Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
3
votes
2answers
3k views

Making operand an offset in IDA Python

I working with ARM executable. Sometimes I have something like this MOV instruction: MOV R0, #0xCD548A40 where the number #0xCD548A40 is a valid offset but IDA doesn't recognize it as such ...
6
votes
1answer
2k views

Idapython - undefining an instruction

I have an instructions defined from address+1 onward and a byte at address. I'd like to undefine the instructions from address+1 onward and redefine them from address using MakeCode or something ...
2
votes
1answer
1k views

idapython find functions that contain a loop

How can I color functions that contain loops in IDApython ? If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i ...
5
votes
2answers
2k views

IDAPython for IDAFree 5.0

I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can ...
4
votes
2answers
2k views

Setting an IDA function pointer in a struct via script

The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member ...
4
votes
2answers
2k views

IDAPython: Get struct id defined at an address

Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't ...
4
votes
1answer
1k views

IDAPython on OSX

I wrote a simple IDAPython script that relies on some non-standard Python library. I'm able to build the library on Windows and run the script in IDA without issue. When I try to do this on OSX, IDA ...
3
votes
0answers
334 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
2
votes
2answers
981 views

Detecting epilogue/prologue of functions [closed]

I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
2
votes
2answers
817 views

Change calling convention from IDAPython?

I have a 64-bit Mach-O sample that uses the System V AMD64 ABI calling convention (rdi, rsi, rdx, rcx,...); but IDA thinks all the functions are using cdecl. I'm new to IDA scripting but didn't find ...
2
votes
2answers
753 views

Force IDA starter 6.5 to disassemble encrypted in autonomous mode

I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit) I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script. To do so, I use command as such, to call text ...
1
vote
1answer
2k views

Why I can not find all the functions using this IDC script?

On Linux 32 bit, I use IDA Pro + IDC script to dump all the functions. Here is part of the script: addr = 0; for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) { name = ...
4
votes
1answer
4k views

Enumerate all XefsTo a Segment in IDAPython

What is the best method to enumerate all xrefs to addresses in a particular segment? I came up with a brute-force approach (as seen below). The code scans each address in a segment and checks for an ...
1
vote
2answers
4k views

How to extract all the rodata data and bss section using IDC script in IDA Pro?

test Platform is 32 bit Linux ELF and 32 bit Windows PE. I use IDC script to extract all the functions from binary and dump into a file, then do the analysis based on the examples in IDA Pro book. ...
4
votes
1answer
2k views

IDA Pro/IDA Python, producing file via terminal

I am using IDA Pro 6.5 and running it via terminal with the following command line switches: -B (to run in batch mode, should automatically generate a .asm file containing results) -S running a ...
4
votes
2answers
2k views

IDA Pro converting to instruction functionality: how to automate.

I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit "c" in order to convert to instruction/code. However, I am ...
1
vote
2answers
574 views

Cross-referencing object fields

I'ld like to see which functions are operating with certain object's fields that I already processed, meaning I created the structure and assigned it to the correct places in the functions in IDA, ...
3
votes
0answers
294 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
4
votes
1answer
440 views

Formatting BinDiff results to a .txt

I have been using BinDiff as a plug-in for IDA Pro. I understand it is not possible to run this plug-in via terminal/batch mode. Is there a way I can export the results to a more readable format such ...
6
votes
2answers
1k views

IDA Pro/IDAPython automation through IDAPython

I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the ...
7
votes
1answer
652 views

Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?

Let's say I have lots of breakpoints at some push instructions. I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + ...
3
votes
2answers
5k views

Recompile the asm file IDA pro created

currently I am trying to use IDA pro to generate assembly code from PE file and recompile it. Firstly basically I know this way: File -> Produce File -> Create ASM File and it seems the asm ...
7
votes
1answer
787 views

Is there a way to set the number special purpose registers in IDA pro with a script?

IDA has this nifty habit that when it doesn't know what a special purpose register is, it just drops in the number of the register instead. While this is all well and fine, I'd like to be able to ...
6
votes
3answers
499 views

How can I clean up strings built at runtime?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
6
votes
3answers
7k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
6
votes
1answer
2k views

How to extract the input file offset of a byte in idapython?

For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
7
votes
1answer
3k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
8
votes
2answers
11k views

IDA Pro List of Functions with Instruction

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
5
votes
2answers
1k views

Accessing Data Marked as Alignment Bytes in IDA

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA. .text:00401176 ...
15
votes
3answers
4k views

How to debug an IDAPython script from within IDA?

IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
5
votes
1answer
2k views

Is it possible to create data xrefs manually?

I have a binary with lots of indirect calls (call dword ptr [register + offset ]) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead ...
17
votes
3answers
9k views

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
5
votes
2answers
2k views

IDA [call $+5 / pop reg] cleaning

Can anyone tell me how to clean up the code which contains the following blocks: call $+5 pop reg add reg, 08BE96h [...] In other words I need to change all such blocks to: mov reg, offset Edit # ...
8
votes
1answer
5k views

How can I control the Hex-Rays decompiler plugin from IDA with scripts?

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....
10
votes
2answers
4k views

How to map an arbitrary address to its corresponding basic block in IDA?

Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that? Edit: more specifically, I want to know the beginning / end of ...
15
votes
4answers
13k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...