Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
1
vote
0answers
290 views

Show IDAPython prompt

Subj hides itself on a mere Escape pressed in the input field. How to bring it back? I didn't find a way short of restarting IDA. It's IDA 6.1 x32 & IDAPython v1.5.2.
3
votes
1answer
959 views

Colorize and disassemble byte sequences with IDA Pro and IDAPython

Maybe someone could help me with the following problem: I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example,...
4
votes
2answers
2k views

Automating a Decryption function call in IDA Python

I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times. The function takes three arguments and is a simple xor decryption. However it ...
1
vote
0answers
118 views

Deducing register contents through IDA scripting

In some of my IDA scripts, it would be useful to be able to reason about which variables were stored in which registers at a given place in the program. One example is the following: mov rdx, [...
7
votes
1answer
638 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
2
votes
1answer
452 views

building custom buttons or panels to add to IDA

I've been looking for a way to add custom panels or buttons to the IDA interface, primarily to track custom scripts rather then remembering a ton of short cuts or having to click through menus to get ...
1
vote
0answers
409 views

Using MyNav Python Scripts With IDA Pro 6.1 On Windows 7

I just came across the MyNav Python scripts and would like to use some of their functionality on my IDA Pro database. I have IdaPython installed properly, but I cannot seem to get the plugins to show ...
0
votes
2answers
2k views

Adding automatically standard structs or enums

Is there any kind of python/idc function that allows you to simulate this? Structures > Insert > Add standard structure Thanks, Sherab
4
votes
1answer
1k views

IDAPython Strings constantly returns NoneType with str()

I'm trying to automate disassembly of a firmware image using IDA Pro 6.5 and IDA Python. One of the process I want to implement is to locate strings and create a data segment around them. Using the ...
0
votes
1answer
413 views

IDA Pro: function to return first valid address

The IDA Pro Python function ScreenEA() will return the address the cursor is at and if I manually position the cursor at the start, it will return the first valid address. However, I would like to be ...
4
votes
3answers
1k views

Automatically decode PUSH+RET call into JMP

While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here. So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
0
votes
0answers
2k views

Modify memory without patching the database

Is there a way to modify one or more bytes in memory without making any changes in the database? I know about idc.PatchByte() in idapython, but it will print the message that states that 'This ...
0
votes
1answer
702 views

IDA pro CTRL and + keypad whenever debugging

How can I remove the CTRL and + keypad whenever I am debugging PE file in IDA? All of the disassembled codes are wrapped up whenever I debug a PE file and I see the message CTRL and + keypad to ...
3
votes
2answers
1k views

Change block/node color with idapython

How can I change color of node (or block?) with idapython? I know about SetColor, but this function does not work with blocks/nodes. EDIT: Solved, see the code snippet below. def get_bb_id(graph, ea)...
2
votes
2answers
2k views

Automatic generation of call graph in IDA Pro

I want to generate call graph from Ida pro but I want to do it automatically. I wrote these two scripts but they did not work. Could you help me what is the problem? 1: #include ida.idc; #include ...
2
votes
1answer
4k views

Finding all API calls in a function

is there a way to get a listing of all called APIs in a function via IDAPython. For example I have the below code from a function. .text:003A33D9 call esi ; _snwprintf .text:...
1
vote
2answers
855 views

Can I expand the view of a structure in IDAPython?

When I define data as a structure with IDAPython, it appears in IDA View in a collapsed view. Out of curiosity, is it possible to programmatically expand the view of the structure? For example, if I ...
4
votes
1answer
879 views

IDA Pro: Platform-independent way to check if an instruction is a jump

I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures. I thought one may ...
4
votes
0answers
698 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
1
vote
0answers
163 views

How can I parse VMTs in IDA if I have the base address?

I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API ...
2
votes
1answer
491 views

IDA Plugin/Script Output File Character Limit?

I am currently working on both a plugin and an ida-python script that export fairly big JSON files. I just noticed, that both will at times cut off the output files with no error message. Sometimes ...
5
votes
2answers
4k views

Ida Pro: parsig complex operand expression using Idapython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
3
votes
0answers
1k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
3
votes
1answer
5k views

Setting name of (newly created) functions via IDAPython

Is there a way to specify the name of a function when creating it with idc.MakeFunction()? If not, what is the best practice to rename a function? I found idc.GetFunctionName(ea) but no counterpart ...
3
votes
2answers
2k views

IDA Pro: Side effects or disadvantages of “Create function”

Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot. Yet, one can right-click such 'function-...
1
vote
0answers
1k views

How to get opcodes for assembly using ppc processor (IDAPython)

In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the Assemble(ea, line) function. Here is an example using a PE-file / x86 processor type: Python>Assemble(...
4
votes
0answers
541 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
10
votes
1answer
3k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
4
votes
1answer
2k views

ELF: How to make IDA show me the correct PLT (Procedure Linkage Table) content?

