Questions tagged [ida-plugin]

Refer to any programs specifically designed to be a plugin of IDA Pro.

Filter by
Sorted by
Tagged with
2 votes
1 answer
89 views

Load to Ida binary with all of SO

I have a Linux ARM binary with a lot of shared libraries. Can I load all of them into one IDA instance so that I can easily navigate between functions? For example: functions that the binary calls and ...
user avatar
1 vote
1 answer
60 views

Custom IDA Decompilation Coloring

Is there a way to customize the coloring of IDA's decompiled code? IDA -> Options -> Colors -> Syntax doesn't seem to affect the coloring of decompilation.
user avatar
  • 113
1 vote
1 answer
47 views

Removing empty blocks ida api

i have a c++ module that removes empty block it used to work well but now I'm porting it to ida 7.7 I'm having issues. mba_t *mba; mba->remove_empty_blocks(); It throws following error "...
user avatar
  • 73
1 vote
1 answer
309 views

How to get function signature using IDA Python in IDA Pro

I open .exe file in IDA with .pdb attached to it, so IDA scans .pdb and shows function names. I need to get signature strings of many functions. I can't do it manually so I want to use built-it IDA ...
user avatar
  • 11
1 vote
1 answer
89 views

Can I get loaded pdb file path from IDAPython?

IDA Pro can automatically download and load .pdb files from symbol server. And now I want to write an IDAPython plugin to obtain some data from the .pdb file. But I don't know how to get the file path ...
user avatar
  • 117
1 vote
1 answer
138 views

How is it possible to generate C++ class header from a .dll or ELF file?

I loaded a dynamic library file to IDA. I can clearly see the function signatures from the "Function name list". There are RTTI items in the "Structures" tab as well, but I don't ...
user avatar
  • 204
1 vote
1 answer
117 views

Analyze Arm Linux CPP binary in Ida Pro

I tried to open CPP binary with Ida. Most of the code analyze well . The problem is that there are lot of vtables(Ida doesn't recognize them as vtables) that I need to reach them manually and pressO (...
user avatar
1 vote
1 answer
157 views

Ida Pro doesn't recognize known function

I open statically Arm binary with Ida Pro. While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example) ...
user avatar
0 votes
1 answer
105 views

IDA API: Writing a plugin - How can I ensure that analysis has completed?

I have been reading through the API documentation here and As far as I can tell there are three ways to wait for the analysis to finish. get_auto_state auto_wait auto_is_ok Looking at the API if ...
user avatar
  • 723
2 votes
2 answers
326 views

IDA PRO Hex-Rays try-catch

I've been working in IDA Pro with a project but there is an issue. Try-Catch statements don't look nice. I've been searching and it seems like IDA does not support them so I was wondering if there is ...
user avatar
  • 97
1 vote
1 answer
91 views

Display open handles in IDA pro, just like xdbg?

I want to know for example that if a ReadFile is happening and the handle number is 100, which file or whatever this handle belongs to? lets assume for whatever reason i cannot trace CreateFiles to ...
user avatar
1 vote
1 answer
34 views

Restoring original stack variable in IDA Pro?

I would like to convert an instruction like: lea ecx, [esp+150h+var_13E+2] to: lea ecx, [esp+14h] I know it's possible to do this with the key K. But I'm writing an IDAPython plugin that needs ...
user avatar
0 votes
1 answer
87 views

Is there any way to STOP the loop of the IDApython?

Is there any way to STOP the loop of the IDApython ? I want to stop the loop processing of IDAPython with any timing after starting the IDAPython(which contain loop function) from IDApro menu -> ...
user avatar
0 votes
1 answer
784 views

(IDAPython)How to get the function name string from the Function address?

For example, in the Registers windows of IDA pro, It show the following. ( I think "WS2_32.dll:ws2_32_shutdown" is a string that IDA automatically resolved.) EAX 766D32B0 WS2_32.dll:...
user avatar
0 votes
1 answer
89 views

how to call the function from IDAPython with passing arguments by manually push them to the stack

would you please tell me how to call the function from IDAPython code ?
 I want to simulate it by manually push to stack as the two arguments and calling the function.
user avatar
1 vote
3 answers
107 views

Identify APIs inside functions

I know it's a silly question 😂😂 I'm using IDA and I want to know if there is a plugin to identify all called APIs inside a function instead of entering each function manually?
user avatar
  • 83
0 votes
1 answer
534 views

