8
votes
In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?
if adding an extra import section to the PE file is an acceptable option
use tools like iidking and add an import section with all the imports that are resolved dynamically
use add cross ...
- 14.9k
6
votes
IDA and Ghidra Reversing
I can only properly answer your first question:
I think this is fundamentally impossible to achieve with IDA, but in Ghidra it works and is fairly easy to use (though a bit hard to find)
If your "...
- 1,186
5
votes
In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?
If you can not add something to the imports viewer you can write your own.
Here is the simple example (it is slightly modified example referenced at this hexblog entry and located here with added ...
- 7,720
3
votes
IDAPython, parse IDA DB as PE file
I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
- 31
3
votes
Accepted
Point-to analysis of IDA Pro
The topic of pointer analysis is an important part of theoretical static analysis. Many articles and academic publications have been written about pointer analysis, this is a heavily researched field.
...
- 11.4k
3
votes
Accepted
Custom IDA Decompilation Format
Not possible, either through a configuration option or through a plugin. For example, here is the part of the code that prints the [rbp-1Fh] from your example:
qsnprintf(v16, v36 - v16, "[%s%c%ah]...
- 7,814
3
votes
How to load a color theme correctly in IDAPro?
I think you're talking about changing the appearance of Qt widgets and not only IDA widgets. If so, take a look at zyantific/IDASkins python plugin.
There're also plugins in C++ if you prefer it.
- 1,074
3
votes
Use idapython to print register or memory value when the debugger is running
Create two Python-functions (menu File-Script command...). First for printing EAX and second - for printing memory @FF27790
def view_ecx():
print GetRegValue("ecx")
def view_memory():
print ...
- 171
3
votes
How to identify base64 encode/decode in assembly
The common base64 key contains ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/. However, remember that IDA Pro will convert ASCII text for you, so you should have no reason to go ...
- 1,625
3
votes
Accepted
Removing empty blocks ida api
That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
- 7,814
2
votes
Accepted
Can't find debugger in IDA PRO menu
IDA does not support debugging .NET binaries or more specifically the CIL bytecode. To debug managed code you can use WinDbg with the SOS debugging extension (SOS.dll).
You can also use dnSpy which ...
- 5,850
2
votes
Names not populating from disassembly to decompiler
If you rename things outside of pseudocode view, it’s not updated automatically and you need to press F5to refresh decompilation with current data.
- 34.7k
2
votes
Find functions signatures in Ida?
IDA works with FLIRT (Fast Library Identification and Recognition Technology) signatures. These “signatures” are basically sequences of assembly instructions that are found in functions. IDA has built-...
- 822
2
votes
Accepted
How to parse the NT headers and section headers of a PE file using IDApython?
The PE header area is not loaded into the database by default but you can do it by enabling “manual load” in the initial load dialog. However, the copy of the header is saved in the database and can ...
- 34.7k
2
votes
Try to parse buffer as PE with IDAPython
After some research time, I found a way to do it in CPP but not in python.
https://github.com/SentineLabs/Memloader/blob/main/MemoryLoader/MemoryLoader/MemoryLoader.cpp
The most relevant part of the ...
- 39
2
votes
Identify APIs inside functions
I am not sure about a plugin. But, this answer gives an IDC script for similar purpose.
I also wrote a script to get called function graph a long time ago. You can leverage this and tweak this ...
- 1,437
2
votes
IDA plugin with visual studio c++ 2019
For decades, IDA's plugin interface remained the same. Your plugin had to export a plugin_t structure named PLUGIN, which contained function pointers to its init, run, and optional term functions. You ...
- 7,814
2
votes
Accepted
IDA PRO Hex-Rays try-catch
I've considered doing this myself, but it's tricky for many reasons.
First, exception internals are not standardized across languages, platforms, or implementations. 64-bit Windows programs use a data-...
- 7,814
1
vote
Accepted
Identify APIs inside functions
To have an overview of called API in a function you can use Graph feature without pluging :
select function
click on menu View > Graphs > Users xrefs chart...
in Starting Direction check only ...
- 66
1
vote
Failed to load IDA PLW plugin
IDA 7.0 is a 64-bit program and cannot load 32-bit PLW files. The plug-in needs to be ported and recompiled for the new API:
https://www.hex-rays.com/products/ida/news/7_0/docs/api70_porting_guide/
- 34.7k
1
vote
How to parse the NT headers and section headers of a PE file using IDApython?
And if you ever feel the need to do it manually or in an environment other than IDA, you might find this useful.
class AttrDict(dict):
def __init__(self, *args, **kwargs):
super(AttrDict, ...
- 281
1
vote
Accepted
How to parse the IAT using IDApython?
There’s no built-in functionality for that, it’s too target-specific to be useful as standard API. What you can do is to retrieve the list of exports and/or imports for the file which was used to ...
- 34.7k
1
vote
Accepted
Get a networkx graph from the the function call-graph of the file using IDApython?
You can generate graphs in the DOT format by calling gen_flow_graph() with the CHART_GEN_DOT flag.
The DOT file can then be imported into networkx using the from_pydot() function.
- 34.7k
1
vote
Accepted
Get current file name with IDApython
You can use get_input_file_path() IDC function and then extract the file name from it.
It's also available in IDAPython as ida_nalt.get_input_file_path (source).
- 3,189
1
vote
Getting function arguments in ida
Okay that's our sample code:
.text:0000000180002953 lea rcx, aSmiGetplatform ; "SMI_GetPlatformInfo"
.text:000000018000295A mov r12b, 0FFh
.text:...
- 148
1
vote
Getting function arguments in ida
I have found out that if in the disassembler you give the type to the function that is being called, then the ida python function will work as it should.
- 21
1
vote
Using Python 3.7 and 2.x in same IDA
You can't use Python 3 and Python 2 in IDA simultaneously, but you can switch between them by following instructions in README_python3.txt.
- 34.7k
1
vote
Find all syscall in statically Arm Binary
In ARM the syscalls are either Supervisor call or Software interrupt.
You can just search->text in IDA for:
SVC 0x
SWI 0x
- 1,748
1
vote
Extracting instruction and operand information in IDA Python
I also had this question. The only solution I've found involves using the Capstone Python bindings in conjunction with IDA. The method call is regs_access https://www.capstone-engine.org/op_access....
- 31
1
vote
How to call WinApi from a breakpoint in IDA Pro?
Your Python code executes inside IDA’s process so you are getting results of the call on IDA, not the debuggee. If you want to execute code inside the process being debugged, you can use Appcall: http:...
- 34.7k
Only top scored, non community-wiki answers of a minimum length are eligible