I would like to make IDA disassemble the .plt section of ELF files correctly, e.g. as objdump does: objdump -D -M intel asdf | grep "Disassembly of section .plt" -A80 I don't know why but IDA gives ...
4
votes
1answer
587 views

Get memory locations using IDAPython

In my code, I am using idc.GetOpnd(ea,0) and idc.GetOpnd(ea,1) to get the 2 operands of an instruction. However, if its a call (or jmp) instruction, I am getting symbols like _perror and loc_8083BA9. ...
6
votes
1answer
9k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
1
vote
1answer
1k views

Calling functions from IDAPython

I wrote a script containing several functions, which I loaded in IDA pro. From IDAPython now I'd want to call a specific function. Is it possible? Which idaapi functions should I use to call my ...
3
votes
1answer
1k views

How to call idc function with idapython

I want to script a x86Emu plugin (an IDA emulator) with IdaPython. It's registered idc functions. Below is function names from the plugin source code. /* add IDC functions for interacting with the ...
2
votes
1answer
2k views

Set breakpoints on all references in IDA

Is there a way to set breakpoints on all references in one click like we do in OllyDBG "Set breakpoint on every reference" ? E.g: after locating CreateFileA API and pressing "x" to see all references,...
1
vote
1answer
167 views

Is there anyway I can iterate all the C-level statements in IDA-Pro?

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. Suppose I only consider these statements: State :: = | if-else cond; |...
1
vote
1answer
2k views

How to get the recovered memory references in IDA-Pro? [duplicate]

I want to collect all the IDA recovered symbol information in data sections (this information could be function name, or it could be an entry of jump table, or it could be a reference to other data ...
3
votes
1answer
926 views

IDA basic block type fcb_cndret - what does it mean?

IDA Pro's idaapi.BasicBlock objects returned by idaapi.FlowChart() can be of the following types (see gdl.hpp in the SDK sources): // flow chart block types enum fc_block_type_t { fcb_normal, // ...
2
votes
3answers
1k views

Declaring block as a string in IDA

I'm reverse engineering a binary that has very generic, standard xor+math encryption on every string. I've written IDAPython to find each one(they're used in a generic way) and decrypt them, then add ...
2
votes
1answer
473 views

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
4
votes
1answer
2k views

Can I invoke IDA's plugin BinDiff from command line?

I am trying to evaluate a very large amount of binaries (thousands) using BinDiff, and currently I only need some instruction level statistics from BinDiff, which can be acquired from its dumped ...
6
votes
2answers
4k views

How to get imge base of current setting through script in IDA pro?

As a beginner I'm trying to disassemble a file with IDA Pro 6.5. I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program. Now, I want to get the image base of ...
2
votes
1answer
420 views

How to detect address changes in the IDA SDK?

I'm developing a custom memory viewer in Python for IDA. Obviously I need to know current EA. For now, I just ask user to supply it through AskAddr() and it works fine. However, I'd like my plugin to ...
3
votes
1answer
2k views

IDAPro, the arguments could not be passed to the python script

Using IDA 6.6, I cannot pass command line arguments to the IDAPython script. The command I use is: idaq64 -c -A -S"myscrip.py arg1" thebinpath. Here is the demo script myscript.py: import sys if ...
3
votes
1answer
386 views

Function calls: xref.type always 'Code_Far_Call' or 'Code_Near_Call'?

Given a disassembly line in IDA Pro such as .text:0040255B call sub_407C10 Am I right to assume that analyzing the belonging address using idautils.XrefsFrom(0x0040255B) always returns an ...
1
vote
0answers
172 views

Changing the argument number in a macro in IDA Pro

Can I change argument number to macro in IDA pro Hex-rays? fd = open("a", 513, 0644); Like this. fd = open("a", O_WRONLY|O_CREAT, 0644); Is this possible?
0
votes
1answer
3k views

IDAPython load PDB-file of analysed binary

in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File). I know how to load a PDB-File via GUi but I need this scripted. Has ...
6
votes
1answer
506 views

A wiki for IDA? [closed]

Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the ...
3
votes
1answer
2k views

IDAPython script does not reload

I'm debugging an IDAPython script on my host machine and I have IDA running on my Windows VM. The folder containing the IDAPython script on the host machine is shared with the VM. The first time I ...
1
vote
2answers
2k views

Using an existing IDB from IDA command line interface

Is there any way to use an existing IDB from the IDA command line interface ? I went through the list of command line switches here but there isn't any related switches. As I am currently scripting ...
2
votes
2answers
431 views

Disassemble instruction with a variable as an offset

I am looking to disassemble an instruction at an address. I know that there are many instructions that can accomplish this such as idc.GetDisasm(), idc.GetDisasmEx(), idaapi.generate_disassembly(), ...