16

As suggested by DCoder, I use the following helper class to efficiently resolve addresses to basic blocks: # Wrapper to operate on sorted basic blocks. class BBWrapper(object): def __init__(self, ea, bb): self.ea_ = ea self.bb_ = bb def get_bb(self): return self.bb_ def __lt__(self, other): return self.ea_ < other.ea_ # Creates a ...


15

I put this together quickly in the File > Python command... dialog: tgtEA = idaapi.askaddr(0, "Enter target address") if tgtEA is None: exit f = idaapi.get_func(tgtEA) if not f: print "No function at 0x%x" % (tgtEA) exit fc = idaapi.FlowChart(f) for block in fc: if block.startEA <= tgtEA: if block.endEA > tgtEA: print "0x%x is ...


14

I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea). Let's imagine we start with a function prototype: int __cdecl main(int argc, const char **argv, const char **envp) That's from an ELF file, x86 abi; stuff is passed on the stack. Then, I can do the following: Python>...


13

I don't know if many people know this, but IDA uses some kind of a trick to decide if a segment is an imports segment, and handles it completely different. IDA uses a few segment properties to treat a segment as an imports segment. for example, naming a segment .idata, or setting the segment's class to XTRN will immediately make it an imports segment. such ...


11

I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic. You can find the documentation for Sark here on Read-The-Docs. As mentioned before by @CrazyFrog, you can use: Alexander Hanel's book and blog; Ero Carrera's Intro to IDAPyton; Additionally, there ...


10

There are binary diffing plugins also that are very handy to analyse vulnerabilities: patchdiff2 and zynamics bindiff. They can help you analyse the patches that the binary had and very usefull to analyse i.e. why the application was vulnerable before the patch and how the vendor fixed it. Besides these two plugins for IDA there's DarunGrim, another ...


9

While in the Text View of the disassembly window, press Alt + T. In the Text Search window, search for shl and check Find all occurrences: Press OK and you will get a list of all functions that contain shl:


9

idaapi.get_imagebase() is your friend. Just in case you didn't know, all the reference documentation for idapython is here Example: Python>hex(idaapi.get_imagebase()) 0x100000L


9

A bit of history: (aka an aging guy blabbering about) In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK available from hex-ray's download center using credentials received when you purchase an IDA license. We did have, however, IDC. IDC is IDA's old, proprietary ...


8

You can do this. Last summer I worked with Hexrays and WingIDE guys and got this working. In fact its in the docs! http://wingware.com/doc/howtos/idapython It rocks. Riley


8

if adding an extra import section to the PE file is an acceptable option use tools like iidking and add an import section with all the imports that are resolved dynamically use add cross referances dialog or idc add_dref() to add cross references to them code for demo #include <stdio.h> #include <windows.h> #pragma comment(lib , "...


8

Here's a rough implementation that scans the currently focused function for this pattern: call $+5 pop <reg> op <reg>, imm32 And changes it to mov <reg>, <computed imm32> nop nop Adapting it to scan different ranges and support more instructions is left as an exercise to the reader. def simplify(tgtEA): ins1 = tgtEA if not ...


8

Here's a few I use regularly: Microsoft VC++ RTTI and EH parser scripts. There is a reimplementation as a plugin (but I haven't tried it). memcpy.idc from IDA's idc directory. Very simple but useful when dealing with firmwares that copy code around. renimp.idc when doing PE unpacking. Though recently it's been supplanted by UUNP's manual reconstruct ...


8

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can find the exact definitions of the flags in IDC.IDC. A small excerpt: #define isCode(F) ((F & MS_CLS) == FF_CODE) // is code byte? #define isData(F) ...


7

While in IDA's Hex View you can go to Edit->Patch Program->Change Byte, but I think this only lets you patch 16 bytes at a time. If you need to patch more bytes than that you can use IDAPython's idc.PatchByte / idc.PatchWord / idc.PatchDword to change bytes in the IDA database. EDIT: Just a quick note, if you want your patches applied to the original file ...


