Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
3
votes
1answer
1k views

How can I extract the structure of an operand with displacement in IDAPython?

Consider the following instruction: 8D 8C 4E B0 2F FF FF LEA ECX, [ESI+ECX*2-0xD050] Using IDAPython, how can I extract the structure of the second operand? I'd like to know things like: ESI is ...
2
votes
1answer
654 views

How to get address where MakeFunction() failed in IDA Pro

I am analysing obfuscated code which contains code paths leading to dummy instructions. These dummy instructions prevent IDA from creating functions. However, I need these functions to do a function ...
3
votes
2answers
3k views

Is it possible to get a list of user-defined names in IDA?

IDA allows one to rename a program entity (e.g. register, variable, function) using N shortcut. Is it possible to get a list of such user-defined names in IDA?
0
votes
1answer
191 views

idaypthon - how to refresh Choose2 listcontrol once it has been displayed?

I have created a plugin/idascript (ida-batch_decompile) that aims to make it easier to decompile a target including images referenced as imports or any other decompilable files in the targets project ...
1
vote
1answer
357 views

Using IDA to automatically annote dynamically imported functions in a driver

I've got an x64 Windows driver where a lot of functions are dynamically imported using MmGetSystemRoutineAddress. The function takes a UNICODE_STRING as a parameter to tell it what function to find ...
3
votes
2answers
826 views

IDA python, get address range of specific dll

I have the following IDA Python script. It is intended to break on first instruction of imported function when call comes from the module of interest: list = [] def set_cb(ea, name, ord): global ...
4
votes
1answer
4k views

IDA python, list all imported functions

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions: import idc import idaapi import idautils def set_breakpoints(): ea = idc.ScreenEA() ...
1
vote
1answer
454 views

How can I force-update IDA's action_handler_t object's state?

context about action_handler_t IDA provides multiple features and APIs to extend and enhance it's usability, one of those features is the creation of user defined action_handler_t objects by ...
3
votes
2answers
3k views

Get a list of global variables with IDA python

I am trying to use IDA python to get a list of all variables in .data section because I want to extract a list of cross references to each global variables from IDA. Is it possible to do this with IDA ...
5
votes
2answers
2k views

idapython - Determine if item is code or data

I need to determine whether an IDA's item is code or data. Sometimes, data resides in an executable's code section (virtual functions tables, switch tables and stuff). So in IDA, you can sometimes see ...
6
votes
1answer
7k views

How can I set breakpoint and get value of a register with IDApython

How can I set a breakpoint and get the value of the EAX register with IDApython? I want to set a breakpoint, for example at address 00b27223, and at each break before execution of that specific ...
1
vote
2answers
2k views

How to Find All Switch Jump Tables in IDAPython

I'm using IDAPython on IDA 6.5 and I'm trying to get all the switch jump tables in a DLL. Mainly I'm interested in jump tables that are jumped indirectly: jmp ds:off_65018790[ecx*4] ; switch jump ...
8
votes
2answers
852 views

Open-source equivalent for FLIRT

I am using a C disassembler and I need to identify compiler-intrinsic functions (i.e. SEH_prolog, SEH_epilog etc.) within my C program. Right now, the only way I can do that is to use IDA's FLIRT (...
4
votes
1answer
7k views

Executing an IDAPython script with arguments within IDA Pro

I have an IDAPython script x.py which takes some arguments, which prevents me from simply using alt + F7 and selecting my script. How can I execute this script within IDA Pro and specify the ...
0
votes
1answer
250 views

IDA command bar default language

The command bar at the bottom of the output window in IDA defaults to python. I would greatly prefer it to default to IDC, is there a way to change this default? I found one reference to RunPlugin("...
1
vote
1answer
312 views

QtNetwork in IDA's PyQt5

I'm interested in writing a network component to my IDAPython plugin, and QtNetwork looks really attractive, however it isn't include-able from IDAPython shell. Is there a simple way to add that ...
0
votes
1answer
803 views

How to list parameter of function from IDA Pro? [duplicate]

I want to list parameter of function for analysis. Can I list the parameter of function using IDA Pro or IDAPython ?
1
vote
1answer
139 views

Adding user(/plugin/thirdparty) data to IDB files

I think I've seen it somewhere a few years back, but couldn't find a mention anywhere. I'm developing an IDAPython plugin and I'd like to embed IDB-specific information inside IDBs. Obviously, I ...
0
votes
1answer
438 views

Can I extract API call graph from IDA Pro to xml file?

I want to extract API call graph from IDA Pro to xml file for analysis. Can I extract API call graph from IDA Pro to xml file?
0
votes
2answers
731 views

IDA 6.8 SDK change calling convention

Is there any way to change the calling convention programmatically? I found some C++ code in this repo but wasn't able to successfully update it to 6.8. static bool idaapi convert_to_usercall(void *...
2
votes
2answers
4k views

How to get the list of strings within IDA's string window in my script?

