Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
10
votes
1answer
4k views

Extracting arguments from IDA

Let's say I have the following function in IDA: int __usercall function<eax>(char* message<ebp>, unsigned int count<edi>) What's the fastest way to extract the argument information ...
4
votes
1answer
3k views

ELF: How to make IDA show me the correct PLT (Procedure Linkage Table) content?

I would like to make IDA disassemble the .plt section of ELF files correctly, e.g. as objdump does: objdump -D -M intel asdf | grep "Disassembly of section .plt" -A80 I don't know why but IDA gives ...
4
votes
1answer
636 views

Get memory locations using IDAPython

In my code, I am using idc.GetOpnd(ea,0) and idc.GetOpnd(ea,1) to get the 2 operands of an instruction. However, if its a call (or jmp) instruction, I am getting symbols like _perror and loc_8083BA9. ...
6
votes
1answer
10k views

Which python library for parsing Linux ELF files?

I want to be able to parse 32 and 64 bit ELF files - but not create or modify them (e.g. as discussed in this thread). The ELF binaries may possibly come from embedded Linux systems, that is, the ...
1
vote
1answer
1k views

Calling functions from IDAPython

I wrote a script containing several functions, which I loaded in IDA pro. From IDAPython now I'd want to call a specific function. Is it possible? Which idaapi functions should I use to call my ...
3
votes
1answer
1k views

How to call idc function with idapython

I want to script a x86Emu plugin (an IDA emulator) with IdaPython. It's registered idc functions. Below is function names from the plugin source code. /* add IDC functions for interacting with the ...
2
votes
1answer
2k views

Set breakpoints on all references in IDA

Is there a way to set breakpoints on all references in one click like we do in OllyDBG "Set breakpoint on every reference" ? E.g: after locating CreateFileA API and pressing "x" to see all references,...
1
vote
1answer
181 views

Is there anyway I can iterate all the C-level statements in IDA-Pro?

I am trying to iterate all the C statement (could be very coarse-grained, it's fine) in IDA-Pro recovered assembly program. Suppose I only consider these statements: State :: = | if-else cond; |...
1
vote
1answer
2k views

How to get the recovered memory references in IDA-Pro? [duplicate]

I want to collect all the IDA recovered symbol information in data sections (this information could be function name, or it could be an entry of jump table, or it could be a reference to other data ...
3
votes
1answer
998 views

IDA basic block type fcb_cndret - what does it mean?

IDA Pro's idaapi.BasicBlock objects returned by idaapi.FlowChart() can be of the following types (see gdl.hpp in the SDK sources): // flow chart block types enum fc_block_type_t { fcb_normal, // ...
2
votes
3answers
2k views

Declaring block as a string in IDA

I'm reverse engineering a binary that has very generic, standard xor+math encryption on every string. I've written IDAPython to find each one(they're used in a generic way) and decrypt them, then add ...
2
votes
1answer
507 views

Strange function in IDA Pro: Only one basic block ending with a jmp sub_xxxxxx (instead of a ret)

Analyzing the ELF file /usr/bin/curl (Ubuntu 14.04, 64bit), I stumbled upon a strange function (see image). It is called regularly via call sub_403D90 but does not end with a ret. Instead, it jumps to ...
4
votes
1answer
3k views

Can I invoke IDA's plugin BinDiff from command line?

I am trying to evaluate a very large amount of binaries (thousands) using BinDiff, and currently I only need some instruction level statistics from BinDiff, which can be acquired from its dumped ...
6
votes
2answers
5k views

How to get imge base of current setting through script in IDA pro?

As a beginner I'm trying to disassemble a file with IDA Pro 6.5. I know that the image base can be find in IDA Pro manu Edit -> Segment -> Rebase program. Now, I want to get the image base of ...
2
votes
1answer
439 views

How to detect address changes in the IDA SDK?

