Questions tagged [idapython]
A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.
368
questions
0
votes
1
answer
59
views
IDA - Decoding this "XORed"? string automatically in psuedocode
__m128i ModuleName;
__m128i ProcName;
ModuleName.m128i_i64[0] = 0x3E4D19089E7D5EDi64;
ModuleName.m128i_i64[1] = 0xD8855EB576AF36A0ui64;
ProcName.m128i_i64[0] = 0x6F80FFFCE583A183i64;
ProcName....
0
votes
2
answers
105
views
How to change default pointer size in IDA Pro
so, I'm writing a script to automate analysis, and the code I'm working with is 64bit.
the pointer size field shown here is the wrong one:
I want to change it from within python to 64bit. I've ...
0
votes
2
answers
136
views
How to make a plugin python function available to IDA's console?
I want to have utility functions shared between all databases, for example:
from idautils import *
from idaapi import *
from idc import *
from ida_name import *
def FindFunctionImpl(...
0
votes
0
answers
64
views
Import function symbols from a reflection system into IDA
I'd like to import structs and functions from a reflection system into IDA.
The problem I have is with functions. So I have all the type information: namespace, class name, function name, calling ...
1
vote
0
answers
263
views
How to use IDA environment to run python scripts?
I am trying out following technique:
https://github.com/CMUSTRUDEL/DIRTY
This is a deep learning approach for type and name recovery. It uses ida scripts to generate and preprocess the dataset.
It ...
0
votes
1
answer
66
views
My ida.reg file got deleted, is there any way to restore ida?
I Got IDA Pro license and for some reason ida.reg file from my home/.ida directory got deleted and now I just can't run ida and instead I get following displayed -
Is there any way to restore ida? ...
0
votes
0
answers
65
views
IDA python : display not refreshing function parameters after type update
I just encountered an issue in IDA python, which I "solved", just very badly. I'd like some explanation here if someone knows what is happening and maybe even why ! :)
The issue :
I have a ...
1
vote
1
answer
434
views
How to run exe program loaded into IDA Pro or Ghidra
I'm new to reverse engineering, just learning. After the exe program is loaded into IDA or Ghidra, how do I run the exe program that loaded into IDA/Ghidra? so I can interact with the exe program? and ...
1
vote
1
answer
214
views
Retrieve & dump type information from IDA Pro
I want to retrieve IDA Pro .idb database's each type info, such as:
size and name of a structure;
each member variable type and name;
each member variable size and offset;
And dump it to a .h file ...
0
votes
1
answer
85
views
IDA Pro Debugging GDB SendDbgCommand
I'm following this tutorial here https://www.triplefault.io/2017/07/loading-kernel-symbols-vmm-debugging.html to load kernel symbols with debugging.
Setting up the debug environment with IDA Pro using ...
0
votes
1
answer
91
views
IDA python API set function chunk end
I’m trying to set a function chunk end at a certain EA in a function using my Ida python plugin, but I can’t find any API which lets me do just that. set_func_end appear not to work (keeps returning ...
0
votes
1
answer
230
views
NameError: name 'ScreenEA' is not defined
Part of Practical malware analysis Lab5, is to run a python script in IDA Pro
I have tried by going to Files-->Script command then I have pasted my python code:
sea = ScreenEA()
for i in range(...
-1
votes
1
answer
196
views
Simple Question About Reversing a Python
So, detect it easy, shows that the .exe is a python 3.9 compiled on visual studio and the compiler was MS Visual C/C++. Trying to unpack it using pyinstxtractor fails, and shows me the error of
...
0
votes
1
answer
79
views
How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?
Is there an API which lets me programmatically:
set the default string type (Setup) and
rebuild the string list (Rebuild)
???
0
votes
1
answer
190
views
How to pass an SVD file as an argument to IDA Pro in the command line (batch mode)?
I am trying to disassemble a few Arm Cortex-M3 .elf binaries and run a custom IDAPython script (script.py) from the command line (in batch mode). I have been able to do that with the following command:...
0
votes
1
answer
123
views
idat.exe -S, path with spaces
I'm trying to execute the command: idat.exe -S"home\mypath to script\myscript.py args" -L"logs" -A mybin.so
But I get an error. Among the logs is present the error:
home\mypath: ...
0
votes
1
answer
74
views
idat.exe -S -A close without error
I have developed a idapython script and I run it using the following command:
idat.exe -S"myscript.py" -L"logs.txt" -A .\mylib.so
In myscript.py I appended the exit(0) in order to ...
