15

I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea). Let's imagine we start with a function prototype: int __cdecl main(int argc, const char **argv, const char **envp) That's from an ELF file, x86 abi; stuff is passed on the stack. Then, I can do the following: Python>...


11

idaapi.get_imagebase() is your friend. Just in case you didn't know, all the reference documentation for idapython is here Example: Python>hex(idaapi.get_imagebase()) 0x100000L


11

I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic. You can find the documentation for Sark here on Read-The-Docs. As mentioned before by @CrazyFrog, you can use: Alexander Hanel's book and blog; Ero Carrera's Intro to IDAPyton; Additionally, there ...


10

A bit of history: (aka an aging guy blabbering about) In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK available from hex-ray's download center using credentials received when you purchase an IDA license. We did have, however, IDC. IDC is IDA's old, proprietary ...


9

Use Jump for IDC or idc.Jump for ida python.


8

if adding an extra import section to the PE file is an acceptable option use tools like iidking and add an import section with all the imports that are resolved dynamically use add cross referances dialog or idc add_dref() to add cross references to them code for demo #include <stdio.h> #include <windows.h> #pragma comment(lib , "...


8

You can get the name of the processor from the idainfo struct: import idaapi info = idaapi.get_inf_structure() if info.is_64bit(): bits = 64 elif info.is_32bit(): bits = 32 else: bits = 16 try: is_be = info.is_be() except: is_be = info.mf endian = "big" if is_be else "little" print 'Processor: {}, {}bit, {} endian'.format(info....


8

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can find the exact definitions of the flags in IDC.IDC. A small excerpt: #define isCode(F) ((F & MS_CLS) == FF_CODE) // is code byte? #define isData(F) ...


8

Please note that it will print only those functions that were recognized as such by IDA autoanalysis or defined manually, exactly as your code snippet. This snippet is not debugged, use on your own risk. from idautils import * from idaapi import * from idc import * for segea in Segments(): for funcea in Functions(segea, SegEnd(segea)): ...


7

This works for me: ea=here() ti = idaapi.opinfo_t() f = idc.GetFlags(ea) if idaapi.get_opinfo(ea, 0, f, ti): print ("tid=%08x - %s" % (ti.tid, idaapi.get_struc_name(ti.tid))) So ti.tid then contains the strid.


7

Many years ago I wrote a very crude script to dump the current (as defined by cursor location) function to the output window using mostly nasm compatible syntax. You could potentially modify to save output to a file and iterate over every function in your database. The script is available here: nasm dumper


7

There is an IDA plugin called Loop Detection that does that, it comes with source code and a paper explaining how it works. Have a look at loop_detection.cpp and refer to the paper for an explanation of how it works. Plugin with source code : http://www.openrce.org/downloads/details/9/Loop_Detection Paper: http://www.uninformed.org/?v=1&a=2&t=pdf ...


7

You can try the following steps: convert binary file to IDB: $IDA_PATH\\idaq.exe -B -p+ $FILE_TO_CONVERT create BinExport from idb $IDA_PATH\\idaq.exe -A -SC:\\bindiff_export.idc where bindiff_export.idc looks like: #include <idc.idc> static main() { Batch(0); Wait(); Exit( 1 - RunPlugin("zynamics_binexport_5", 2 )); } Should you ...


7

Another solution: ea = ScreenEA() # Or whatever you want buf = idc.GetManyBytes(ea, ItemSize(ea))


7

Stack Variable References The xrefs you are showing are xrefs from stack variables. As you mentioned, when trying to get the xrefs to the struct, you get two types of results: Valid addresses, which are struct instances in the data section 0xFF000000 and above addresses, where the struct is used as a stack variable. In IDA the stack variables for a ...


7

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the same amount of control as the second approach. It might be better for quick and dirty type of solutions, if that's what you're after. Calling idc.RunTo(ea) will ...


6

Here it is. Run it with idal -c -A -S./script.py ./test.bin # I didn't check this code, please use carefully ! # IDAPython documentation is at https://www.hex-rays.com/products/ida/support/idapython_docs/ import idautils import idc for ea in idautils.Segments(): segend = idc.GetSegmentAttr(ea, idc.SEGATTR_END) start = ea while start < ...


6

Finding Byte Strings using IDAPython ASERT MindshaRE solves this right. No need to actually run the code which isn't always possible. Effectively this script will go through instruction by instruction to find moves of ASCII characters into a memory location. It gets fancy and used QT to create an interactive table however you can gut out that part and just ...


6

I just created a wikia for IDA Pro. Do add your contributions there! :) I'll also be adding some info every now and then. It is a community wiki, so please do no evil! =P


6

Depends on what you would call a disadvantage. This kind of code-relict often results from a function that's present in source code, but doesn't ever get called*, so IDA didn't assign a name to it. If this is the case, you: generally don't want to include the function in your analysis, because the program never uses it anyways can search for a longer ...


6

Put the text cursor somewhere between the < and > and press + on the numeric keypad.


6

The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait for this process to end. This can be done by inserting GetDebuggerEvent(WFNE_SUSP, -1) after step_into import idaapi x=0 while x<10: idaapi.step_into() ...


6

Although Sark is a good library/tool, if you're only looking for a small utility script you might want to avoid the overhead of installing it. I do recommend you give it a try regardless. The following code will do just that without using any third party code: # get segment start and end EA by name idata_seg_selector = idc.SegByName('.data') ...


6

The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located. Additionally, you can use the answer to the question Igor linked (Get a list of global variables with IDA python) to get a list of all functions. Once you have the eas you can do the ...


6

There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call sib_base, sib_index, sib_scale to get the info. Here's how you could do it in Python. from idautils import DecodeInstruction from idaapi import get_reg_name ea = 0x20AC5 # Assuming this ea is a lea i = DecodeInstruction(ea) ...


6

TL;DR: There's no simple API to achieve this, code is at the end of the answer or here. As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils.XrefsTo(sid) where sid is the frame id (retrieved using idc.GetFrame) should work, however I couldn't get it to yield any result in my attempts. Instead, ...


6

There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, it requires a little bit of setup. You'll need to use a few functions to get what you need: get_func(ea): retrieves the func_t structure for the function at ...


5

If you can not add something to the imports viewer you can write your own. Here is the simple example (it is slightly modified example referenced at this hexblog entry and located here with added double-click functionality, added columns, removed exports and fixed bug for a case of unknown origin of the imported function). See the function BuildImports for ...


5

Here is a POC from some code I wrote a while back. def fixTheJmpCalls(): # kind of slow to loop through all the functions and instructions but it works # flaw: only defined functions will be traversed.this. for funcea in Functions( SegStart( here() ), SegEnd( here() ) ): for eai in FuncItems(funcea): if GetMnem(eai) == "...


5

I've been using the Ida OpOff function for that. That was idc, not idapython, but https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#OpOff says there's OpOff in idapython as well. In addition, there's another function, OpOffEx, that lets you specify more details. I think one of those is what you need.


Only top voted, non community-wiki answers of a minimum length are eligible