15

I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea). Let's imagine we start with a function prototype: int __cdecl main(int argc, const char **argv, const char **envp) That's from an ELF file, x86 abi; stuff is passed on the stack. Then, I can do the following: Python>...


13

I don't know if many people know this, but IDA uses some kind of a trick to decide if a segment is an imports segment, and handles it completely different. IDA uses a few segment properties to treat a segment as an imports segment. for example, naming a segment .idata, or setting the segment's class to XTRN will immediately make it an imports segment. such ...


11

idaapi.get_imagebase() is your friend. Just in case you didn't know, all the reference documentation for idapython is here Example: Python>hex(idaapi.get_imagebase()) 0x100000L


11

I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic. You can find the documentation for Sark here on Read-The-Docs. As mentioned before by @CrazyFrog, you can use: Alexander Hanel's book and blog; Ero Carrera's Intro to IDAPyton; Additionally, there ...


10

A bit of history: (aka an aging guy blabbering about) In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK available from hex-ray's download center using credentials received when you purchase an IDA license. We did have, however, IDC. IDC is IDA's old, proprietary ...


9

While in the Text View of the disassembly window, press Alt + T. In the Text Search window, search for shl and check Find all occurrences: Press OK and you will get a list of all functions that contain shl:


9

Here's a rough implementation that scans the currently focused function for this pattern: call $+5 pop <reg> op <reg>, imm32 And changes it to mov <reg>, <computed imm32> nop nop Adapting it to scan different ranges and support more instructions is left as an exercise to the reader. def simplify(tgtEA): ins1 = tgtEA if not ...


8

While in IDA's Hex View you can go to Edit->Patch Program->Change Byte, but I think this only lets you patch 16 bytes at a time. If you need to patch more bytes than that you can use IDAPython's idc.PatchByte / idc.PatchWord / idc.PatchDword to change bytes in the IDA database. EDIT: Just a quick note, if you want your patches applied to the original file ...


8

When looking for functions, you should always check the SDK headers. These two are listed in loader.hpp: // Get offset in the input file which corresponds to the given ea // If the specified ea can't be mapped into the input file offset, // return -1. idaman int32 ida_export get_fileregion_offset(ea_t ea); // Get linear address which corresponds to ...


8

You can do this. Last summer I worked with Hexrays and WingIDE guys and got this working. In fact its in the docs! http://wingware.com/doc/howtos/idapython It rocks. Riley


8

if adding an extra import section to the PE file is an acceptable option use tools like iidking and add an import section with all the imports that are resolved dynamically use add cross referances dialog or idc add_dref() to add cross references to them code for demo #include <stdio.h> #include <windows.h> #pragma comment(lib , "...


8

You can get the name of the processor from the idainfo struct: import idaapi info = idaapi.get_inf_structure() if info.is_64bit(): bits = 64 elif info.is_32bit(): bits = 32 else: bits = 16 try: is_be = info.is_be() except: is_be = info.mf endian = "big" if is_be else "little" print 'Processor: {}, {}bit, {} endian'.format(info....


8

Use Jump for IDC or idc.Jump for ida python.


8

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can find the exact definitions of the flags in IDC.IDC. A small excerpt: #define isCode(F) ((F & MS_CLS) == FF_CODE) // is code byte? #define isData(F) ...


8

Please note that it will print only those functions that were recognized as such by IDA autoanalysis or defined manually, exactly as your code snippet. This snippet is not debugged, use on your own risk. from idautils import * from idaapi import * from idc import * for segea in Segments(): for funcea in Functions(segea, SegEnd(segea)): ...


7

Many years ago I wrote a very crude script to dump the current (as defined by cursor location) function to the output window using mostly nasm compatible syntax. You could potentially modify to save output to a file and iterate over every function in your database. The script is available here: nasm dumper


7

There is an IDA plugin called Loop Detection that does that, it comes with source code and a paper explaining how it works. Have a look at loop_detection.cpp and refer to the paper for an explanation of how it works. Plugin with source code : http://www.openrce.org/downloads/details/9/Loop_Detection Paper: http://www.uninformed.org/?v=1&a=2&t=pdf ...


7

You can try the following steps: convert binary file to IDB: $IDA_PATH\\idaq.exe -B -p+ $FILE_TO_CONVERT create BinExport from idb $IDA_PATH\\idaq.exe -A -SC:\\bindiff_export.idc where bindiff_export.idc looks like: #include <idc.idc> static main() { Batch(0); Wait(); Exit( 1 - RunPlugin("zynamics_binexport_5", 2 )); } Should you ...


7

Another solution: ea = ScreenEA() # Or whatever you want buf = idc.GetManyBytes(ea, ItemSize(ea))


7

Stack Variable References The xrefs you are showing are xrefs from stack variables. As you mentioned, when trying to get the xrefs to the struct, you get two types of results: Valid addresses, which are struct instances in the data section 0xFF000000 and above addresses, where the struct is used as a stack variable. In IDA the stack variables for a ...


6

Your best bet is to use IDAPython API to do this. To iterate trough all functions you could do something like from idautils import * from idaapi import * ea = BeginEA() for funcea in Functions(SegStart(ea), SegEnd(ea)): functionName = GetFunctionName(funcea) functionStart = "0x%08x"%funcea functionEnd = "0x%08x"%FindFuncEnd(funcea) # ... ...


6

Answering my own question so it's not marked as being opened. @DCoder's comment of using isAlign(idaapi.getFlags(ScreenEA())) is correct. .text:0040117B .text:0040117B locret_40117B: ; CODE XREF: sub_401160+Dj .text:0040117B retn .text:0040117B sub_401160 endp .text:0040117B .text:0040117B ; --------------------...


6

Finding Byte Strings using IDAPython ASERT MindshaRE solves this right. No need to actually run the code which isn't always possible. Effectively this script will go through instruction by instruction to find moves of ASCII characters into a memory location. It gets fancy and used QT to create an interactive table however you can gut out that part and just ...


6

Here it is. Run it with idal -c -A -S./script.py ./test.bin # I didn't check this code, please use carefully ! # IDAPython documentation is at https://www.hex-rays.com/products/ida/support/idapython_docs/ import idautils import idc for ea in idautils.Segments(): segend = idc.GetSegmentAttr(ea, idc.SEGATTR_END) start = ea while start < ...


6

This works for me: ea=here() ti = idaapi.opinfo_t() f = idc.GetFlags(ea) if idaapi.get_opinfo(ea, 0, f, ti): print ("tid=%08x - %s" % (ti.tid, idaapi.get_struc_name(ti.tid))) So ti.tid then contains the strid.


6

I just created a wikia for IDA Pro. Do add your contributions there! :) I'll also be adding some info every now and then. It is a community wiki, so please do no evil! =P


6

Depends on what you would call a disadvantage. This kind of code-relict often results from a function that's present in source code, but doesn't ever get called*, so IDA didn't assign a name to it. If this is the case, you: generally don't want to include the function in your analysis, because the program never uses it anyways can search for a longer ...


6

Put the text cursor somewhere between the < and > and press + on the numeric keypad.


6

The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait for this process to end. This can be done by inserting GetDebuggerEvent(WFNE_SUSP, -1) after step_into import idaapi x=0 while x<10: idaapi.step_into() ...


6

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the same amount of control as the second approach. It might be better for quick and dirty type of solutions, if that's what you're after. Calling idc.RunTo(ea) will ...


Only top voted, non community-wiki answers of a minimum length are eligible