Skip to main content
8 votes
Accepted

How can I set breakpoint and get value of a register with IDApython

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the ...
NirIzr's user avatar
  • 11.8k
6 votes

IDA and Ghidra Reversing

I can only properly answer your first question: I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find) If your "...
Florian Magin's user avatar
5 votes
Accepted

Adding a toolbar to IDA using PySide

New IDA 6.95 API Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Executing an IDAPython script with arguments within IDA Pro

Naturally, the best way would be editing the script and have it ask the user for those parameters. IDA has quite a few ways of doing that. You could use one or several of the many idc.Ask* functions. ...
NirIzr's user avatar
  • 11.8k
4 votes
Accepted

Hex-Rays and IDA Python plugin loading order

When loading plugins, IDA goes through them alphabetically, and tries to load all the plugins. When loading a plugin, the loader check the plugin flags (idaapi.PLUGIN_PROC, idaapi.PLUGIN_FIX, and so ...
tmr232's user avatar
  • 1,577
4 votes
Accepted

Variable mapping in IDA hotkey change

please have a look at the second part of this blog post. You can either manipulate your shortcuts.cfg or use the Options->Shortcuts GUI since version 6.2.
Nordwald's user avatar
  • 2,906
4 votes

IDA plugin with visual studio c++ 2019

For decades, IDA's plugin interface remained the same. Your plugin had to export a plugin_t structure named PLUGIN, which contained function pointers to its init, run, and optional term functions. You ...
Rolf Rolles's user avatar
  • 9,198
4 votes

How to highlight all external registers in a function

The answer to this question is to simply use Hex-Rays instead of IDA. It automatically does everything you've suggested, and the end result is the function's prototype, which will indicate register ...
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

How to find V-Table in IDA? (Using class informer)

What you're looking it is actually a VTable. As you know, a VTable is a table of function pointers and as you can see, at address 0x19B64 you actually see a single function address (this looks like dd ...
NirIzr's user avatar
  • 11.8k
3 votes

Install and configure script language bar on IDA from IDC to Python

The free version of IDA doesn't support the IDAPython scripting engine. You'll have to get a commercial license. The instructions you're trying to follow may also be a little outdated.
NirIzr's user avatar
  • 11.8k
3 votes

How can I call IDA Pro's MakeCode for one instruction at a time?

NirIzr's answer has a major drawback: All those locations following the decoded instructions are still added to the analyzer queue, they're just not being processed. That means if you ever enable ...
user2347953's user avatar
3 votes
Accepted

How can I call IDA Pro's MakeCode for one instruction at a time?

This is a bit of a tricky question, because technically MakeCode is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that MakeCode actually returns the ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

IDA Pro/IDAPython automation through IDAPython

With the now free BinDiff 4.2 you can do batch analysis with a bit of work. In the BinDiff installation directory (zynamics/BinDiff 4.2), you will find bin/differ.exe and bin/differ64.exe. Those are ...
tmr232's user avatar
  • 1,577
3 votes
Accepted

Obtaining the Pseudocode of a function via a script

You can use the following function: def decompile_func(ea): if not init_hexrays_plugin(): return False f = get_func(ea) if f is None: return False cfunc = decompile(f); if cfunc ...
joxeankoret's user avatar
  • 4,488
3 votes
Accepted

Point-to analysis of IDA Pro

The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field. ...
NirIzr's user avatar
  • 11.8k
3 votes

How to identify base64 encode/decode in assembly

The common base64 key contains ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/. However, remember that IDA Pro will convert ASCII text for you, so you should have no reason to go ...
the_endian's user avatar
  • 1,870
3 votes

How to load a color theme correctly in IDAPro?

I think you're talking about changing the appearance of Qt widgets and not only IDA widgets. If so, take a look at zyantific/IDASkins python plugin. There're also plugins in C++ if you prefer it.
wisk's user avatar
  • 1,164
3 votes

Use idapython to print register or memory value when the debugger is running

Create two Python-functions (menu File-Script command...). First for printing EAX and second - for printing memory @FF27790 def view_ecx(): print GetRegValue("ecx") def view_memory(): print ...
prusanov's user avatar
  • 171
3 votes

Getting function arguments in ida

Okay that's our sample code: .text:0000000180002953 lea rcx, aSmiGetplatform ; "SMI_GetPlatformInfo" .text:000000018000295A mov r12b, 0FFh .text:...
Nadu's user avatar
  • 168
3 votes
Accepted

Get current file name with IDApython

You can use get_input_file_path() IDC function and then extract the file name from it. It's also available in IDAPython as ida_nalt.get_input_file_path (source).
bart1e's user avatar
  • 3,409
3 votes
Accepted

Custom IDA Decompilation Format

Not possible, either through a configuration option or through a plugin. For example, here is the part of the code that prints the [rbp-1Fh] from your example: qsnprintf(v16, v36 - v16, "[%s%c%ah]...
Rolf Rolles's user avatar
  • 9,198
3 votes

IDAPython, parse IDA DB as PE file

I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
Nyx__o's user avatar
  • 31
3 votes
Accepted

Removing empty blocks ida api

That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
Rolf Rolles's user avatar
  • 9,198
2 votes

How can I export a struct in IDA Pro to a c-style struct?

I've found the answer here. It is possible to export a structure by going in Local Types (Shift+F1). Then select the structure you want to export and in the contextual menu choose either Edit or ...
user16715's user avatar
2 votes

Find cryptography used by iOS applications by analyzing ARM assembly in IDA?

FindCrypt and IDASignsrch are both plugins used to scan the binary itself for cryptographic algorithm signatures. Non of them try to map API functions (and certainly not for iOS). They work by ...
NirIzr's user avatar
  • 11.8k
2 votes

IDA Pro Plugin to add x64dbg

I am not aware of any fully-fledged plugin, but there are some halfway solutions. Labeless looks promising and provides Labels/Comments synchronization between IDA PRO and dbg backend (OllyDbg1.10,...
tmr232's user avatar
  • 1,577
2 votes

IDApython and IDA-decompiler commenting

The treeloc_t constructor does not accept an EA, and you need to specify the comment preciser: ea = idaapi.get_screen_ea() cfunc = idaapi.decompile(ea) tl = idaapi.treeloc_t() tl.ea = ea tl.itp = ...
Andrea Biondo's user avatar
2 votes

How to Find All Switch Jump Tables in IDAPython

Decided to add a small code snippet to show how to iterate through the .text segment, obtaining all the switch table locations and storing the jump targets in a dictionary. text_seg = idaapi....
chuazl's user avatar
  • 21
2 votes

Is there any IDA plugin to display AST?

See the vds5 plugin in the Hex-Rays SDK. /* * Hex-Rays Decompiler project * Copyright (c) 2007-2008 by Hex-Rays, [email protected] * ALL RIGHTS RESERVED. * * Sample plugin ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

IDAPython: Change struct member content name

I am not sure what you are trying to accomplish. My guess is you are trying to document each command entry in a list of commands. Changing struct membernames is done in the structs view, or using the ...
Willem Hengeveld's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible