Questions tagged [idapython]

A Python API to develop IDA Pro plugins which comes bundled with the paid versions of IDA. It allows automation of tasks and even writing loaders and plugins in Python themselves.

Filter by
Sorted by
Tagged with
6
votes
3answers
8k views

Paste hex bytes into IDA Pro Hex View

Is it possible to paste a series of bytes into hex view of IDA? Say I have a large buffer I need to fill with a specific value, and I have it in the form most hex editors output... 0A AB EF FF 00 01......
6
votes
1answer
2k views

How to extract the input file offset of a byte in idapython?

For every selected byte Ida Pro displays the offset in the input file where the byte can be found (displayed in the buttom bar of the Ida-View and the Hex-View). How can I retrieve this information ...
7
votes
1answer
3k views

Getting IDAPro to analyse part of memory as PE-File

I am using Qemu with its internal GDB server to attach IDA Pro to an instance of Windows 8 x64. There are some problems to solve, because when I am connecting to the GDB server, I am just seeing a ...
8
votes
2answers
12k views

IDA Pro List of Functions with Instruction

I have a DLL with a large number of functions in IDA Pro. I would like to make a script that can scan the instructions within each of the functions looking for a specific instruction. For my specific ...
5
votes
2answers
2k views

Accessing Data Marked as Alignment Bytes in IDA

Some compilers will add useless bytes in functions or in between functions. In the below block of code at 0040117C we can see the "align" keyword that was inserted by IDA. .text:00401176 ...
15
votes
3answers
5k views

How to debug an IDAPython script from within IDA?

IDAPython is great plugin in IDA. It is so handy to write small script to decode, decrypt or fix (patch) a binary in IDA. I can just write, load and run a script, and can use print for the usual ...
5
votes
1answer
2k views

Is it possible to create data xrefs manually?

I have a binary with lots of indirect calls (call dword ptr [register + offset ]) the register is calculated with a simple math which I manage to statically calculate on my own (the call itself lead ...
18
votes
3answers
11k views

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

The title says most of it. Say I have a Windows PE (x86, 32bit) binary (just so we have case to discuss), the imports list will usually only show the imports found in the import directory. The ...
5
votes
2answers
2k views

IDA [call $+5 / pop reg] cleaning

Can anyone tell me how to clean up the code which contains the following blocks: call $+5 pop reg add reg, 08BE96h [...] In other words I need to change all such blocks to: mov reg, offset Edit # ...
8
votes
1answer
5k views

How can I control the Hex-Rays decompiler plugin from IDA with scripts?

I want to use IDA with the Hex-Rays decompiler plugin as part of automated static analysis, possibly on a large number of files without opening each one and telling it to produce a C file individually....
10
votes
2answers
4k views

How to map an arbitrary address to its corresponding basic block in IDA?

Say I have an arbitrary address and I want to find out which basic block (i.e. area_t structure) corresponds to it. How would I do that? Edit: more specifically, I want to know the beginning / end of ...
15
votes
4answers
14k views

What are the essential IDA Plugins or IDA Python scripts that you use? [closed]

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely ...

1 2 3 4 5
6