Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
2
votes
2answers
863 views

Compare call graphs of two dll's Using IDAPython comand line

I need to generate call graph for two DLL's and compare it using IDApython and it must be executed automatically in command line. How to generate and save call graph and immediately open next DLL and ...
2
votes
1answer
2k views

Hex-Rays and IDA Python plugin loading order

I have made a plugin (using IDA Python) that requires the Hex-Rays plugin. As per the instructions in the hexrays_sdk folder, I've named my plugin starting with hexrays_ to make sure it loads after ...
2
votes
1answer
728 views

IDA Python - Find highlighted register

In IDA's Graph View, when we select some register (for example, esp in the image below), every location that the register occurs is highlighted. Is it possible to read what the selected operand is? (...
0
votes
1answer
417 views

Obtaining the argument text from a carg_t IDA Python object

I have a decompiled result from calling idaapi.decompile(). From the decompiled result, I obtain the treeitems and loop through them looking for items that are of type cexpr_t and have the opname of ...
1
vote
2answers
1k views

Identify RVA data in IDA Pro

I want to read the data value at a given address in IDA Pro. I found it can be achieved by DWord(address) function. However in case the value is RVA of a function (as below), Dword() gives RVA 7E094D (...
4
votes
3answers
3k views

IDApython and IDA-decompiler commenting

Looking at the functions exposed by idaapi I see that functions like the following are exposed. get_user_cmt set_user_cmt save_user_cmts As these functions are exposed I'm hoping that I have a way ...
1
vote
1answer
3k views

idapython: getting a list of all segments

If I open the Segments subview in IDA, I can get a list of all of the segments. I would like to access this list so I can enumerate through all of the segments. How can I do this with idapython?
1
vote
0answers
923 views

IDA: Extracting functions arguments from stripped binary

This thread describes method for extracting function arguments from ida. However this method is not working for stripped binaries (funcdata.size() is always 0). Is it possible to extract such ...
4
votes
2answers
2k views

Identify Jump Statements due to Switch/Case in IDA Pro

I want to identify the jump statements due to switch/case in an IDA Pro disassembled binary. My ultimate goal is to read the jump table entries. I am also interested in function table/vtables. For ...
3
votes
3answers
1k views

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

I would like to determine if an instruction a) reads from or b) writes to a memory address. I can currently think of two approaches in IDA: Looking for a list of mnemonics (better: particular opcodes?...
2
votes
0answers
785 views

IDA Pro get line number in main view

I'm writing a plugin for IDA and I need to get the line number of an instruction in the main view when someone clicks on that instruction or somewhere in the view. I noticed that there is ...
1
vote
0answers
535 views

Determine ARM architecture from IDA plugin

Writing sandbox plugin for IDA (with IDAPython, but that not the case as it seems) to analyze ARM opcodes, I've came upon following issues: 1) How can I distinct specific ARM architecture (e.g. ARMv5,...
1
vote
0answers
229 views

IDAPython loading parameters bruteforce

I have a binary file for known hardware platform, but nothing more is known. When I load this file in IDA (with default parameters), nothing good happens - at least does not appear xrefs to readable ...
2
votes
1answer
5k views

Idapython: How to get the opcode bytes corresponding to an instruction?

How do I get the 8B 45 FC corresponding to the mov eax, [rbp+var_4] etc. via idapython? I did not come up with a better solution than Getting the instruction via idautils.DecodeInstruction() ...
1
vote
1answer
307 views

How to create empty IDB file with IDApython?

Is it possible to create empty idb file using idapython? My intention is to use it afterwards to populate with several binary code blobs and run some analysis on the resulting idb file and all this ...
6
votes
1answer
6k views

How to automatically rename some IDA functions from a given list?