I'm trying to write some scripts that do some string searching through the disassembly in IDA. Currently, I loop through all the disassembly, MinEA() to MaxEA() and use idc.FindText() to see if a ...
1
vote
2answers
3k views

Finding function name of caller function

Function "Bob" calls function "Janice". Currently, I'm at an address in function "Janice" and can easily do idc.GetFunctionName(ea) to get the name Janice. However, I also want to get the caller ...
4
votes
2answers
982 views

Automating pattern-based de-obfuscation of x64 code using IDA plugins

Trying to deobfuscate x64 code. You can skim/skip most of this, since it mainly exists to prove I have tried and exhausted all avenues. Burning Purpose To massively automate the deobfuscation within ...
1
vote
1answer
672 views

Check for multiple strings in IDAPython

I'm trying to see if the disassembly has two strings possibly within it. My string search algorithm starts from the first instruction MinEA() to the last MaxEA() and uses idc.FindText(.....,"Bob") to ...
1
vote
1answer
582 views

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

I am looking at the disassembly for iOS applications and need to figure out a way to analyze the cryptography used. I have tried using different plugins for IDA such as FindCrypt, IDAsignsrch, and ...
1
vote
2answers
261 views

how to get hanging instructions of a dll using IDApython

I need to get hanging instructions i.e instructions which are not under any functions in a dll through idapython script? it is available in brown color when seen through IDA pro.
2
votes
1answer
889 views

Segments start address is different in IDApython when invoked thrg cmd prompt

I am able to get Segments start address, end address and all functions of a DLL through follwoing ida python script: # Get the segment's starting address ea = ScreenEA() print(ea) print(...
8
votes
2answers
3k views

How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type

I'm writing an IDA plugin using idapython in order to add comments (located in database) to variables of struct types. In order to do this, firstly, i need to get the list of cross-references to a ...
2
votes
2answers
797 views

Compare call graphs of two dll's Using IDAPython comand line

I need to generate call graph for two DLL's and compare it using IDApython and it must be executed automatically in command line. How to generate and save call graph and immediately open next DLL and ...
2
votes
1answer
1k views

Hex-Rays and IDA Python plugin loading order

I have made a plugin (using IDA Python) that requires the Hex-Rays plugin. As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
2
votes
1answer
642 views

IDA Python - Find highlighted register

In IDA's Graph View, when we select some register (for example, esp in the image below), every location that the register occurs is highlighted. Is it possible to read what the selected operand is? (...
0
votes
1answer
304 views

Obtaining the argument text from a carg_t IDA Python object

I have a decompiled result from calling idaapi.decompile(). From the decompiled result, I obtain the treeitems and loop through them looking for items that are of type cexpr_t and have the opname of ...
1
vote
2answers
1k views

Identify RVA data in IDA Pro

I want to read the data value at a given address in IDA Pro. I found it can be achieved by DWord(address) function. However in case the value is RVA of a function (as below), Dword() gives RVA 7E094D (...
4
votes
3answers
2k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
1
vote
1answer
3k views

idapython: getting a list of all segments

If I open the Segments subview in IDA, I can get a list of all of the segments. I would like to access this list so I can enumerate through all of the segments. How can I do this with idapython?
1
vote
0answers
838 views

IDA: Extracting functions arguments from stripped binary

This thread describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0). Is it possible to extract such ...
4
votes
2answers
2k views

Identify Jump Statements due to Switch/Case in IDA Pro

I want to identify the jump statements due to switch/case in an IDA Pro disassembled binary. My ultimate goal is to read the jump table entries. I am also interested in function table/vtables. For ...
3
votes
3answers
1k views

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

I would like to determine if an instruction a) reads from or b) writes to a memory address. I can currently think of two approaches in IDA: Looking for a list of mnemonics (better: particular opcodes?...
2
votes
0answers
690 views

IDA Pro get line number in main view

I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
1
vote
0answers
507 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
1
vote
0answers
216 views

IDAPython loading parameters bruteforce

I have a binary file for known hardware platform, but nothing more is known. When I load this file in IDA (with default parameters), nothing good happens - at least does not appear xrefs to readable ...
2
votes
1answer
5k views

Idapython: How to get the opcode bytes corresponding to an instruction?

How do I get the 8B 45 FC corresponding to the mov eax, [rbp+var_4] etc. via idapython? I did not come up with a better solution than Getting the instruction via idautils.DecodeInstruction() ...
0
votes
1answer
279 views

How to create empty IDB file with IDApython?

Is it possible to create empty idb file using idapython? My intention is to use it afterwards to populate with several binary code blobs and run some analysis on the resulting idb file and all this ...
6
votes
1answer
5k views

How to automatically rename some IDA functions from a given list?

I have a text file which contains a list of function name and address pairs, structured like this : 194C:841B LoadMessage 194C:8429 ShowDialog ... Is there a way (eg: script, automation, ...) to ...
3
votes
1answer
912 views

IDA Pro Dump of instructions and offsets

I'm writing a plugin for IDA PRO with IDAPython and I need to make a dump of the full disassembled code with offsets. I know I can export a html file and then parse it but I cannot call the ...
1
vote
2answers
4k views

How can I step through instructions in IDA and know the current EIP?

import idaapi x=0 while x<10: idaapi.step_into() rv = idaapi.regval_t() idaapi.get_reg_val('EIP',rv) ea = rv.ival print hex(ea) x+=1 Hi. Here is a script to step-into 10 ...
0
votes
2answers
938 views

How can I check if an address contains a pointer?

I'm iterating through a list of heads returned by the Heads() function, and for each head I want to check if the address contains a pointer (specifically a pointer to code). I've tried using the ...
7
votes
1answer
3k views

Is there a way to set the cursor address in IDA Pro?

In the same way that ScreenEA() returns the current cursor address, is there a way to set the address? Something that would resemble SetScreenEA()?
4
votes
3answers
2k views

How to get the CPU architecture via Idapython?

I was not able to find an API function to get the CPU architecture of the loaded binary. In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type. ...
8
votes
2answers
6k views

Good training for IDAPython

I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...