Failed to load IDA PLW plugin

I am trying to install mIDA plugin for IDA. I found a compiled PLW file here: https://github.com/sourceincite/tools/tree/master/pymsrpc/mIDA , downloaded it and saved it to C:\Program Files\IDA 7.0\...
user avatar
  • 11
0 votes
1 answer
91 views

IDAPython, parse IDA DB as PE file

I have buffer loaded into IDA with IDAPython in a costume loader script, I want to now to be parsed as a PE, or in fact, it would be better if IDA will try to reparse it as a PE, is it possible ...
user avatar
1 vote
1 answer
139 views

Try to parse buffer as PE with IDAPython

file_buffer = requests.get(file_url) buf_size = len(file_buffer) pe_file = pefile.PE(data=file_buffer) print("This is really a pe imphash %s." % pe_file.get_imphash()) addr = hex(id(...
user avatar
1 vote
2 answers
291 views

How to parse the NT headers and section headers of a PE file using IDApython?

I am trying to move some of my PE parsing into IDApython, i know how to do this with libraries like lief, but is it possible to parse the PE headers using IDA python, just like lief? i want to get all ...
user avatar
0 votes
1 answer
88 views

How to parse the IAT using IDApython?

Is it possible to parse the IAT using IDApython? i know how to do it with python libraries like lief, but i was wondering if IDApython also has an ability to parse IAT or not?
user avatar
1 vote
3 answers
600 views

IDA plugin with visual studio c++ 2019

Hello all and sorry for my bad English I am trying to test an example for developping plugin in C++ with IDA from the book : http://www.binarypool.com/idapluginwriting/idapw.pdf I am using Visual c++ ...
user avatar
  • 13
0 votes
1 answer
51 views

LPC2378FBD144 Arm7 hex file

I have binary file for the LPC2378FBD144 processor ineed to reverse engineer it using IDA V7.3 im little confused about memory organization values i should put in the memory organization thank you for ...
user avatar
0 votes
1 answer
81 views

Custom IDA Decompilation Format

Is there a way to customize the format of IDA's decompiled code? e.g. char buf[7]; // [rsp+5h] [rbp-1Fh] to char buf[ 7 ]; // [ rsp + 5h ] [ rbp - 1Fh ] or switch (c) to switch( c )
user avatar
  • 113
1 vote
0 answers
2k views

How to change IDA to use Python 3.7 and not Python 2.7: "do not have the x86_64 architecture"

I have IDA 6.95, Python 2.7 and Python 3.7. Currently when I start IDA it uses Python 2.7: ----------------------------------------------------------------------------------------- Python 2.7.12 (v2.7....
user avatar
  • 461
1 vote
1 answer
342 views

Get a networkx graph from the the function call-graph of the file using IDApython?

Is there any easy way to get a function call graph of a binary program using IDApython then convert it to a networkx graph other than going through every function and constructing the call-graph ...
user avatar
0 votes
1 answer
929 views

Get current file name with IDApython

I am running my IDA script on many files (batching), and i need to get the file name the script is running on within the script. the problem is i cannot find any API that does that. the closest things ...
user avatar
0 votes
0 answers
114 views

Checking if a call is a API/Library call in IDApython?

I asked the question a while ago but found no answer so I'm trying my luck again the only solution is this : Finding all API calls in a function but it doesn't work when the library call is a .NET ...
user avatar
1 vote
1 answer
136 views

Is there any way to apply FLIRT signatures through a script like idapython?

I'm writing a script to find out how many functions were recognized after applying a FLIRT signature library, I'm using idapython I would like to know if I can apply the signatures by the script.
user avatar
1 vote
2 answers
849 views

Getting function arguments in ida

I'm trying to extract the callee arguments in my intel x86 binary using IDA Pro 7.3. I tried the following line: ida_typeinf.get_arg_addrs(call_address) # call address points at `call some_func` ...
user avatar
1 vote
0 answers
120 views

How to clear all comments created in ida using funcap?

How to clear the comments created by funcap and restore database to it's previous state? I tried reanalyzing the program but comments do not seems to go away from database. Though, checking-off ...
user avatar
  • 223
0 votes
1 answer
2k views

Find functions signatures in Ida?