I have a text file which contains a list of function name and address pairs, structured like this : 194C:841B LoadMessage 194C:8429 ShowDialog ... Is there a way (eg: script, automation, ...) to ...
3
votes
1answer
992 views

IDA Pro Dump of instructions and offsets

I'm writing a plugin for IDA PRO with IDAPython and I need to make a dump of the full disassembled code with offsets. I know I can export a html file and then parse it but I cannot call the ...
1
vote
2answers
4k views

How can I step through instructions in IDA and know the current EIP?

import idaapi x=0 while x<10: idaapi.step_into() rv = idaapi.regval_t() idaapi.get_reg_val('EIP',rv) ea = rv.ival print hex(ea) x+=1 Hi. Here is a script to step-into 10 ...
0
votes
2answers
1k views

How can I check if an address contains a pointer?

I'm iterating through a list of heads returned by the Heads() function, and for each head I want to check if the address contains a pointer (specifically a pointer to code). I've tried using the ...
8
votes
1answer
3k views

Is there a way to set the cursor address in IDA Pro?

In the same way that ScreenEA() returns the current cursor address, is there a way to set the address? Something that would resemble SetScreenEA()?
6
votes
3answers
3k views

How to get the CPU architecture via Idapython?

I was not able to find an API function to get the CPU architecture of the loaded binary. In idaapi.py, there is a function def set_processor_type(*args) but no equivalent such as get_processor_type. ...
8
votes
2answers
6k views

Good training for IDAPython

I'm familiar with python and IDA in general. I found a few very basic tutorials but nothing that goes through an explanation of the classes used and the full capability set. Near as I can tell the ...
1
vote
0answers
290 views

Show IDAPython prompt

Subj hides itself on a mere Escape pressed in the input field. How to bring it back? I didn't find a way short of restarting IDA. It's IDA 6.1 x32 & IDAPython v1.5.2.
3
votes
1answer
1k views

Colorize and disassemble byte sequences with IDA Pro and IDAPython

Maybe someone could help me with the following problem: I have an interesting byte sequence that I found within a MIPS ELF binary that exists on the hard drive. This byte sequence may be, for example,...
4
votes
2answers
3k views

Automating a Decryption function call in IDA Python

I'm trying to figure out a way to automatically decrypt certain strings in a binary called by a function several times. The function takes three arguments and is a simple xor decryption. However it ...
1
vote
0answers
142 views

Deducing register contents through IDA scripting

In some of my IDA scripts, it would be useful to be able to reason about which variables were stored in which registers at a given place in the program. One example is the following: mov rdx, [...
7
votes
1answer
702 views

Adding a toolbar to IDA using PySide

So i'm trying to add a custom toolbar to IDA 6.4 using their PySide download and the IDAAPI. I've tried adding a toolbar by just creating one but since it doesn't have an exec_() method I can't get ...
2
votes
1answer
503 views

building custom buttons or panels to add to IDA

I've been looking for a way to add custom panels or buttons to the IDA interface, primarily to track custom scripts rather then remembering a ton of short cuts or having to click through menus to get ...
1
vote
0answers
438 views

Using MyNav Python Scripts With IDA Pro 6.1 On Windows 7

I just came across the MyNav Python scripts and would like to use some of their functionality on my IDA Pro database. I have IdaPython installed properly, but I cannot seem to get the plugins to show ...
0
votes
2answers
2k views

Adding automatically standard structs or enums

Is there any kind of python/idc function that allows you to simulate this? Structures > Insert > Add standard structure Thanks, Sherab
4
votes
1answer
2k views

IDAPython Strings constantly returns NoneType with str()

I'm trying to automate disassembly of a firmware image using IDA Pro 6.5 and IDA Python. One of the process I want to implement is to locate strings and create a data segment around them. Using the ...
0
votes
1answer
459 views

IDA Pro: function to return first valid address

The IDA Pro Python function ScreenEA() will return the address the cursor is at and if I manually position the cursor at the start, it will return the first valid address. However, I would like to be ...
4
votes
3answers
1k views

Automatically decode PUSH+RET call into JMP

While reversing a piece of malware I've faced with anti-disasm trick, that actually is well described here. So my question is: would the assembly patching of whole the PUSH+RET stubs to JMP(i.e. C3-> ...
0
votes
0answers
2k views