1
vote
1
answer
216
views
How to quickly mark functions library in IDA Pro?
I have a binary with debug information and I want to mark STL library functions with "Library function" tag as quick as possible, just by highlighting a range of functions and clicking some ...
2
votes
1
answer
350
views
IDA: Demangled name simplification in idapython
With idapython I would like to get demangled names with the name simplification (bottom of page) applied to them.
For example, the following function:
Python> ida_name.demangle_name(idc....
1
vote
0
answers
80
views
How to remove a node in CTREE
Im learning about CTREE in IDA. Here is my ida decompiled code:
v3 = 0;
if ( !strcmp(Str1, "hello") )
v3 = 100;
return a1 + v3;
At this time, i just want to mess arround with CTREE ...
3
votes
1
answer
99
views
IDAPython get current module name in a debugger
I have a script that catches say a value of 666 in the RDX register and pauses debugging. The problem is, that this value might be added to the register by other modules aside from the main ...
4
votes
0
answers
240
views
idapython: variable instruction references (def-use) for data flow analysis
Let's consider a code snippet:
I can get disassembler variables-
def get_function_vars(function) -> list:
frameId = idc.get_frame_id(function)
if frameId:
varStruct = ida_struct....
3
votes
1
answer
117
views
How to highlight all external registers in a function
What I want:
detect all potentially usercall, userpurge - functions;
when entering the function, immediately see all external entities:
arguments passed through registers;
i.e., in order not to ...
1
vote
1
answer
211
views
IDAPython doesn't recognize function
I'm developing a python script for IDA Pro that analyzes 32 bit PE files containing an anti-disassembly technique, the problem is that the function that contains the technique isn't being listed in ...
2
votes
0
answers
55
views
Is it possible to create nested memory mapped registers in IDA Processor Modules?
Let's look at this very simple example: we have an AX (16-bit) register, which splits into two 8-bit registers: AH and AL (imagine x86). Then, imagine that these registers are memory mapped starting ...
2
votes
0
answers
54
views
Make IDA pro decompiler to show me the destination of trampoline calls instead of the trampoline function?
Right now I have a obfuscated driver, that in order to call something like KeDelayExecutionThread, it does the following:
mov rax, cs:KeDelayExecutionThrea
lea r8, [rsp+28h+arg_0]
xor edx, ...
2
votes
0
answers
61
views
Ida pro doesn't list windbg in debugger lists when the input file is a not a normal PE file? (Windows kernel debug)
Ida has a really weird feature/bug that when you input a non-normal PE file like a memory dump of a kernel buffer, or an EFI file (even though EFI is PE..), you cannot select the windbg as the ...
3
votes
0
answers
152
views
IDA Processor Module: How to maintain register values if instruction doesn't modify them directly (ex. STATUS register, FLAGS, etc.)?
I'm developing a processor module for a specific microcontroller. There are cases, when instruction modifies some register (lets call it STATUS) indirectly. By indirectly, I mean, that STATUS is not ...
2
votes
1
answer
197
views
IDAPython's FlowChart wrong basic blocks
I'm developing a python script for IDA Pro and I seem to have a problem with idaapi.FlowChart because it retrieves another basic block that isn't present in the graph view of the GUI of IDA.
As you ...
4
votes
2
answers
549
views
IDAPython set name of function using string passed to debug logging subfunction
IDA Pro 7.6
Static disassembly of ARM executable.
This binary has 40K functions or so, and no symbols. So all the functions are sub_49FFA etc.
However, 90% of these functions have a call to a debug ...
1
vote
0
answers
426
views
Access RTTI class hierarchy along with offsets from IDAPython
Starting with 7.0, IDA Pro parses and annotates exception handling information and RTTI.
When you double-click on a RTTI Complete Object Locator right above the start of the vtable and then double-...
4
votes
0
answers
534
views
Does IDA Freeware 8.x support plugins?
According to the information I searched, it is not supported in IDA 7.x and before.
Has this changed in 8.x? Because now the 8.x decompiler cloud version is free, which is different from before.
refer:...
3
votes
1
answer
98
views
Is it possible to work with 'marked positions' in IDA from idapython, and if so, how?
I'm working on an IDA script in which I'd like to iterate through addresses that have been marked (with Alt-M).
Looking at the idapython documentation, it looks like maybe I can do this via the ...
