11
votes
Accepted
How is IDAPython API structured?
A bit of history: (aka an aging guy blabbering about)
In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK ...
- 11.7k
8
votes
Accepted
Idapython: How to get the opcode bytes corresponding to an instruction?
Another solution:
ea = ScreenEA() # Or whatever you want
buf = idc.GetManyBytes(ea, ItemSize(ea))
- 4,425
7
votes
Accepted
idapython - Get Xrefs to a stack variable
There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
- 426
6
votes
Accepted
IDA: Generic approach to determine if an instruction reads from, or writes to, memory?
While the API may be cumbersome, most of the information you are looking for is "readily" available from IDA during static analysis. Some of it is somewhat generic, while other pieces ...
- 1,557
6
votes
idapython - Get Xrefs to a stack variable
TL;DR: There's no simple API to achieve this, code is at the end of the answer or here.
As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
- 11.7k
5
votes
Accepted
How to decompile with Hex Rays via a Python API?
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
- 8,899
5
votes
Accepted
IDA: Demangled name simplification in idapython
idaapi.get_ea_name(ea, idaapi.GN_SHORT|idaapi.GN_DEMANGLED) seems to return the filtered demangled name.
- 36.2k
4
votes
Accepted
IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?
Short answer is that both idaapi and idc modules should be avoided if possible.
The idaapi module is there for backwards compatibility and should be avoided if possible. It will be dropped in a ...
- 11.7k
3
votes
What's happening in the assembly main function?
the disassembly You posted for sub 401000 is incomplete
this is a limited explanation
it checks the provided buffer (0x40A000 in the first call for the first null terminator )
and possibly ...
- 16.2k
3
votes
Accepted
IDA SDK - Rename Variable permanently
Solution is very simple:
get pointer to pseudoview
vdui_t * vuu= open_pseudocode(func->startEA, 0);
Get Pointer to variables
lvars_t& lvars = *pFunction->get_lvars();
Simply rename variable
...
- 272
3
votes
How can I call IDA Pro's MakeCode for one instruction at a time?
NirIzr's answer has a major drawback: All those locations following the decoded instructions are still added to the analyzer queue, they're just not being processed. That means if you ever enable ...
- 161
3
votes
Accepted
How can I call IDA Pro's MakeCode for one instruction at a time?
This is a bit of a tricky question, because technically MakeCode is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that MakeCode actually returns the ...
- 11.7k
3
votes
How to get the file format via Idapython?
There is an IDApython function that provides what you're after.
It's called idaapi.get_file_type_name() and it will return the same string displayed in the "Load a new file" dialog:
Additionally, ...
- 11.7k
3
votes
Accepted
How can I force-update IDA's action_handler_t object's state?
The update methods of actions are usually called when the relevant GUI components (usually various IDA views) are refreshed. To make things speedier, IDA avoids refreshing views until such a refresh ...
- 1,557
3
votes
Accepted
Attaching debugger to process IDA Pro privilege problem
AFAIK you cannot debug a 64 bit application locally with IDA Pro.
You need to use remote debugging.
See this page: https://www.hex-rays.com/products/ida/debugger/#details
and this: https://www.hex-...
- 6,030
3
votes
Accepted
Check for multiple strings in IDAPython
You could use regular expression:
idc.FindText(ea, idc.SEARCH_REGEX | idc.SEARCH_DOWN, y, x, "Bob|Alice")
# ^^^^^^^^^^^^^^^^ ^
IDA Pro uses POSIX ERE ...
- 456
3
votes
Accepted
Get current file name with IDApython
You can use get_input_file_path() IDC function and then extract the file name from it.
It's also available in IDAPython as ida_nalt.get_input_file_path (source).
- 3,369
3
votes
IDAPython, parse IDA DB as PE file
I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
- 31
3
votes
Accepted
Removing empty blocks ida api
That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
- 9,088
3
votes
Accepted
IDA API: obtain operand size prefix (x64)
Open up intel.hpp that ships with the SDK. The aux prefix flags are defined at the top; the one you're interested in is as follows:
#define aux_natad 0x00001000 // addressing mode is not ...
- 9,088
2
votes
IDA IDC Get memory reference in instruction
Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition.
If you just want to log it to the console, the snippet I would use is:
Message("__GetProcAddress = %08X\n", Dword(...
- 1,228
2
votes
IDApython and IDA-decompiler commenting
The treeloc_t constructor does not accept an EA, and you need to specify the comment preciser:
ea = idaapi.get_screen_ea()
cfunc = idaapi.decompile(ea)
tl = idaapi.treeloc_t()
tl.ea = ea
tl.itp = ...
- 430
2
votes
How to Find All Switch Jump Tables in IDAPython
Decided to add a small code snippet to show how to iterate through the .text segment, obtaining all the switch table locations and storing the jump targets in a dictionary.
text_seg = idaapi....
- 21
2
votes
Can I extract API call graph from IDA Pro to xml file?
No, you can't extract an IDA graph to the xml file.
If you still want to use an external graph viewer, IDA supports two graph specification languages Graph Description Language and the D.O.T.
- 155
2
votes
How to decompile with Hex Rays via a Python API?
Well,there exist some examples at the idapython's github, see the idapyhton/examples/vds1.py,you can get a demo.
import idaapi
f=idaapi.get_func(ea)
cfunc=idaapi.decompile(f)
I have tried this on ...
- 31
2
votes
How to decompile with Hex Rays via a Python API?
It depends on IDA version you're using.
Version 7.0 (and AFAIR version 6.9) has ida_hexrays python module which has functions decompile and decompile_many.
If I remember it correctly the older IDA ...
- 8,343
2
votes
Accepted
IDA SDK: Event when database created / opened?
After looking around a bit more, I noticed that if I handle the following two processor module (HT_IDP) events, I can pretty much catch the moment I wanted:
processor_t::event_t::ev_newfile when a ...
- 1,073
2
votes
How to get closing message from IDA Pro?
Your plugin class can implement the term(self) method, which will be called when IDA unloads the plugin. Unloading a plugin might happen at different occasions depending on the value returned by your ...
- 11.7k
2
votes
Accepted
Can't find debugger in IDA PRO menu
IDA does not support debugging .NET binaries or more specifically the CIL bytecode. To debug managed code you can use WinDbg with the SOS debugging extension (SOS.dll).
You can also use dnSpy which ...
- 6,030
2
votes
Extracting instruction and operand information in IDA Python
I also had this question. The only solution I've found involves using the Capstone Python bindings in conjunction with IDA. The method call is regs_access https://www.capstone-engine.org/op_access....
- 41
Only top scored, non community-wiki answers of a minimum length are eligible