?
Jôsùå's user avatar
1 vote
1 answer
454 views

idapython: how to reset pointer type for variables

I am using IDA Pro 7.6 on win32 x86 binaries. I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
coolthingsforme's user avatar
2 votes
1 answer
443 views

how to get indirect callsite function return type and arguments

I am using idapython to get function return type and arguments @ an indirect call instruction. I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
R4444's user avatar
  • 1,797
2 votes
1 answer
413 views

How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?

TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc). In order to explicitly load a type library I can use ...
0xC0000022L's user avatar
  • 10.9k
0 votes
2 answers
1k views

idapython: how to get decompiler output corresponding to the indirect call

For, e.g. disassembler or IDA view: Decompiler or Hex View: I can get the decompilation of whole function using something like: decompiled = ida_hexrays.decompile(ea) But, in this way I get the ...
R4444's user avatar
  • 1,797
0 votes
1 answer
2k views

How do I enable Python on IDA 6.8?

I have a python dir within IDA 6.8 folder with idaapi.py, idautils.py, and idc.py. IDA doesn't seem to pick the Python scripting by default. How do I enable it?
Irbis77's user avatar
  • 326
2 votes
1 answer
726 views

How to print disassembly code with IDAPython when IDA doesn’t detect it as code

I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA: I want to print ...
Chirrin Dul's user avatar
1 vote
1 answer
131 views

IDA API: obtain operand size prefix (x64)

I am trying to tell apart the following two instructions: 8D 02 lea eax, [rdx] // auxfix = 0x1810 67 8D 02 lea eax, [edx] // auxfix = 0x810 The only difference is in the insn_t....
bernd feinman's user avatar

1
2 3 4 5
8