Modify memory without patching the database

Is there a way to modify one or more bytes in memory without making any changes in the database? I know about idc.PatchByte() in idapython, but it will print the message that states that 'This ...
0
votes
1answer
864 views

IDA pro CTRL and + keypad whenever debugging

How can I remove the CTRL and + keypad whenever I am debugging PE file in IDA? All of the disassembled codes are wrapped up whenever I debug a PE file and I see the message CTRL and + keypad to ...
4
votes
2answers
2k views

Change block/node color with idapython

How can I change color of node (or block?) with idapython? I know about SetColor, but this function does not work with blocks/nodes. EDIT: Solved, see the code snippet below. def get_bb_id(graph, ea)...
2
votes
2answers
2k views

Automatic generation of call graph in IDA Pro

I want to generate call graph from Ida pro but I want to do it automatically. I wrote these two scripts but they did not work. Could you help me what is the problem? 1: #include ida.idc; #include ...
2
votes
1answer
4k views

Finding all API calls in a function

is there a way to get a listing of all called APIs in a function via IDAPython. For example I have the below code from a function. .text:003A33D9 call esi ; _snwprintf .text:...
1
vote
2answers
976 views

Can I expand the view of a structure in IDAPython?

When I define data as a structure with IDAPython, it appears in IDA View in a collapsed view. Out of curiosity, is it possible to programmatically expand the view of the structure? For example, if I ...
4
votes
1answer
975 views

IDA Pro: Platform-independent way to check if an instruction is a jump

I am looking for a way to tell if an instruction is a jump instruction. Of course, I would like to avoid checking all possible jump mnemonics for all possible CPU architectures. I thought one may ...
5
votes
0answers
724 views

Python library for linux to demangle MSVC decorated names

I am looking for a python library for linux which can demangle the function names which are mangled by MSVC. for example : Project!??0?$allocator@D@std@@QAE@XZ to Project!public: __thiscall ...
1
vote
0answers
166 views

How can I parse VMTs in IDA if I have the base address?

I have run the Class Informer plugin to identify virtual method tables. I am trying to write a python script which will rename each function in the table. I am struggling to find the correct API ...
2
votes
1answer
516 views

IDA Plugin/Script Output File Character Limit?

I am currently working on both a plugin and an ida-python script that export fairly big JSON files. I just noticed, that both will at times cut off the output files with no error message. Sometimes ...
5
votes
2answers
4k views

Ida Pro: parsig complex operand expression using Idapython

Say given the following line in Ida Pro: mov [rsp+3F8h+var_3F8], 0 How can I parse and access the items inside the [ ]? What I tried: idc.GetOpnd(addr, n) # returns a string '[rsp+3F8h+...
3
votes
0answers
1k views

Tracing function call args with IDA Pro

Right now I'm trying to place a trace point and hook it with the Python code that pulls all relevant stuff from the stack. Unfortunately it just gives me the garbage all the time, because the value in ...
3
votes
1answer
5k views

Setting name of (newly created) functions via IDAPython

Is there a way to specify the name of a function when creating it with idc.MakeFunction()? If not, what is the best practice to rename a function? I found idc.GetFunctionName(ea) but no counterpart ...
3
votes
2answers
2k views

IDA Pro: Side effects or disadvantages of “Create function”

Some instructions in a binary do not belong to a function, or, IDA does not manage to recover one. See for example the red addresses in the below screen shot. Yet, one can right-click such 'function-...
1
vote
0answers
1k views

How to get opcodes for assembly using ppc processor (IDAPython)

In IDAPython, you can obtain the corresponding opcodes for a assembly instruction using the Assemble(ea, line) function. Here is an example using a PE-file / x86 processor type: Python>Assemble(...
5
votes
0answers
565 views

How to create HexRays variables in IDAPython correctly?

Let's assume we have a function which has a following variables in it: Local variables on stack of different types, including types defined in local types window Local variables of different types ...
10
votes
1answer
4k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...