7

When looking for functions, you should always check the SDK headers. These two are listed in loader.hpp: // Get offset in the input file which corresponds to the given ea // If the specified ea can't be mapped into the input file offset, // return -1. idaman int32 ida_export get_fileregion_offset(ea_t ea); // Get linear address which corresponds to ...


7

This works for me: ea=here() ti = idaapi.opinfo_t() f = idc.GetFlags(ea) if idaapi.get_opinfo(ea, 0, f, ti): print ("tid=%08x - %s" % (ti.tid, idaapi.get_struc_name(ti.tid))) So ti.tid then contains the strid.


7

There is an IDA plugin called Loop Detection that does that, it comes with source code and a paper explaining how it works. Have a look at loop_detection.cpp and refer to the paper for an explanation of how it works. Plugin with source code : http://www.openrce.org/downloads/details/9/Loop_Detection Paper: http://www.uninformed.org/?v=1&a=2&t=pdf ...


7

You can try the following steps: convert binary file to IDB: $IDA_PATH\\idaq.exe -B -p+ $FILE_TO_CONVERT create BinExport from idb $IDA_PATH\\idaq.exe -A -SC:\\bindiff_export.idc where bindiff_export.idc looks like: #include <idc.idc> static main() { Batch(0); Wait(); Exit( 1 - RunPlugin("zynamics_binexport_5", 2 )); } Should you ...


7

You can get the name of the processor from the idainfo struct: import idaapi info = idaapi.get_inf_structure() if info.is_64bit(): bits = 64 elif info.is_32bit(): bits = 32 else: bits = 16 try: is_be = info.is_be() except: is_be = info.mf endian = "big" if is_be else "little" print 'Processor: {}, {}bit, {} endian'.format(info....


7

Use Jump for IDC or idc.Jump for ida python.


7

Another solution: ea = ScreenEA() # Or whatever you want buf = idc.GetManyBytes(ea, ItemSize(ea))


6

Finding Byte Strings using IDAPython ASERT MindshaRE solves this right. No need to actually run the code which isn't always possible. Effectively this script will go through instruction by instruction to find moves of ASCII characters into a memory location. It gets fancy and used QT to create an interactive table however you can gut out that part and just ...


6

Many years ago I wrote a very crude script to dump the current (as defined by cursor location) function to the output window using mostly nasm compatible syntax. You could potentially modify to save output to a file and iterate over every function in your database. The script is available here: nasm dumper


6

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later). This plugin can be used to : * Navigate to RPC functions in IDA * Analyze RPC function arguments * Understand ...


6

[Back in 2013] the decompiler did not have a scripting API. So you had these choices: Add necessary functions to IDC using a native plugin that calls the decompiler API. Use ctypes or similar to call the C++ API directly from Python. I posted a small PoC script doing it to the Hex-Rays forum a couple years ago. If you just want to have the decompiled text, ...


6

Your best bet is to use IDAPython API to do this. To iterate trough all functions you could do something like from idautils import * from idaapi import * ea = BeginEA() for funcea in Functions(SegStart(ea), SegEnd(ea)): functionName = GetFunctionName(funcea) functionStart = "0x%08x"%funcea functionEnd = "0x%08x"%FindFuncEnd(funcea) # ... ...


6

Answering my own question so it's not marked as being opened. @DCoder's comment of using isAlign(idaapi.getFlags(ScreenEA())) is correct. .text:0040117B .text:0040117B locret_40117B: ; CODE XREF: sub_401160+Dj .text:0040117B retn .text:0040117B sub_401160 endp .text:0040117B .text:0040117B ; --------------------...


6

Here it is. Run it with idal -c -A -S./script.py ./test.bin # I didn't check this code, please use carefully ! # IDAPython documentation is at https://www.hex-rays.com/products/ida/support/idapython_docs/ import idautils import idc for ea in idautils.Segments(): segend = idc.GetSegmentAttr(ea, idc.SEGATTR_END) start = ea while start < ...


6

I just created a wikia for IDA Pro. Do add your contributions there! :) I'll also be adding some info every now and then. It is a community wiki, so please do no evil! =P


Only top voted, non community-wiki answers of a minimum length are eligible