8 votes

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

if adding an extra import section to the PE file is an acceptable option use tools like iidking and add an import section with all the imports that are resolved dynamically use add cross ...
user avatar
  • 14.9k
6 votes

IDA and Ghidra Reversing

I can only properly answer your first question: I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find) If your "...
user avatar
5 votes

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

If you can not add something to the imports viewer you can write your own. Here is the simple example (it is slightly modified example referenced at this hexblog entry and located here with added ...
user avatar
  • 7,720
3 votes

IDAPython, parse IDA DB as PE file

I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
user avatar
  • 31
3 votes
Accepted

Point-to analysis of IDA Pro

The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field. ...
user avatar
  • 11.4k
3 votes
Accepted

Custom IDA Decompilation Format

Not possible, either through a configuration option or through a plugin. For example, here is the part of the code that prints the [rbp-1Fh] from your example: qsnprintf(v16, v36 - v16, "[%s%c%ah]...
user avatar
  • 7,814
3 votes

How to load a color theme correctly in IDAPro?

I think you're talking about changing the appearance of Qt widgets and not only IDA widgets. If so, take a look at zyantific/IDASkins python plugin. There're also plugins in C++ if you prefer it.
user avatar
  • 1,074
3 votes

Use idapython to print register or memory value when the debugger is running

Create two Python-functions (menu File-Script command...). First for printing EAX and second - for printing memory @FF27790 def view_ecx(): print GetRegValue("ecx") def view_memory(): print ...
user avatar
  • 171
3 votes

How to identify base64 encode/decode in assembly

The common base64 key contains ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/. However, remember that IDA Pro will convert ASCII text for you, so you should have no reason to go ...
user avatar
  • 1,625
3 votes
Accepted

Removing empty blocks ida api

That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
user avatar
  • 7,814
2 votes
Accepted

Can't find debugger in IDA PRO menu

IDA does not support debugging .NET binaries or more specifically the CIL bytecode. To debug managed code you can use WinDbg with the SOS debugging extension (SOS.dll). You can also use dnSpy which ...
user avatar
  • 5,850
2 votes

Names not populating from disassembly to decompiler

If you rename things outside of pseudocode view, it’s not updated automatically and you need to press F5to refresh decompilation with current data.
user avatar
  • 34.7k
2 votes

Find functions signatures in Ida?

IDA works with FLIRT (Fast Library Identification and Recognition Technology) signatures. These “signatures” are basically sequences of assembly instructions that are found in functions. IDA has built-...
user avatar
  • 822
2 votes
Accepted

How to parse the NT headers and section headers of a PE file using IDApython?

The PE header area is not loaded into the database by default but you can do it by enabling “manual load” in the initial load dialog. However, the copy of the header is saved in the database and can ...
user avatar
  • 34.7k
2 votes

Try to parse buffer as PE with IDAPython

After some research time, I found a way to do it in CPP but not in python. https://github.com/SentineLabs/Memloader/blob/main/MemoryLoader/MemoryLoader/MemoryLoader.cpp The most relevant part of the ...
user avatar
2 votes

Identify APIs inside functions

I am not sure about a plugin. But, this answer gives an IDC script for similar purpose. I also wrote a script to get called function graph a long time ago. You can leverage this and tweak this ...
user avatar
  • 1,437
2 votes

IDA plugin with visual studio c++ 2019

For decades, IDA's plugin interface remained the same. Your plugin had to export a plugin_t structure named PLUGIN, which contained function pointers to its init, run, and optional term functions. You ...
user avatar
  • 7,814
2 votes
Accepted

IDA PRO Hex-Rays try-catch

I've considered doing this myself, but it's tricky for many reasons. First, exception internals are not standardized across languages, platforms, or implementations. 64-bit Windows programs use a data-...
user avatar
  • 7,814
1 vote
Accepted

Identify APIs inside functions

To have an overview of called API in a function you can use Graph feature without pluging : select function click on menu View > Graphs > Users xrefs chart... in Starting Direction check only ...
user avatar
  • 66
1 vote

Failed to load IDA PLW plugin

IDA 7.0 is a 64-bit program and cannot load 32-bit PLW files. The plug-in needs to be ported and recompiled for the new API: https://www.hex-rays.com/products/ida/news/7_0/docs/api70_porting_guide/
user avatar
  • 34.7k
1 vote

How to parse the NT headers and section headers of a PE file using IDApython?

And if you ever feel the need to do it manually or in an environment other than IDA, you might find this useful. class AttrDict(dict): def __init__(self, *args, **kwargs): super(AttrDict, ...
user avatar
1 vote
Accepted

How to parse the IAT using IDApython?

There’s no built-in functionality for that, it’s too target-specific to be useful as standard API. What you can do is to retrieve the list of exports and/or imports for the file which was used to ...
user avatar
  • 34.7k
1 vote
Accepted

Get a networkx graph from the the function call-graph of the file using IDApython?

You can generate graphs in the DOT format by calling gen_flow_graph() with the CHART_GEN_DOT flag. The DOT file can then be imported into networkx using the from_pydot() function.
user avatar
  • 34.7k
1 vote
Accepted

Get current file name with IDApython

You can use get_input_file_path() IDC function and then extract the file name from it. It's also available in IDAPython as ida_nalt.get_input_file_path (source).
user avatar
  • 3,189
1 vote

Getting function arguments in ida

Okay that's our sample code: .text:0000000180002953 lea rcx, aSmiGetplatform ; "SMI_GetPlatformInfo" .text:000000018000295A mov r12b, 0FFh .text:...
user avatar
  • 148
1 vote

Getting function arguments in ida

I have found out that if in the disassembler you give the type to the function that is being called, then the ida python function will work as it should.
user avatar
1 vote

Using Python 3.7 and 2.x in same IDA

You can't use Python 3 and Python 2 in IDA simultaneously, but you can switch between them by following instructions in README_python3.txt.
user avatar
  • 34.7k
1 vote

Find all syscall in statically Arm Binary

In ARM the syscalls are either Supervisor call or Software interrupt. You can just search->text in IDA for: SVC 0x SWI 0x
user avatar
1 vote

Extracting instruction and operand information in IDA Python

I also had this question. The only solution I've found involves using the Capstone Python bindings in conjunction with IDA. The method call is regs_access https://www.capstone-engine.org/op_access....
user avatar
1 vote

How to call WinApi from a breakpoint in IDA Pro?

Your Python code executes inside IDA’s process so you are getting results of the call on IDA, not the debuggee. If you want to execute code inside the process being debugged, you can use Appcall: http:...
user avatar
  • 34.7k

Only top scored, non community-wiki answers of a minimum length are eligible