I'm developing a custom memory viewer in Python for IDA. Obviously I need to know current EA. For now, I just ask user to supply it through AskAddr() and it works fine. However, I'd like my plugin to ...
3
votes
1answer
2k views

IDAPro, the arguments could not be passed to the python script

Using IDA 6.6, I cannot pass command line arguments to the IDAPython script. The command I use is: idaq64 -c -A -S"myscrip.py arg1" thebinpath. Here is the demo script myscript.py: import sys if ...
3
votes
1answer
405 views

Function calls: xref.type always 'Code_Far_Call' or 'Code_Near_Call'?

Given a disassembly line in IDA Pro such as .text:0040255B call sub_407C10 Am I right to assume that analyzing the belonging address using idautils.XrefsFrom(0x0040255B) always returns an ...
1
vote
0answers
200 views

Changing the argument number in a macro in IDA Pro

Can I change argument number to macro in IDA pro Hex-rays? fd = open("a", 513, 0644); Like this. fd = open("a", O_WRONLY|O_CREAT, 0644); Is this possible?
0
votes
1answer
3k views

IDAPython load PDB-file of analysed binary

in a python-script which I'm writing I need the possibility to load via IDA-Python the PDB-File of the analysed binary (PE-File). I know how to load a PDB-File via GUi but I need this scripted. Has ...
6
votes
1answer
522 views

A wiki for IDA? [closed]

Everyone knows the state of IDA's documentation... There is a bit of info in idc.idc and the SDK headers, there's Chris Eagle's book (which predates quite a few advances in IDA), and there's the ...
4
votes
1answer
2k views

IDAPython script does not reload

I'm debugging an IDAPython script on my host machine and I have IDA running on my Windows VM. The folder containing the IDAPython script on the host machine is shared with the VM. The first time I ...
1
vote
2answers
2k views

Using an existing IDB from IDA command line interface

Is there any way to use an existing IDB from the IDA command line interface ? I went through the list of command line switches here but there isn't any related switches. As I am currently scripting ...
2
votes
2answers
461 views

Disassemble instruction with a variable as an offset

I am looking to disassemble an instruction at an address. I know that there are many instructions that can accomplish this such as idc.GetDisasm(), idc.GetDisasmEx(), idaapi.generate_disassembly(), ...
3
votes
2answers
4k views

Making operand an offset in IDA Python

I working with ARM executable. Sometimes I have something like this MOV instruction: MOV R0, #0xCD548A40 where the number #0xCD548A40 is a valid offset but IDA doesn't recognize it as such ...
6
votes
1answer
3k views

Idapython - undefining an instruction

I have an instructions defined from address+1 onward and a byte at address. I'd like to undefine the instructions from address+1 onward and redefine them from address using MakeCode or something ...
2
votes
1answer
1k views

idapython find functions that contain a loop

How can I color functions that contain loops in IDApython ? If the end of the basic block can jump to start of basic block it's good enough, even in the rare case this is not a loop. But how do i ...
5
votes
2answers
3k views

IDAPython for IDAFree 5.0

I want to run some python scripts on IDAFree 5.0. However, there is no pre-built IDAPython at http://code.google.com/p/idapython/downloads/list for this version. So, I was wondering if anyone can ...
4
votes
2answers
2k views

Setting an IDA function pointer in a struct via script

The ordinary, manual way of redefining a struct member to become a function pointer would be to press on it, hit 'Y', and enter the proper declaration in the popup box. For example, for struct member ...
3
votes
2answers
2k views

IDAPython: Get struct id defined at an address

Spotted an interesting problem when trying to determine which type of structure (since isStruct(getFlags(ea)) returns True) is defined at the given address in the DB. Reading through idc.py didn't ...
4
votes
1answer
1k views

IDAPython on OSX

I wrote a simple IDAPython script that relies on some non-standard Python library. I'm able to build the library on Windows and run the script in IDA without issue. When I try to do this on OSX, IDA ...
3
votes
0answers
344 views

Best Practice to handle/document dynamically loaded calls/branches/jumps in IDA

I have been reversing some binaries that either have broken relocation tables (ELF binaries), or due to architecture limitations "build" function addresses arithmetically in a register then branch to ...
2
votes
2answers
1k views

Detecting epilogue/prologue of functions [closed]

I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
2
votes
2answers
874 views

Change calling convention from IDAPython?

I have a 64-bit Mach-O sample that uses the System V AMD64 ABI calling convention (rdi, rsi, rdx, rcx,...); but IDA thinks all the functions are using cdecl. I'm new to IDA scripting but didn't find ...
2
votes
2answers
763 views

Force IDA starter 6.5 to disassemble encrypted in autonomous mode

I'm using IDA Starter 6.5 on linux. (Debian Wheezy 32bit) I would like to perform batch analysis on a bunch of iOS apps with an IDAPython script. To do so, I use command as such, to call text ...
1
vote
1answer
2k views

Why I can not find all the functions using this IDC script?

On Linux 32 bit, I use IDA Pro + IDC script to dump all the functions. Here is part of the script: addr = 0; for (addr = NextFunction(addr); addr != BADADDR; addr = NextFunction(addr)) { name = ...
4
votes
1answer
4k views

Enumerate all XefsTo a Segment in IDAPython

What is the best method to enumerate all xrefs to addresses in a particular segment? I came up with a brute-force approach (as seen below). The code scans each address in a segment and checks for an ...
1
vote
2answers
5k views

How to extract all the rodata data and bss section using IDC script in IDA Pro?

test Platform is 32 bit Linux ELF and 32 bit Windows PE. I use IDC script to extract all the functions from binary and dump into a file, then do the analysis based on the examples in IDA Pro book. ...
4
votes
1answer
3k views

IDA Pro/IDA Python, producing file via terminal

I am using IDA Pro 6.5 and running it via terminal with the following command line switches: -B (to run in batch mode, should automatically generate a .asm file containing results) -S running a ...
4
votes
2answers
3k views

IDA Pro converting to instruction functionality: how to automate.

I am loading various files that read into IDA as binary. Once I have the GUI in front of me I am able to go through the segments and hit "c" in order to convert to instruction/code. However, I am ...
1
vote
2answers
620 views

Cross-referencing object fields

I'ld like to see which functions are operating with certain object's fields that I already processed, meaning I created the structure and assigned it to the correct places in the functions in IDA, ...
3
votes
0answers
300 views

funcap not capturing information in IDA debugger

I'm looking for ways to quickly triage applications when I'm reverse engineering and I've been looking at solutions that have already been written before I write my own I saw funcap (https://github....
4
votes
1answer
470 views

Formatting BinDiff results to a .txt

I have been using BinDiff as a plug-in for IDA Pro. I understand it is not possible to run this plug-in via terminal/batch mode. Is there a way I can export the results to a more readable format such ...
6
votes
2answers
1k views

IDA Pro/IDAPython automation through IDAPython

I have been trying to use IDA Pro (with bindiff) via IDAPython to automate the analysis process of a bios.dump file while outputting the results to a .txt / .asm file. From here I want to use the ...
7
votes
1answer
671 views

Can I evaluate operand values of an instruction currently at breakpoint (while debugging) in IDA using IDAPython?

Let's say I have lots of breakpoints at some push instructions. I am trying to dereference the operand (if address) - get the actual relevant value for each one in a script, handling immediate, base + ...
3
votes
2answers
5k views

Recompile the asm file IDA pro created

currently I am trying to use IDA pro to generate assembly code from PE file and recompile it. Firstly basically I know this way: File -> Produce File -> Create ASM File and it seems the asm ...
7
votes
1answer
903 views

Is there a way to set the number special purpose registers in IDA pro with a script?

IDA has this nifty habit that when it doesn't know what a special purpose register is, it just drops in the number of the register instead. While this is all well and fine, I'd like to be able to ...
6
votes
3answers
514 views

How can I clean up strings built at runtime?

How can I clean up/simplify strings that are built at runtime? I've seen this a couple of times and figured that there has to be something easier. I've been manually converting the characters to try ...
6
votes
3answers
8k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
6
votes
1answer
2k views

How to extract the input file offset of a byte in idapython?

For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
7
votes
1answer
3k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...