11 votes
Accepted

How is IDAPython API structured?

A bit of history: (aka an aging guy blabbering about) In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK ...
NirIzr's user avatar
  • 11.8k
8 votes
Accepted

Idapython: How to get the opcode bytes corresponding to an instruction?

Another solution: ea = ScreenEA() # Or whatever you want buf = idc.GetManyBytes(ea, ItemSize(ea))
joxeankoret's user avatar
  • 4,489
7 votes
Accepted

idapython - Get Xrefs to a stack variable

There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
mayahustle's user avatar
6 votes
Accepted

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

While the API may be cumbersome, most of the information you are looking for is "readily" available from IDA during static analysis. Some of it is somewhat generic, while other pieces ...
tmr232's user avatar
  • 1,567
6 votes

idapython - Get Xrefs to a stack variable

TL;DR: There's no simple API to achieve this, code is at the end of the answer or here. As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

How to decompile with Hex Rays via a Python API?

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
Megabeets's user avatar
  • 8,959
5 votes
Accepted

IDA: Demangled name simplification in idapython

idaapi.get_ea_name(ea, idaapi.GN_SHORT|idaapi.GN_DEMANGLED) seems to return the filtered demangled name.
Igor Skochinsky's user avatar
  • 36.5k
4 votes
Accepted

IDAPython modules: Prefer using idaapi or ida_*, and ignore idc completely?

Short answer is that both idaapi and idc modules should be avoided if possible. The idaapi module is there for backwards compatibility and should be avoided if possible. It will be dropped in a ...
NirIzr's user avatar
  • 11.8k
3 votes

What's happening in the assembly main function?

the disassembly You posted for sub 401000 is incomplete this is a limited explanation it checks the provided buffer (0x40A000 in the first call for the first null terminator ) and possibly ...
blabb's user avatar
  • 16.3k
3 votes
Accepted

IDA SDK - Rename Variable permanently

Solution is very simple: get pointer to pseudoview vdui_t * vuu= open_pseudocode(func->startEA, 0); Get Pointer to variables lvars_t& lvars = *pFunction->get_lvars(); Simply rename variable ...
LighFusion's user avatar
3 votes

How to get the file format via Idapython?

There is an IDApython function that provides what you're after. It's called idaapi.get_file_type_name() and it will return the same string displayed in the "Load a new file" dialog: Additionally, ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

How can I force-update IDA's action_handler_t object's state?

The update methods of actions are usually called when the relevant GUI components (usually various IDA views) are refreshed. To make things speedier, IDA avoids refreshing views until such a refresh ...
tmr232's user avatar
  • 1,567
3 votes
Accepted

Check for multiple strings in IDAPython

You could use regular expression: idc.FindText(ea, idc.SEARCH_REGEX | idc.SEARCH_DOWN, y, x, "Bob|Alice") # ^^^^^^^^^^^^^^^^ ^ IDA Pro uses POSIX ERE ...
kennytm's user avatar
  • 466
3 votes

How can I call IDA Pro's MakeCode for one instruction at a time?

NirIzr's answer has a major drawback: All those locations following the decoded instructions are still added to the analyzer queue, they're just not being processed. That means if you ever enable ...
user2347953's user avatar
3 votes
Accepted

How can I call IDA Pro's MakeCode for one instruction at a time?

This is a bit of a tricky question, because technically MakeCode is not what causing the rest of the code to be analyzed as code. A hint for that can be the fact that MakeCode actually returns the ...
NirIzr's user avatar
  • 11.8k
3 votes
Accepted

Get current file name with IDApython

You can use get_input_file_path() IDC function and then extract the file name from it. It's also available in IDAPython as ida_nalt.get_input_file_path (source).
bart1e's user avatar
  • 3,369
3 votes

IDAPython, parse IDA DB as PE file

I don't think IDA handle multiple PE instance, one of the solution I used in the past was to create a new segment, load the .text and ask IDA to decompile this segment.
Nyx__o's user avatar
  • 31
3 votes
Accepted

Removing empty blocks ida api

That function was renamed from bool remove_empty_blocks(void) to bool remove_empty_and_unreachable_blocks(void) as of Hex-Rays 7.6. Just change the name of the function you're trying to call.
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

IDA API: obtain operand size prefix (x64)

Open up intel.hpp that ships with the SDK. The aux prefix flags are defined at the top; the one you're interested in is as follows: #define aux_natad 0x00001000 // addressing mode is not ...
Rolf Rolles's user avatar
  • 9,198
2 votes

How to decompile with Hex Rays via a Python API?

Well,there exist some examples at the idapython's github, see the idapyhton/examples/vds1.py,you can get a demo. import idaapi f=idaapi.get_func(ea) cfunc=idaapi.decompile(f) I have tried this on ...
YaFeng  Luo's user avatar
2 votes

How to decompile with Hex Rays via a Python API?

It depends on IDA version you're using. Version 7.0 (and AFAIR version 6.9) has ida_hexrays python module which has functions decompile and decompile_many. If I remember it correctly the older IDA ...
w s's user avatar
  • 8,448
2 votes

IDA IDC Get memory reference in instruction

Put a breakpoint on that instruction. You can use IDC in the breakpoint's condition. If you just want to log it to the console, the snippet I would use is: Message("__GetProcAddress = %08X\n", Dword(...
Avery3R's user avatar
  • 1,248
2 votes

IDApython and IDA-decompiler commenting

The treeloc_t constructor does not accept an EA, and you need to specify the comment preciser: ea = idaapi.get_screen_ea() cfunc = idaapi.decompile(ea) tl = idaapi.treeloc_t() tl.ea = ea tl.itp = ...
Andrea Biondo's user avatar
2 votes

How to Find All Switch Jump Tables in IDAPython

Decided to add a small code snippet to show how to iterate through the .text segment, obtaining all the switch table locations and storing the jump targets in a dictionary. text_seg = idaapi....
chuazl's user avatar
  • 21
2 votes

Can I extract API call graph from IDA Pro to xml file?

No, you can't extract an IDA graph to the xml file. If you still want to use an external graph viewer, IDA supports two graph specification languages Graph Description Language and the D.O.T.
Roman Kiselenko's user avatar
2 votes

How to get closing message from IDA Pro?

Your plugin class can implement the term(self) method, which will be called when IDA unloads the plugin. Unloading a plugin might happen at different occasions depending on the value returned by your ...
NirIzr's user avatar
  • 11.8k
2 votes
Accepted

IDA SDK: Event when database created / opened?

After looking around a bit more, I noticed that if I handle the following two processor module (HT_IDP) events, I can pretty much catch the moment I wanted: processor_t::event_t::ev_newfile when a ...
Ray's user avatar
  • 1,083
2 votes
Accepted

Can't find debugger in IDA PRO menu

IDA does not support debugging .NET binaries or more specifically the CIL bytecode. To debug managed code you can use WinDbg with the SOS debugging extension (SOS.dll). You can also use dnSpy which ...
0xec's user avatar
  • 6,060
2 votes

Extracting instruction and operand information in IDA Python

I also had this question. The only solution I've found involves using the Capstone Python bindings in conjunction with IDA. The method call is regs_access https://www.capstone-engine.org/op_access....
Trey Keown's user avatar
2 votes

Names not populating from disassembly to decompiler

If you rename things outside of pseudocode view, it’s not updated automatically and you need to press F5to refresh decompilation with current data.
Igor Skochinsky's user avatar
  • 36.5k

Only top scored, non community-wiki answers of a minimum length are eligible