11
votes
Accepted
How is IDAPython API structured?
A bit of history: (aka an aging guy blabbering about)
In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK ...
- 11.4k
7
votes
Accepted
idapython - Get Xrefs to a stack variable
There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
- 416
7
votes
Accepted
Idapython: How to get the opcode bytes corresponding to an instruction?
Another solution:
ea = ScreenEA() # Or whatever you want
buf = idc.GetManyBytes(ea, ItemSize(ea))
- 4,325
6
votes
Accepted
A wiki for IDA?
I just created a wikia for IDA Pro.
Do add your contributions there! :)
I'll also be adding some info every now and then.
It is a community wiki, so please do no evil! =P
- 1,253
6
votes
idapython - Get Xrefs to a stack variable
TL;DR: There's no simple API to achieve this, code is at the end of the answer or here.
As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
- 11.4k
6
votes
Accepted
IDA: Generic approach to determine if an instruction reads from, or writes to, memory?
While the API may be cumbersome, most of the information you are looking for is "readily" available from IDA during static analysis. Some of it is somewhat generic, while other pieces ...
- 1,479
5
votes
Accepted
How to decompile with Hex Rays via a Python API?
Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler.
Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
- 8,659
4
votes
IDA SDK Extract Offset From Instruction
Elaborating on existing answers, if you prefer to use IDAPython:
decode_insn(here())
print hex(cmd.Op1.addr)
- 991
4
votes
Accepted
IDA basic block type fcb_cndret - what does it mean?
I don't know it either so I put together this small script in order to do some empirical analysis.
import idaapi
import idc
import idautils
for f in Functions():
fc = idaapi.FlowChart(idaapi....
- 991
4
votes
Accepted
IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?
Short answer is that both idaapi and idc modules should be avoided if possible.
The idaapi module is there for backwards compatibility and should be avoided if possible. It will be dropped in a ...
- 11.4k
3
votes
How can I call IDA Pro's MakeCode for one instruction at a time?
NirIzr's answer has a major drawback: All those locations following the decoded instructions are still added to the analyzer queue, they're just not being processed. That means if you ever enable ...
- 161
3
votes
Accepted
How can I call IDA Pro's MakeCode for one instruction at a time?
This is a bit of a tricky question, because technically MakeCode is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that MakeCode actually returns the ...
- 11.4k
3
votes
How to get the file format via Idapython?
There is an IDApython function that provides what you're after.
It's called idaapi.get_file_type_name() and it will return the same string displayed in the "Load a new file" dialog:
Additionally, ...
- 11.4k
3
votes
Accepted
How can I force-update IDA's action_handler_t object's state?
The update methods of actions are usually called when the relevant GUI components (usually various IDA views) are refreshed. To make things speedier, IDA avoids refreshing views until such a refresh ...
- 1,479
3
votes
Accepted
Attaching debugger to process IDA Pro privilege problem
AFAIK you cannot debug a 64 bit application locally with IDA Pro.
You need to use remote debugging.
See this page: https://www.hex-rays.com/products/ida/debugger/#details
and this: https://www.hex-...
- 5,860
3
votes
Compiling plugins for use with IDA 5.0 free?
I found the reason why the plugin didn't work: the PLUGIN symbol wasn't exported from the dll (.plw).
In headers prior to version 5.1 the symbol isn't declared __declspec(dllexport), meaning it has ...
- 1,960
3
votes
Accepted
Unload plugin without closing the .IDB?
Currently I'm working around that by having PLUGIN_KEEP set upon load
but patching PLUGIN_UNL into PLUGIN.flags
This is not a "workaround" but actually a documented way to have IDA unload your ...
- 34.9k
3
votes
IDA Pro Renaming Imports
Before you dump the process's memory to disk, use a tool like Scylla to reconstruct the Import Table.
- 20.4k
3
votes
Accepted
Ida Plugin Batch analysis issue.
Have you tried manually loading the Hex-Rays plugin before loading your plugin?
For example:
#include <idc.idc>
static main() {
Wait();
Message("Hello world from IDC!\n");
...
- 20.4k
3
votes
Accepted
IDA SDK - Rename Variable permanently
Solution is very simple:
get pointer to pseudoview
vdui_t * vuu= open_pseudocode(func->startEA, 0);
Get Pointer to variables
lvars_t& lvars = *pFunction->get_lvars();
Simply rename variable
...
- 272
3
votes
What's happening in the assembly main function?
the disassembly You posted for sub 401000 is incomplete
this is a limited explanation
it checks the provided buffer (0x40A000 in the first call for the first null terminator )
and possibly ...
- 15k
3
votes
IDAPython, parse IDA DB as PE file
I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
- 31
3
votes
Accepted
Removing empty blocks ida api
That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
- 7,879
3
votes
Accepted
IDA API: obtain operand size prefix (x64)
Open up intel.hpp that ships with the SDK. The aux prefix flags are defined at the top; the one you're interested in is as follows:
#define aux_natad 0x00001000 // addressing mode is not ...
- 7,879
2
votes
IDA SDK Extract Offset From Instruction
char szBuffer[MAXSTR];
ua_outop2( get_screen_ea( ), szBuffer, MAXSTR, 1 );
ea_t qword = cmd.Operands[1].addr;
- 81
2
votes
IDA Pro Renaming Imports
While in debugger, select the import table and run idc\renimp.idc.
Top comment from the file:
/*
Rename imports.
This script renames entries of a dynamically built import table.
For ...
- 34.9k
2
votes
How to Find All Switch Jump Tables in IDAPython
Decided to add a small code snippet to show how to iterate through the .text segment, obtaining all the switch table locations and storing the jump targets in a dictionary.
text_seg = idaapi....
- 21
2
votes
Can I extract API call graph from IDA Pro to xml file?
No, you can't extract an IDA graph to the xml file.
If you still want to use an external graph viewer, IDA supports two graph specification languages Graph Description Language and the D.O.T.
- 155
2
votes
IDA IDC Get memory reference in instruction
Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition.
If you just want to log it to the console, the snippet I would use is:
Message("__GetProcAddress = %08X\n", Dword(...
- 1,160
2
votes
Accepted
Check for multiple strings in IDAPython
You could use regular expression:
idc.FindText(ea, idc.SEARCH_REGEX | idc.SEARCH_DOWN, y, x, "Bob|Alice")
# ^^^^^^^^^^^^^^^^ ^
IDA Pro uses POSIX ERE ...
- 446
Only top scored, non community-wiki answers of a minimum length are eligible