I didn't understand the subject of find function in Ida via signature. If I understand well that way helps to recognize libraries functions in static binary(in dynamic binary I can see the functions ...
user avatar
1 vote
1 answer
320 views

IDAPython: idaapi.get_highlight for demangled names

I'm using the following code to get the address of the selected function/variable: hightlight = idaapi.get_highlight(idaapi.get_current_viewer()) screen_ea = idaapi.get_screen_ea() ea = idaapi....
user avatar
2 votes
1 answer
2k views

IDA and Ghidra Reversing

I have several questions about IDA and Ghidra (for MIPS and ARM): Is there any option to load an executable file with all its libraries? For example, I want to enter inside a function which its ...
user avatar
  • 71
2 votes
1 answer
127 views

Names not populating from disassembly to decompiler

I am writing a script in IDA Pro. I noticed that when I rename functions with "n" in the disassembly view, that same function is not being renamed in the decompilation. I have never noticed this ...
user avatar
1 vote
1 answer
3k views

Using Python 3.7 and 2.x in same IDA

I have IDA Pro 7.4 that use with Python 3.7 and I have some IDA-plugin that works only with Python 2.7. Is there any way to run that Python 2.7 based plugin?
user avatar
1 vote
0 answers
112 views

Find vulnerabilities in ARM IoT device

I have an ARM IoT device with a web interface, and I have the binary of this device open in Ida Pro. I looking for vulnerabilities in the webserver binary that can be exploited to run commands or ...
user avatar
1 vote
1 answer
546 views

Find all syscall in statically Arm Binary

What is the easy and fast way to find all syscall in statically Arm binary ? Is there any Ida plugin that do that?
user avatar
1 vote
0 answers
59 views

IDA Pro SP tracking

I am reversing a BIOS and its code extensively uses SP register for 16-bit return addresses (and also things like "bswap ESP" to obtain a "two-level-deep" stack, and rarely "mov mm7, esp" to obtain a "...
user avatar
1 vote
0 answers
146 views

How to load a library at a specific address in IDA and re-analyze the program statically?

I have a dumped PE that has calls like call ds:dword_4010B4 now these are actually addresses of APIs in kernel32.dll my problem is IDA doesn't know that these are kernel32 APIs and therefore in ...
user avatar
1 vote
1 answer
586 views

Extracting instruction and operand information in IDA Python

I am writing an IDA python plugin to identify the operands that are defined and used by every instruction. For now, I am using the canonical feature for an instruction to identify if an operand to the ...
user avatar
0 votes
1 answer
257 views

How to call WinApi from a breakpoint in IDA Pro?

When I'm stepping through a debuggee process with IDA+WinDbg (as a debugger), I need to track one parameter by executing the following API (from within the breakpoint): //C++ code SCROLLINFO s; s....
user avatar
  • 1,305
0 votes
0 answers
46 views

use ida python to add a remark when calling a function using register

I want to add a remark for all non direct function calls. e.g. say i have mov EAX [functionEP] call EAX Assuming i have many such calls to various functions, I would like to run the debugger and ...
user avatar
  • 255
3 votes
2 answers
4k views

Use idapython to print register or memory value when the debugger is running

I want to record the value of a certain register or specific memory location when the program is being debugged. e.g. in the following segment: .text:0FD6268D shr ecx, 4 .text:...
user avatar
  • 255
1 vote
1 answer
175 views

Tool to search known hash/encryption algo in files in Windows

I am looking for a tool (the best would be an Ida plugin) that can search files in a folder for a known hash (md5/sha1 etc.) and encryption (aes /rsa etc.). I know an Ida plugin called FindCrypt2 but ...
user avatar
1 vote
3 answers
4k views

How to load a color theme correctly in IDAPro?

I work late nights and a dark theme like this would be nice with IDAPro. I followed the installation steps and copied the contents of 'plugins' from the github page to the 'plugins' directory in my ...
user avatar
  • 223
1 vote
0 answers
122 views

Argument types not identified when parsing declarations

I'm trying to add a dynamic import segment in the IDA database which contains functions names, and I'm applying type information to it, so that I can obtain argument locations by using ...
user avatar
0 votes
2 answers
2k views

How to identify base64 encode/decode in assembly

How to identify in assembly base 64 encode/decode with Ida. Is there any magic constant that I can search? Or maybe a plugin that find that? FindCrypt2 Ida plugin not find that
user avatar
  • 503
1 vote
1 answer
1k views

Can't find debugger in IDA PRO menu

I was going to debug something but I see IDA 6.8 + hexrays doesn't show the debugger tab in the menu for some .exe files. This is an example when I didn't load any .exe: This is another example when ...
user avatar
3 votes
1 answer
595 views

IDA 7.0 - combine sequence of assembly instructions to a macro

I'm solving this CTF with IDA Pro 7.0. At some point there is an offset calculation by index, it simply multiply an index by 48 and write/read some data to it. The main problems are: the ...
user avatar
  • 31