12
votes
Accepted
Good training for IDAPython
I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic.
You can find the documentation for Sark ...
- 1,557
11
votes
Accepted
Is there a way to set the cursor address in IDA Pro?
Use Jump for IDC or idc.Jump for ida python.
- 6,040
11
votes
Accepted
How is IDAPython API structured?
A bit of history: (aka an aging guy blabbering about)
In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK ...
- 11.7k
9
votes
Accepted
Using IDA Python Iterate Through All Functions and Their Instructions
Please note that it will print only those functions that were recognized as such by IDA autoanalysis or defined manually, exactly as your code snippet. This snippet is not debugged, use on your own ...
- 8,408
8
votes
Accepted
How to get the CPU architecture via Idapython?
You can get the name of the processor from the idainfo struct:
import idaapi
info = idaapi.get_inf_structure()
if info.is_64bit():
bits = 64
elif info.is_32bit():
bits = 32
else:
bits = ...
- 1,557
8
votes
Accepted
Idapython: How to get the opcode bytes corresponding to an instruction?
Another solution:
ea = ScreenEA() # Or whatever you want
buf = idc.GetManyBytes(ea, ItemSize(ea))
- 4,470
8
votes
Accepted
How can I set breakpoint and get value of a register with IDApython
I can think of two methods to achieve this:
Using RunTo.
Setting a breakpoint, hooking debugger events and implementing dbg_bpt
1. Using RunTo
This is nearly trivial to do, but does not give the ...
- 11.7k
8
votes
Accepted
idapython - Determine if item is code or data
IDA utilizes flags for checking the properties of locations.
Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code.
You can ...
- 2,896
7
votes
Accepted
How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type
Stack Variable References
The xrefs you are showing are xrefs from stack variables. As you mentioned, when trying to get the xrefs to the struct, you get two types of results:
Valid addresses, which ...
- 1,557
7
votes
Accepted
How can I extract the structure of an operand with displacement in IDAPython?
There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call sib_base, sib_index, sib_scale to get the info.
Here's how you could ...
- 556
7
votes
Accepted
idapython - Get Xrefs to a stack variable
There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
- 436
7
votes
Accepted
IDAPython: How to get function argument values
Answering my own question: I sent an email to Hex-Rays and got back the answer in like minutes. The answer is using idaapi.get_arg_addrs().
For example, given the following code:
LOAD:...
- 4,470
6
votes
Can I expand the view of a structure in IDAPython?
Put the text cursor somewhere between the < and > and press + on the numeric keypad.
- 161
6
votes
IDAPro, the arguments could not be passed to the python script
Roughly three years have passed and this relatively simple question still lacks a proper answer. Encountering the same issue today using IDA 7.0, I might as well spend the time providing a proper ...
- 11.7k
6
votes
Good training for IDAPython
Check out "The Beginner's Guide to IDAPython" by Alexander Hanel and his blog
and this by Ero Carrera
- 367
6
votes
Accepted
IDA: Generic approach to determine if an instruction reads from, or writes to, memory?
While the API may be cumbersome, most of the information you are looking for is "readily" available from IDA during static analysis. Some of it is somewhat generic, while other pieces ...
- 1,557
6
votes
Accepted
idapython: getting a list of all segments
Try to use the Segments() from idautils.
from idautils import *
from idc import *
from idaapi import *
for ea in Segments():
print '%x-%x'%(SegStart(ea),SegEnd(ea))
- 1,759
6
votes
Open-source equivalent for FLIRT
There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API.
There are options to support:
FLIRT ...
- 696
6
votes
Accepted
Get a list of global variables with IDA python
Although Sark is a good library/tool, if you're only looking for a small utility script you might want to avoid the overhead of installing it. I do recommend you give it a try regardless.
The ...
- 11.7k
6
votes
Is it possible to get a list of user-defined names in IDA?
The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located.
Additionally, you can use the ...
- 11.7k
6
votes
idapython - Get Xrefs to a stack variable
TL;DR: There's no simple API to achieve this, code is at the end of the answer or here.
As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
- 11.7k
6
votes
How to search for Opcode 0xFF25 in IDA Pro?
It depends on what do you exactly mean by opcode (not in all possible targets it starts with the start of the instruction, and it can be placed weirdly enough in it). Sometimes, however, simple binary ...
- 8,408
5
votes
Automatically decode PUSH+RET call into JMP
I wrote a similar sort of script, while solving a crackme.
The binary in question obfuscated
call imm32
jmp imm32
instructions to
push imm32
xor dword ptr [esp], imm32
mov edx, imm32
xor ...
- 6,040
5
votes
Accepted
Adding a toolbar to IDA using PySide
New IDA 6.95 API
Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and ...
- 11.7k
5
votes
How can I step through instructions in IDA and know the current EIP?
The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait ...
- 61
5
votes
Accepted
How to automatically rename some IDA functions from a given list?
This way to automate things called IDAPython, its documentation is here:
1 - Save this script somewhere, remember where.
#Not used, not debbugged, not ran even once
#Use on your own risk, beware ...
- 8,408
5
votes
Accepted
How to get the list of strings within IDA's string window in my script?
It looks like that the following is what you are looking for or at least similar:
import idautils
sc = idautils.Strings()
for s in sc:
print "%x: len=%d type=%d -> '%s'" % (s.ea, s.length, s....
- 8,408
5
votes
IDA python, list all imported functions
This code snippet was copied from
https://github.com/idapython/src/blob/master/examples/ex_imports.py
# -----------------------------------------------------------------------
# This is an example ...
- 8,408
5
votes
Accepted
Does IDAPython define any special environment variable?
I don't think there is directly, but there is a trick I've seen a few times (works with any dependency):
try:
import idc
print 'ida'
except Exception as e:
print 'no ida'
You may set a ...
- 2,896
5
votes
Accepted
How to get the disassembly line without offset translations in IDAPython?
Unfortunately, IDA's disassembly cannot be separated from it's data type information that is inherent to IDA (and is considered one of it's biggest advantages).
You could, however, alter that ...
- 11.7k
Only top scored, non community-wiki answers of a minimum length are eligible