2
votes
0
answers
285
views
IDA api: get function argument definition
So let's say we have the following code:
0: lea rax, [rbp+8]
1: mov rcx, rax
2: mov rdx, 5
3: call my_fun
i want to get the actual argument of the my_fun call, which would be the [rbp+8] local var in ...
2
votes
0
answers
221
views
Convert instructions to op code bytes in python script for IDA Pro
I need to convert into op code bytes the instructions that I have disassembled but I can't find a function that lets me do it, I've tried idc.get_bytes but it doesn't seem to work.
This is my python ...
1
vote
0
answers
18
views
How to use IDA pro to convert a batch of binary PE files into assembly code? [duplicate]
I have a batch of binary PE files, and I want to convert them into assembly code using IDA pro. Do you know IDA command/plugin to automatically convert all of them?
1
vote
1
answer
150
views
How to call the Color Picker window in Ida Pro from a script?
I'm going to make a python script that allows you to color selected functions - in the right colors.
To do this, I need to programmatically call the ColorPicker window so that the user can select the ...
0
votes
1
answer
304
views
ida pro: scripting debugger with python fails on step_over/run_to
So I am trying to run an app and collect information at certain points.
No biggie, right? Wrong. Check this simple example:
import ida_dbg
ida_dbg.step_over() #or runto()
eax = ida_dbg.get_reg_val(&...
3
votes
1
answer
335
views
How to select an item in IDAPython, in decompilation view?
I would like to automate calling the DeepScanVariable function from the HexRaysPyTools right-click menu (that serves to reconstruct structures).
I have changed the arguments types for a list of ...
1
vote
1
answer
141
views
Why does tif.get_func_details sometimes only starts to work after decompiling the function?
I am going through a huge executable and am fetching information about functions arguments this way:
tif, funcdata = ida_typeinf.tinfo_t(), ida_typeinf.func_type_data_t()
assert ida_nalt.get_tinfo(...
1
vote
1
answer
645
views
IDAPython Get Function Parameter Type Name
I'm currently trying to make a hotkey to rename example functions sub_123450(aType* this, void* a2) to aType::123450(aType* this, void* a2). I have code to rename etc. but how can I get the name of ...
1
vote
2
answers
311
views
Renaming a local stack variable with IDAPython
I am trying to write an IDAPython script that renames some local variables (in the disassembly window) according to some logic, unfortunately I am unable/failing to use the API to do so...
In my ...
1
vote
0
answers
34
views
How to find prolog with idapython in non-disassambled function raw bytes?
I tried googling but I didn't find much info. I am trying to get the function prolog from an instruction inside a function. The function is in raw bytes. Is this possible to get?
1
vote
1
answer
454
views
idapython: how to reset pointer type for variables
I am using IDA Pro 7.6 on win32 x86 binaries.
I'm trying to use the ida_hexrays interface to decompile subroutines. I want all of the local variables and arguments of the subroutine to have integral ...
2
votes
1
answer
443
views
how to get indirect callsite function return type and arguments
I am using idapython to get function return type and arguments @ an indirect call instruction.
I was able to sync ida disassembler with hexrays decompiler as asked here and I can now get decompiled ...
2
votes
1
answer
413
views
How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?
TL;DR: I want to do this programmatically using either IDC or IDAPython and failed to find an option that works for me (also scoured idc.idc).
In order to explicitly load a type library I can use ...
0
votes
2
answers
1k
views
idapython: how to get decompiler output corresponding to the indirect call
For, e.g. disassembler or IDA view:
Decompiler or Hex View:
I can get the decompilation of whole function using something like:
decompiled = ida_hexrays.decompile(ea)
But, in this way I get the ...
0
votes
1
answer
2k
views
How do I enable Python on IDA 6.8?
I have a python dir within IDA 6.8 folder with idaapi.py, idautils.py, and idc.py. IDA doesn't seem to pick the Python scripting by default.
How do I enable it?
2
votes
1
answer
726
views
How to print disassembly code with IDAPython when IDA doesn’t detect it as code
I have a piece of malware for windows / x64 which is packed, so IDA only recognizes the unpacker routine as data. This is the aspect of the zone just after loading the binary in IDA:
I want to print ...
1
vote
1
answer
131
views
IDA API: obtain operand size prefix (x64)
I am trying to tell apart the following two instructions:
8D 02 lea eax, [rdx] // auxfix = 0x1810
67 8D 02 lea eax, [edx] // auxfix = 0x810
The only difference is in the insn_t....