Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
1
vote
1answer
1k views

Extract conditional instructions using IDA python in ARM binaries

While using IDA Python for extract ARM instructions, I noticed that some instructions are not extracted completely. For example, conditional instructions such as BCS or BCC are printed as B. For ...
7
votes
2answers
3k views

idapython - Get Xrefs to a stack variable

I am trying to write an IDAPython script that will return a list of references to a local stack-frame variable. However, I couldn't find any API that does so. What I am trying to achieve is a code ...
2
votes
1answer
895 views

IDAPython: Change struct member content name

tl;dr I have an array of structs, I'd like to iterate over it and change fields content, (name, values), upon simple conditions. I can get the offset of the members, but I can't modify them due to the ...
1
vote
1answer
519 views

Accesssing xmm registers in IDAPython

I'm trying to write a Python script for IDA that hooks into debugging events, and prints some info about the xmm registers. I tried idc.GetRegValue("xmm0") But that returns a random long, which ...
2
votes
0answers
369 views

getting the flags of an IDA name

IDA has the following function idc.MakeNameEx which accepts multiple flags values that set properties about the given name (such as whether it's public, auto-generated, etc). So far all is good and ...
2
votes
1answer
1k views

Batch mode of ida pro 6.5

i have tried almost all links about batch mode. My Question is that i did not get the user manual about batch mode of ida pro that how can i use the commands like -c -A -B and how i can run script on ...
3
votes
2answers
739 views

How to get elf header via IDAPython?

In IDAPython, we can get segments with idautils.Segments().However, the result doesn't cover the whole input file, and the the first segment is ".init". My question is, how to get other things in the ...
2
votes
1answer
3k views

How to get the disassembly line without offset translations in IDAPython?

When I use GetDisasm()to get disassembly line, I find out that it will show some memory references as a variable name. For example, when raw assembly is: mov %r15, 0x20b062(%rip)` GetDisasm()'s ...
3
votes
2answers
2k views

IDA - Some issues regarding function's/data/code recognition

I have to write an IDAPython script and I came across many false positives in IDA's function/code/data recognition. Case 1 - Invalid function's end (rpcrt4.dll): In some DLLs (especially in rpcrt4....
3
votes
2answers
3k views

How can I call IDA Pro's MakeCode for one instruction at a time?

I have undefined a block of code and I want to manually reconstruct this block by iterating over the area while decoding undefined bytes and calling idc.MakeCode for each instruction separately. I ...
5
votes
1answer
15k views

Using IDA Python Iterate Through All Functions and Their Instructions

I'm new to IDAPython. Basically I want to iterate through all functions in an IDB file and their instructions using ida python script. The final goal is to export the functions & their ...
1
vote
0answers
285 views

Is there a from…import * equivalent of idaapi.require()?

Loading your own modules from your IDAPython scripts with idaapi.require() suggests using idaapi.require() to load user modules in IDAPython scripts. However in my script, I have extensively used from ...
1
vote
1answer
2k views

IDA Pro Export C style array using Python instead of GUI menu

IDA Pro 6.95. From the menu I can use Edit... Export data... C unsigned char array (hex). I want to do this in a Python script without rewriting what already works. I have looked for a way to find a ...
1
vote
1answer
259 views

Is it possible to redirect IDAPython stack trace to console?

I am facing a weird problem! When my IDAPython script crashes, it produces a stack trace in the IDA default warning box that pops up right in front. The size of the box is neither adequate enough to ...
1
vote
1answer
369 views

How can I walk up along the AST using IDAPython decompiler API?

I am using IDAPython for my analysis. In IDA v6.95, the header file plugins/hexrays_sdk/include/hexrays.hpp defines the following: typedef ctree_items_t parents_t; parents_t parents; ///< ...
0
votes
1answer
223 views

How can I see the IDAPython implementation of HexRay's decompiler API?

I am trying to use HexRay's decompiler API, however having trouble due to its lack of documentation. Is there any means so That I can get to see the Python implementation of decompiler API?
0
votes
0answers
443 views

Why is IDAPython decompiler API returning the same effective address for both the current item and its parent?

Following this blog post, I am writing an IDAPython code to traverse the AST generated by the decompiler in order to extract some information. I am providing both my AST, the Python code and the ...
5
votes
1answer
3k views

How is IDAPython API structured?

In IDA's documentation, there are references to modules named ida_*, as well as idc, idaapi and idautils. The former modules seem to be the lower level ones. Almost always it says that IDA Plugin SDK ...
1
vote
1answer
194 views

Does IDAPython define any special environment variable?

I have an IDAPython script written for a specific analysis. Also, I am using another in-house tool for the same analysis that, too, exposes Python API. My intention is to augment the script such that ...
3
votes
1answer
3k views

Is there any IDAPython API that returns the function which an address belong to?

Given an address, e.g. 0x70011DC, is there any IDAPython API that returns the function, e.g. sub_0x7001024 which this address belong to?
3
votes
1answer
567 views

How to get the file format via Idapython?

I am working on a reverse engineering project on android apk. I would like to check if the file being analyzed is a binary file such as .so file or elf file. Is it possible to get it from idapro?
1
vote
1answer
542 views

IDAPython can't ignore library functions

I wrote a simple IDAPython script that only prints out local functions and ignores library functions. But somehow, it prints every single function. Here is the script: import idc, idautils for func ...
3
votes
1answer
2k views

How can I extract the structure of an operand with displacement in IDAPython?

