11 votes
Accepted

How is IDAPython API structured?

A bit of history: (aka an aging guy blabbering about) In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK ...
NirIzr's user avatar
  • 11.8k
9 votes
Accepted

Using IDA Python Iterate Through All Functions and Their Instructions

Please note that it will print only those functions that were recognized as such by IDA autoanalysis or defined manually, exactly as your code snippet. This snippet is not debugged, use on your own ...
w s's user avatar
  • 8,478
8 votes
Accepted

Idapython: How to get the opcode bytes corresponding to an instruction?

Another solution: ea = ScreenEA() # Or whatever you want buf = idc.GetManyBytes(ea, ItemSize(ea))
joxeankoret's user avatar
  • 4,488
8 votes
Accepted

How can I set breakpoint and get value of a register with IDApython

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the ...
NirIzr's user avatar
  • 11.8k
8 votes
Accepted

idapython - Determine if item is code or data

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can ...
Nordwald's user avatar
  • 2,896
8 votes
Accepted

IDAPython: How to get function argument values

Answering my own question: I sent an email to Hex-Rays and got back the answer in like minutes. The answer is using idaapi.get_arg_addrs(). For example, given the following code: LOAD:...
joxeankoret's user avatar
  • 4,488
7 votes
Accepted

How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type

Stack Variable References The xrefs you are showing are xrefs from stack variables. As you mentioned, when trying to get the xrefs to the struct, you get two types of results: Valid addresses, which ...
tmr232's user avatar
  • 1,577
7 votes
Accepted

How can I extract the structure of an operand with displacement in IDAPython?

There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call sib_base, sib_index, sib_scale to get the info. Here's how you could ...
Bambu's user avatar
  • 556
7 votes
Accepted

idapython - Get Xrefs to a stack variable

There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
mayahustle's user avatar
6 votes
Accepted

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

While the API may be cumbersome, most of the information you are looking for is "readily" available from IDA during static analysis. Some of it is somewhat generic, while other pieces ...
tmr232's user avatar
  • 1,577
6 votes

IDAPro, the arguments could not be passed to the python script

Roughly three years have passed and this relatively simple question still lacks a proper answer. Encountering the same issue today using IDA 7.0, I might as well spend the time providing a proper ...
NirIzr's user avatar
  • 11.8k
6 votes
Accepted

idapython: getting a list of all segments

Try to use the Segments() from idautils. from idautils import * from idc import * from idaapi import * for ea in Segments(): print '%x-%x'%(SegStart(ea),SegEnd(ea))
ebux's user avatar
  • 1,759
6 votes

Open-source equivalent for FLIRT

There is radare2 tool and framework, written in pure C, as an embeddable and a portable library - almost all functionality available via C API and r2pipe API. There are options to support: FLIRT ...
Anton Kochkov's user avatar
6 votes
Accepted

Get a list of global variables with IDA python

Although Sark is a good library/tool, if you're only looking for a small utility script you might want to avoid the overhead of installing it. I do recommend you give it a try regardless. The ...
NirIzr's user avatar
  • 11.8k
6 votes

IDA python, list all imported functions

This code snippet was copied from https://github.com/idapython/src/blob/master/examples/core/list_imports.py """ summary: enumerate file imports description: Using the API to ...
w s's user avatar
  • 8,478
6 votes

Is it possible to get a list of user-defined names in IDA?

The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located. Additionally, you can use the ...
NirIzr's user avatar
  • 11.8k
6 votes

idapython - Get Xrefs to a stack variable

TL;DR: There's no simple API to achieve this, code is at the end of the answer or here. As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
NirIzr's user avatar
  • 11.8k
6 votes

How to search for Opcode 0xFF25 in IDA Pro?

It depends on what do you exactly mean by opcode (not in all possible targets it starts with the start of the instruction, and it can be placed weirdly enough in it). Sometimes, however, simple binary ...
w s's user avatar
  • 8,478
5 votes
Accepted

Adding a toolbar to IDA using PySide

New IDA 6.95 API Perhaps because they saw this question, maybe because of user requests, version 6.95 was released with two IDAPython API functions for creating a menu and a toolbar: create_menu and ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

How to get the list of strings within IDA's string window in my script?

It looks like that the following is what you are looking for or at least similar: import idautils sc = idautils.Strings() for s in sc: print "%x: len=%d type=%d -> '%s'" % (s.ea, s.length, s....
w s's user avatar
  • 8,478
5 votes
Accepted

Does IDAPython define any special environment variable?

I don't think there is directly, but there is a trick I've seen a few times (works with any dependency): try: import idc print 'ida' except Exception as e: print 'no ida' You may set a ...
Nordwald's user avatar
  • 2,896
5 votes
Accepted

How to get the disassembly line without offset translations in IDAPython?

Unfortunately, IDA's disassembly cannot be separated from it's data type information that is inherent to IDA (and is considered one of it's biggest advantages). You could, however, alter that ...
NirIzr's user avatar
  • 11.8k
5 votes
Accepted

How to decompile with Hex Rays via a Python API?

Yes. The newer versions of IDA has official bindings for the Hex-Rays decompiler. Originally, the Python bindings were written by EiNSTeiN around the Hex-Rays Decompiler SDK API. Later it has been ...
Megabeets's user avatar
  • 8,989
5 votes

IDA python, write to specific memory location

Byte(), Word() and Dword() are idapython's functions and every try to assign a value to a function call in python will end up with "SyntaxError: can't assign to function call". These 3 functions you ...
Megabeets's user avatar
  • 8,989
5 votes
Accepted

IDAPython set name of function using string passed to debug logging subfunction

Sounds like you probably want: idautils.CodeRefsTo with flow set to False to get all callers to the logging function ida_typeinf.get_arg_addrs to get the addresses, at some particular call site, of ...
Rolf Rolles's user avatar
  • 9,198
5 votes
Accepted

IDA: Demangled name simplification in idapython

idaapi.get_ea_name(ea, idaapi.GN_SHORT|idaapi.GN_DEMANGLED) seems to return the filtered demangled name.
Igor Skochinsky's user avatar
  • 36.6k
4 votes
Accepted

IDA Python - Find highlighted register

You can use idaapi.get_highlighted_identifier() This function returns highlighted text. All the IDAPython reference can be found at here, at Hex-Rays site
w s's user avatar
  • 8,478
4 votes
Accepted

Hex-Rays and IDA Python plugin loading order

When loading plugins, IDA goes through them alphabetically, and tries to load all the plugins. When loading a plugin, the loader check the plugin flags (idaapi.PLUGIN_PROC, idaapi.PLUGIN_FIX, and so ...
tmr232's user avatar
  • 1,577
4 votes
Accepted

Executing an IDAPython script with arguments within IDA Pro

Naturally, the best way would be editing the script and have it ask the user for those parameters. IDA has quite a few ways of doing that. You could use one or several of the many idc.Ask* functions. ...
NirIzr's user avatar
  • 11.8k
4 votes

Open-source equivalent for FLIRT

There is also Sibyl, an open-source tool based on Miasm2 that performs function divination.
W. Bruneau's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible