11 votes
Accepted

How is IDAPython API structured?

A bit of history: (aka an aging guy blabbering about) In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK ...
user avatar
  • 11.4k
7 votes
Accepted

idapython - Get Xrefs to a stack variable

There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
user avatar
7 votes
Accepted

Idapython: How to get the opcode bytes corresponding to an instruction?

Another solution: ea = ScreenEA() # Or whatever you want buf = idc.GetManyBytes(ea, ItemSize(ea))
user avatar
  • 4,325
6 votes
Accepted

A wiki for IDA?

I just created a wikia for IDA Pro. Do add your contributions there! :) I'll also be adding some info every now and then. It is a community wiki, so please do no evil! =P
user avatar
  • 1,253
6 votes

idapython - Get Xrefs to a stack variable

TL;DR: There's no simple API to achieve this, code is at the end of the answer or here. As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
user avatar
  • 11.4k
6 votes
Accepted

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

While the API may be cumbersome, most of the information you are looking for is "readily" available from IDA during static analysis. Some of it is somewhat generic, while other pieces ...
user avatar
  • 1,479
5 votes
Accepted

How to decompile with Hex Rays via a Python API?

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
user avatar
  • 8,659
4 votes

IDA SDK Extract Offset From Instruction

Elaborating on existing answers, if you prefer to use IDAPython: decode_insn(here()) print hex(cmd.Op1.addr)
user avatar
4 votes
Accepted

IDA basic block type fcb_cndret - what does it mean?

I don't know it either so I put together this small script in order to do some empirical analysis. import idaapi import idc import idautils for f in Functions(): fc = idaapi.FlowChart(idaapi....
user avatar
4 votes
Accepted

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

Short answer is that both idaapi and idc modules should be avoided if possible. The idaapi module is there for backwards compatibility and should be avoided if possible. It will be dropped in a ...
user avatar
  • 11.4k
3 votes

How can I call IDA Pro's MakeCode for one instruction at a time?

NirIzr's answer has a major drawback: All those locations following the decoded instructions are still added to the analyzer queue, they're just not being processed. That means if you ever enable ...
user avatar
3 votes
Accepted

How can I call IDA Pro's MakeCode for one instruction at a time?

This is a bit of a tricky question, because technically MakeCode is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that MakeCode actually returns the ...
user avatar
  • 11.4k
3 votes

How to get the file format via Idapython?

There is an IDApython function that provides what you're after. It's called idaapi.get_file_type_name() and it will return the same string displayed in the "Load a new file" dialog: Additionally, ...
user avatar
  • 11.4k
3 votes
Accepted

How can I force-update IDA's action_handler_t object's state?

The update methods of actions are usually called when the relevant GUI components (usually various IDA views) are refreshed. To make things speedier, IDA avoids refreshing views until such a refresh ...
user avatar
  • 1,479
3 votes
Accepted

Attaching debugger to process IDA Pro privilege problem

AFAIK you cannot debug a 64 bit application locally with IDA Pro. You need to use remote debugging. See this page: https://www.hex-rays.com/products/ida/debugger/#details and this: https://www.hex-...
user avatar
  • 5,860
3 votes

Compiling plugins for use with IDA 5.0 free?

I found the reason why the plugin didn't work: the PLUGIN symbol wasn't exported from the dll (.plw). In headers prior to version 5.1 the symbol isn't declared __declspec(dllexport), meaning it has ...
user avatar
  • 1,960
3 votes
Accepted

Unload plugin without closing the .IDB?

Currently I'm working around that by having PLUGIN_KEEP set upon load but patching PLUGIN_UNL into PLUGIN.flags This is not a "workaround" but actually a documented way to have IDA unload your ...
user avatar
  • 34.9k
3 votes

IDA Pro Renaming Imports

Before you dump the process's memory to disk, use a tool like Scylla to reconstruct the Import Table.
user avatar
3 votes
Accepted

Ida Plugin Batch analysis issue.

Have you tried manually loading the Hex-Rays plugin before loading your plugin? For example: #include <idc.idc> static main() { Wait(); Message("Hello world from IDC!\n"); ...
user avatar
3 votes
Accepted

IDA SDK - Rename Variable permanently

Solution is very simple: get pointer to pseudoview vdui_t * vuu= open_pseudocode(func->startEA, 0); Get Pointer to variables lvars_t& lvars = *pFunction->get_lvars(); Simply rename variable ...
user avatar
3 votes

What's happening in the assembly main function?

the disassembly You posted for sub 401000 is incomplete this is a limited explanation it checks the provided buffer (0x40A000 in the first call for the first null terminator ) and possibly ...
user avatar
  • 15k
3 votes

IDAPython, parse IDA DB as PE file

I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
user avatar
  • 31
3 votes
Accepted

Removing empty blocks ida api

That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
user avatar
  • 7,879
3 votes
Accepted

IDA API: obtain operand size prefix (x64)

Open up intel.hpp that ships with the SDK. The aux prefix flags are defined at the top; the one you're interested in is as follows: #define aux_natad 0x00001000 // addressing mode is not ...
user avatar
  • 7,879
2 votes

IDA SDK Extract Offset From Instruction

char szBuffer[MAXSTR]; ua_outop2( get_screen_ea( ), szBuffer, MAXSTR, 1 ); ea_t qword = cmd.Operands[1].addr;
user avatar
2 votes

IDA Pro Renaming Imports

While in debugger, select the import table and run idc\renimp.idc. Top comment from the file: /* Rename imports. This script renames entries of a dynamically built import table. For ...
user avatar
  • 34.9k
2 votes

How to Find All Switch Jump Tables in IDAPython

Decided to add a small code snippet to show how to iterate through the .text segment, obtaining all the switch table locations and storing the jump targets in a dictionary. text_seg = idaapi....
user avatar
  • 21
2 votes

Can I extract API call graph from IDA Pro to xml file?

No, you can't extract an IDA graph to the xml file. If you still want to use an external graph viewer, IDA supports two graph specification languages Graph Description Language and the D.O.T.
user avatar
  • 155
2 votes

IDA IDC Get memory reference in instruction

Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition. If you just want to log it to the console, the snippet I would use is: Message("__GetProcAddress = %08X\n", Dword(...
user avatar
  • 1,160
2 votes
Accepted

Check for multiple strings in IDAPython

You could use regular expression: idc.FindText(ea, idc.SEARCH_REGEX | idc.SEARCH_DOWN, y, x, "Bob|Alice") # ^^^^^^^^^^^^^^^^ ^ IDA Pro uses POSIX ERE ...
user avatar
  • 446

Only top scored, non community-wiki answers of a minimum length are eligible