Consider the following instruction: 8D 8C 4E B0 2F FF FF LEA ECX, [ESI+ECX*2-0xD050] Using IDAPython, how can I extract the structure of the second operand? I'd like to know things like: ESI is ...
2
votes
1answer
763 views

How to get address where MakeFunction() failed in IDA Pro

I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function ...
4
votes
3answers
4k views

Is it possible to get a list of user-defined names in IDA?

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
0
votes
1answer
222 views

idaypthon - how to refresh Choose2 listcontrol once it has been displayed?

I have created a plugin/idascript (ida-batch_decompile) that aims to make it easier to decompile a target including images referenced as imports or any other decompilable files in the targets project ...
2
votes
1answer
400 views

Using IDA to automatically annote dynamically imported functions in a driver

I've got an x64 Windows driver where a lot of functions are dynamically imported using MmGetSystemRoutineAddress. The function takes a UNICODE_STRING as a parameter to tell it what function to find ...
3
votes
2answers
966 views

IDA python, get address range of specific dll

I have the following IDA Python script. It is intended to break on first instruction of imported function when call comes from the module of interest: list = [] def set_cb(ea, name, ord): global ...
4
votes
1answer
4k views

IDA python, list all imported functions

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions: import idc import idaapi import idautils def set_breakpoints(): ea = idc.ScreenEA() ...
1
vote
1answer
518 views

How can I force-update IDA's action_handler_t object's state?

context about action_handler_t IDA provides multiple features and APIs to extend and enhance it's usability, one of those features is the creation of user defined action_handler_t objects by ...
3
votes
2answers
3k views

Get a list of global variables with IDA python

I am trying to use IDA python to get a list of all variables in .data section because I want to extract a list of cross references to each global variables from IDA. Is it possible to do this with IDA ...
5
votes
2answers
3k views

idapython - Determine if item is code or data

I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see ...
6
votes
1answer
8k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
2answers
2k views

How to Find All Switch Jump Tables in IDAPython

I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly: jmp ds:off_65018790[ecx*4] ; switch jump ...
8
votes
2answers
980 views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
4
votes
1answer
7k views

Executing an IDAPython script with arguments within IDA Pro

I have an IDAPython script x.py which takes some arguments, which prevents me from simply using alt + F7 and selecting my script. How can I execute this script within IDA Pro and specify the ...
0
votes
1answer
267 views

IDA command bar default language

The command bar at the bottom of the output window in IDA defaults to python. I would greatly prefer it to default to IDC, is there a way to change this default? I found one reference to RunPlugin("...
1
vote
1answer
334 views

QtNetwork in IDA's PyQt5

I'm interested in writing a network component to my IDAPython plugin, and QtNetwork looks really attractive, however it isn't include-able from IDAPython shell. Is there a simple way to add that ...
0
votes
1answer
1k views

How to list parameter of function from IDA Pro? [duplicate]

I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
1
vote
1answer
150 views

Adding user(/plugin/thirdparty) data to IDB files

I think I've seen it somewhere a few years back, but couldn't find a mention anywhere. I'm developing an IDAPython plugin and I'd like to embed IDB-specific information inside IDBs. Obviously, I ...
0
votes
1answer
497 views

Can I extract API call graph from IDA Pro to xml file?

I want to extract API call graph from IDA Pro to xml file for analysis. Can I extract API call graph from IDA Pro to xml file?
0
votes
2answers
855 views

IDA 6.8 SDK change calling convention

Is there any way to change the calling convention programmatically? I found some C++ code in this repo but wasn't able to successfully update it to 6.8. static bool idaapi convert_to_usercall(void *...
3
votes
2answers
5k views

How to get the list of strings within IDA's string window in my script?

I'm trying to write some scripts that do some string searching through the disassembly in IDA. Currently, I loop through all the disassembly, MinEA() to MaxEA() and use idc.FindText() to see if a ...
1
vote
2answers
3k views

Finding function name of caller function

Function "Bob" calls function "Janice". Currently, I'm at an address in function "Janice" and can easily do idc.GetFunctionName(ea) to get the name Janice. However, I also want to get the caller ...
4
votes
2answers
1k views

Automating pattern-based de-obfuscation of x64 code using IDA plugins

Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues. Burning Purpose To massively automate the deobfuscation within ...
1
vote
1answer
856 views

Check for multiple strings in IDAPython

I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,"Bob") to ...
1
vote
1answer
599 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
1
vote
2answers
312 views

how to get hanging instructions of a dll using IDApython

I need to get hanging instructions i.e instructions which are not under any functions in a dll through idapython script? it is available in brown color when seen through IDA pro.
2
votes
1answer
1k views

Segments start address is different in IDApython when invoked thrg cmd prompt

I am able to get Segments start address, end address and all functions of a DLL through follwoing ida python script: # Get the segment's starting address ea = ScreenEA() print(ea) print(...
8
votes
2answers
3k views

How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type

I'm writing an IDA plugin using idapython in order to add comments (located in database) to variables of struct types. In order to do this, firstly, i need to get the list of cross-references to a ...