Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
4
votes
2answers
474 views

idapython - assign a struct to a stack variable

I was wondering if anyone knows how to assign a struct to a stack variable using IDAPython (like when we do Alt+Q); Doing this for addresses in .data is not a problem, but I can't figure out a way to ...
2
votes
1answer
271 views

IDC: Get structure id under cursor in “Structures” window?

I'm writing an IDC script which accepts a structure and does some processing. Currently, I have to call it by typing structure names. What I want is to make it use the structure under cursor in "...
4
votes
1answer
997 views

IDA: Changing type of arguments to local type

I have functions foo_0(...,_ v0,...) foo_1(...,_ v1,...) ... And, for each (foo_x, _ v_x) pair, I would like to change the type of v_x in the declaration to ANIMAL *, where ANIMAL is a local type. ...
1
vote
0answers
79 views

idapython:How can I get xref to a stack variable in the form of pseudocode

I have learned about how to get xref to a stack variable,but it is in the form of assembly:idapython - Get Xrefs to a stack variable This way works well on a variable like [ebp+var_0] but do not ...
2
votes
2answers
1k views

IDA Pro - how to export a listing file in batch mode

I am using IDA Pro 6 and I'm looking for a way to automatically export an analysed file into a listing (.lst) file. The interface of IDA enables to do this action using the menu File > Produce File > ...
1
vote
1answer
397 views

How can I mark a global variable as an offset using IDAPython?

I have a four byte global variable that is a pointer to some other data. How can I mark this to be an offset (like pressing o) using IDAPython? .text:00436FF3 dd 43702Ch ida_offset.op_offset_ex ...
1
vote
0answers
327 views

IDAPython Decompile - connect assembly to pseudo-code line

I'm trying to write a small application that can show for each line of the de-compiled psuedo code of a certain function the assembly instruction that responsible for it. for example if we have a ...
1
vote
1answer
575 views

How to force IDA pro to list some bytes as a specified instruction?

Please first read this My previous question, and then continue the following: **** The binary file size loaded into IDA is 0x1e400 = 123k, and when I try to only change the "Loading address" to ...
2
votes
1answer
281 views

How to modify strings and funtions reference detection in IDA pro?

I have loaded a binary file into IDA which is for Motorola 6800 series. The strings are referenced like this: pea ($2017A99).l. The actual address of the referenced string in above command is ...
3
votes
1answer
3k views

IDAPython: How to get function argument values

I always write ad-hoc code to get the values passed to function calls, like finding the XRef to a function and then tracking back disassembly to find some specific MOV or PUSH instruction. For example,...
0
votes
1answer
255 views

calc_switch_cases() in IDApython, can't iterate over results

i'm actually quite new to IDApython programing and i'm trying to get, for a "switch-case" jump table, the list of basic blocks for a given value of the case. While experimenting, i was trying to ...
-1
votes
1answer
333 views

Dis-assamble .exe file to .asm in IDA Python [closed]

I have 5K .exe files from different sources like C and C++. I want to Dis-assamble them into .asm file using IDA Python. Consider this .exe file opened in IDA with text view: I want this "Assembly" ...
1
vote
1answer
2k views

Running script on the command line with IDA Pro 7.0

I'm trying to run a script with IDAPython on Windows: PS: C:\Users\user\Downloads> ida.exe -S"tmp.py" -t >> PS: C:\Users\user\Downloads> and I had to press Ctrl+C to get out of the >&...
1
vote
1answer
555 views

IDA Pro using Brew installed Python

Has anyone found a way to change the python installation used by IDA Pro? Using the system python on a Mac isn't terribly exciting.
0
votes
1answer
403 views

How to extract the automatic comment for these data items in IDA?

So I'm seeing this a lot in an IDA database: ; wchar_t off_BADF00D off_BADF00D dd offset loc_6F0062 dd offset loc_740074 dd offset loc_6D006E+1 ...
1
vote
1answer
248 views

What is an efficient way to scan for a given import function across modules in IDAPython?

I am writing a script which should first place a breakpoint on start, _start, _main, or main and then start the IDA Pro debugger. It then should enumerate the modules looking for "kernel32.dll" and ...
3
votes
1answer
3k views

IDA Script, Get Function Name That has random Characters involved in name

I was trying to figure out if there is a way I can get the address for a function name that has random characters in it. For example the function name is "Player_GetStats_m29275" here the "m292755" is ...
1
vote
2answers
985 views

How can I load C header file with IDAPython in IDA Pro?

How can I load C header file with IDAPython in IDA Pro? I'm trying automatically load C header file with IDAPython, such as Load("filename.h").
2
votes
2answers
998 views

IDAPython: How to check if an instruction is a conditional branch or jump?

I want to know using IDAPython if an instruction at the end of a basic block is a jump/branch instruction (like B or JNZ) and also determine if it's conditional or not. I need it in a CPU agnostic way,...
2
votes
1answer
1k views

How do you rename a memory address operand in IDAPython?

I need to rename some memory address "names" in IDAPython. I'm talking about the dword_805672 formatted ones. Please see the screenshot below: I've placed red boxes around the names which I would ...
1
vote
2answers
281 views

What is a more efficient way to locate disasm patterns in IDAPython?

This is my first "serious" IDAPython script. As I sorta suspected, it's performing waaaayyyyy too slow so I wanted to ask for some pointers on this: fp = MinEA() end = MaxEA() while fp < end: ...
6
votes
2answers
5k views

IDA python, write to specific memory location

I am looking for a way to modify memory location in IDA python script. We can read memory with these functions: Byte(address) Word(address) Dword(address) When I try to do something like this: Byte(...
2
votes
0answers
263 views

How do I read over an undefined function with IDAPython?

