11
votes
Accepted
How is IDAPython API structured?
A bit of history: (aka an aging guy blabbering about)
In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK ...
- 11.8k
7
votes
Accepted
idapython - Get Xrefs to a stack variable
There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
- 436
6
votes
idapython - Get Xrefs to a stack variable
TL;DR: There's no simple API to achieve this, code is at the end of the answer or here.
As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
- 11.8k
5
votes
Accepted
How to decompile with Hex Rays via a Python API?
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
- 9,019
5
votes
Accepted
IDA: Demangled name simplification in idapython
idaapi.get_ea_name(ea, idaapi.GN_SHORT|idaapi.GN_DEMANGLED) seems to return the filtered demangled name.
- 36.9k
4
votes
Accepted
IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?
Short answer is that both idaapi and idc modules should be avoided if possible.
The idaapi module is there for backwards compatibility and should be avoided if possible. It will be dropped in a ...
- 11.8k
3
votes
IDAPython, parse IDA DB as PE file
I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
- 31
3
votes
What's happening in the assembly main function?
the disassembly You posted for sub 401000 is incomplete
this is a limited explanation
it checks the provided buffer (0x40A000 in the first call for the first null terminator )
and possibly ...
- 16.7k
3
votes
Accepted
Get current file name with IDApython
You can use get_input_file_path() IDC function and then extract the file name from it.
It's also available in IDAPython as ida_nalt.get_input_file_path (source).
- 3,419
3
votes
Accepted
IDA SDK - Rename Variable permanently
Solution is very simple:
get pointer to pseudoview
vdui_t * vuu= open_pseudocode(func->startEA, 0);
Get Pointer to variables
lvars_t& lvars = *pFunction->get_lvars();
Simply rename variable
...
- 272
3
votes
How can I call IDA Pro's MakeCode for one instruction at a time?
NirIzr's answer has a major drawback: All those locations following the decoded instructions are still added to the analyzer queue, they're just not being processed. That means if you ever enable ...
- 161
3
votes
Accepted
How can I call IDA Pro's MakeCode for one instruction at a time?
This is a bit of a tricky question, because technically MakeCode is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that MakeCode actually returns the ...
- 11.8k
3
votes
How to get the file format via Idapython?
There is an IDApython function that provides what you're after.
It's called idaapi.get_file_type_name() and it will return the same string displayed in the "Load a new file" dialog:
Additionally, ...
- 11.8k
3
votes
Accepted
Removing empty blocks ida api
That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
- 9,218
3
votes
Accepted
IDA API: obtain operand size prefix (x64)
Open up intel.hpp that ships with the SDK. The aux prefix flags are defined at the top; the one you're interested in is as follows:
#define aux_natad 0x00001000 // addressing mode is not ...
- 9,218
2
votes
IDA IDC Get memory reference in instruction
Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition.
If you just want to log it to the console, the snippet I would use is:
Message("__GetProcAddress = %08X\n", Dword(...
- 1,268
2
votes
How to decompile with Hex Rays via a Python API?
Well,there exist some examples at the idapython's github, see the idapyhton/examples/vds1.py,you can get a demo.
import idaapi
f=idaapi.get_func(ea)
cfunc=idaapi.decompile(f)
I have tried this on ...
- 31
2
votes
How to decompile with Hex Rays via a Python API?
It depends on IDA version you're using.
Version 7.0 (and AFAIR version 6.9) has ida_hexrays python module which has functions decompile and decompile_many.
If I remember it correctly the older IDA ...
- 8,538
2
votes
Accepted
IDA SDK: Event when database created / opened?
After looking around a bit more, I noticed that if I handle the following two processor module (HT_IDP) events, I can pretty much catch the moment I wanted:
processor_t::event_t::ev_newfile when a ...
- 1,103
2
votes
How to get closing message from IDA Pro?
Your plugin class can implement the term(self) method, which will be called when IDA unloads the plugin. Unloading a plugin might happen at different occasions depending on the value returned by your ...
- 11.8k
2
votes
Accepted
Can't find debugger in IDA PRO menu
IDA does not support debugging .NET binaries or more specifically the CIL bytecode. To debug managed code you can use WinDbg with the SOS debugging extension (SOS.dll).
You can also use dnSpy which ...
- 6,110
2
votes
Extracting instruction and operand information in IDA Python
I also had this question. The only solution I've found involves using the Capstone Python bindings in conjunction with IDA. The method call is regs_access https://www.capstone-engine.org/op_access....
- 41
2
votes
Names not populating from disassembly to decompiler
If you rename things outside of pseudocode view, it’s not updated automatically and you need to press F5to refresh decompilation with current data.
- 36.9k
2
votes
Get current file name with IDApython
There are three functions exposed by ida_nalt and two of those aliased from idc module.
idc.get_root_filename = ida_nalt.get_root_filename
Returns the file name only (no leading path elements; old ...
2
votes
Try to parse buffer as PE with IDAPython
After some research time, I found a way to do it in CPP but not in python.
https://github.com/SentineLabs/Memloader/blob/main/MemoryLoader/MemoryLoader/MemoryLoader.cpp
The most relevant part of the ...
- 39
2
votes
Import header files in IDA to get the struct definitions?
If you are using CLIthen do something like: ida_typeinf.idc_parse_types("filename.h", idc.PT_FILE). See this file for more options. Also check this link for GUI, they also explained how to ...
- 1,807
2
votes
IDA SDK - can't understand the output of displacement query functions?
Instruction encoding and decoding is one of the least user-friendly parts of the SDK. Since they have to support so many processor architectures with the same set of data types, they basically have to ...
- 9,218
2
votes
Accepted
Import header files in IDA to get the struct definitions?
You can parse a header using File > Load file > C header file or create a type library beforehand.
- 36.9k
2
votes
32 bit vs 64 bit IDA Pro
First, the IDA 32 will not load a 64 image, and the 64 will disassemble a 32 image, but the only difference is in the generated pseudocode, if you want to generate a pseudocode in C, you need to use ...
- 366
2
votes
Accepted
Is it possible to tap into IDAPython from within a (C) plugin? ... or at least use that Python instance?
You can register IDC functions from IDAPython plugins. See the %IDADIR%\python\examples\core\extend_idc.py for the following snippet:
from __future__ import print_function
import ida_expr
if ...
- 9,218
Only top scored, non community-wiki answers of a minimum length are eligible