I have a pretty basic IDAPython script which finds indirect calls by using idc.FindText() and then extracts the arguments. It works great except that it does not find the indirect calls in undefined ...
3
votes
1answer
557 views

Resolve Addresses To Function Names

I have a malware sample that wraps LoadLibrary & GetProcAddress duo to dynamically resolve functions. After this wrapper is called the value stored in eax(which is the function name)immediately ...
2
votes
1answer
540 views

Give a name to an arbitrary hex value in IDA Pro

I'm using IDA Pro 7.0. I am analyzing a library that is part of a larger ARM executable, so there are often calls to external functions that aren't in this library. Therefore obviously the address of ...
2
votes
4answers
2k views

How to decompile with Hex Rays via a Python API?

If i have a large set of files and I'd like to run Hex-rays over them to produce output as C - can I do so in python? I see there is IDA Python And I see Hex-rays has a C++ SDK Is there a python Hex-...
2
votes
1answer
792 views

Identify the porcessor type of a binary

There are different ways to identify the processor type such as using IDA or file command in Linux. But sometimes the processor type is not detected by these tools. Besides I do not have the correct ...
1
vote
1answer
1k views

Processor Type in IDA Python

While using IDA Python and related code of idaapi, the processor type is not returned correctly. Specially we will have MetaPC instead of the exact processor type. This is my code that I used it: ...
1
vote
1answer
1k views

Extract conditional instructions using IDA python in ARM binaries

While using IDA Python for extract ARM instructions, I noticed that some instructions are not extracted completely. For example, conditional instructions such as BCS or BCC are printed as B. For ...
7
votes
2answers
2k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
2
votes
1answer
723 views

IDAPython: Change struct member content name

tl;dr I have an array of structs, I'd like to iterate over it and change fields content, (name, values), upon simple conditions. I can get the offset of the members, but I can't modify them due to the ...
1
vote
1answer
452 views

Accesssing xmm registers in IDAPython

I'm trying to write a Python script for IDA that hooks into debugging events, and prints some info about the xmm registers. I tried idc.GetRegValue("xmm0") But that returns a random long, which ...
2
votes
0answers
356 views

getting the flags of an IDA name

IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc). So far all is good and ...
2
votes
1answer
1k views

Batch mode of ida pro 6.5

i have tried almost all links about batch mode. My Question is that i did not get the user manual about batch mode of ida pro that how can i use the commands like -c -A -B and how i can run script on ...
3
votes
2answers
612 views

How to get elf header via IDAPython?

In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the ...
2
votes
1answer
3k views

How to get the disassembly line without offset translations in IDAPython?

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name. For example, when raw assembly is: mov %r15, 0x20b062(%rip)` GetDisasm()'s ...
3
votes
2answers
2k views

IDA - Some issues regarding function's/data/code recognition

I have to write an IDAPython script and I came across many false positives in IDA's function/code/data recognition. Case 1 - Invalid function's end (rpcrt4.dll): In some DLLs (especially in rpcrt4....
3
votes
2answers
2k views

How can I call IDA Pro's MakeCode for one instruction at a time?

I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately. I ...
3
votes
1answer
13k views

Using IDA Python Iterate Through All Functions and Their Instructions

I'm new to IDAPython. Basically I want to iterate through all functions in an IDB file and their instructions using ida python script. The final goal is to export the functions & their ...
1
vote
0answers
258 views

Is there a from…import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
1answer
1k views

IDA Pro Export C style array using Python instead of GUI menu

IDA Pro 6.95. From the menu I can use Edit... Export data... C unsigned char array (hex). I want to do this in a Python script without rewriting what already works. I have looked for a way to find a ...
1
vote
1answer
200 views

Is it possible to redirect IDAPython stack trace to console?

I am facing a weird problem! When my IDAPython script crashes, it produces a stack trace in the IDA default warning box that pops up right in front. The size of the box is neither adequate enough to ...
1
vote
1answer
311 views

How can I walk up along the AST using IDAPython decompiler API?

I am using IDAPython for my analysis. In IDA v6.95, the header file plugins/hexrays_sdk/include/hexrays.hpp defines the following: typedef ctree_items_t parents_t; parents_t parents; ///< ...
0
votes
1answer
214 views

How can I see the IDAPython implementation of HexRay's decompiler API?

I am trying to use HexRay's decompiler API, however having trouble due to its lack of documentation. Is there any means so That I can get to see the Python implementation of decompiler API?
0
votes
0answers
384 views

Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?

Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
5
votes
1answer
2k views

How is IDAPython API structured?

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
1
vote
1answer
180 views

Does IDAPython define any special environment variable?

I have an IDAPython script written for a specific analysis. Also, I am using another in-house tool for the same analysis that, too, exposes Python API. My intention is to augment the script such that ...
3
votes
1answer
3k views

Is there any IDAPython API that returns the function which an address belong to?

Given an address, e.g. 0x70011DC, is there any IDAPython API that returns the function, e.g. sub_0x7001024 which this address belong to?
3
votes
1answer
455 views

How to get the file format via Idapython?

I am working on a reverse engineering project on android apk. I would like to check if the file being analyzed is a binary file such as .so file or elf file. Is it possible to get it from idapro?
1
vote
1answer
490 views

IDAPython can't ignore library functions

I wrote a simple IDAPython script that only prints out local functions and ignores library functions. But somehow, it prints every single function. Here is the script: import idc, idautils for func ...