15 votes
Accepted

Extracting arguments from IDA

I received an answer from HexRays support which has a solution which does not rely on parsing the C string retrieved by GetType(ea). Let's imagine we start with a function prototype: int __cdecl ...
user avatar
  • 2,279
11 votes
Accepted

How to get imge base of current setting through script in IDA pro?

idaapi.get_imagebase() is your friend. Just in case you didn't know, all the reference documentation for idapython is here Example: Python>hex(idaapi.get_imagebase()) 0x100000L
user avatar
  • 7,720
11 votes
Accepted

Good training for IDAPython

I wrote Sark to avoid this banging-head-against-wall routine. It provides wrappers around most of the commonly-used IDAPython APIs, making them more pythonic. You can find the documentation for Sark ...
user avatar
  • 1,479
11 votes
Accepted

How is IDAPython API structured?

A bit of history: (aka an aging guy blabbering about) In the old days, we didn't have python in IDA and when an individual wanted to develop an IDA plugin he had to implement it in C and use the SDK ...
user avatar
  • 11.4k
9 votes
Accepted

Is there a way to set the cursor address in IDA Pro?

Use Jump for IDC or idc.Jump for ida python.
user avatar
  • 5,850
8 votes
Accepted

IDAPython: Get struct id defined at an address

This works for me: ea=here() ti = idaapi.opinfo_t() f = idc.GetFlags(ea) if idaapi.get_opinfo(ea, 0, f, ti): print ("tid=%08x - %s" % (ti.tid, idaapi.get_struc_name(ti.tid))) So ti.tid then ...
user avatar
8 votes

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

if adding an extra import section to the PE file is an acceptable option use tools like iidking and add an import section with all the imports that are resolved dynamically use add cross ...
user avatar
  • 14.9k
8 votes
Accepted

How to get the CPU architecture via Idapython?

You can get the name of the processor from the idainfo struct: import idaapi info = idaapi.get_inf_structure() if info.is_64bit(): bits = 64 elif info.is_32bit(): bits = 32 else: bits = ...
user avatar
  • 1,479
8 votes
Accepted

How can I set breakpoint and get value of a register with IDApython

I can think of two methods to achieve this: Using RunTo. Setting a breakpoint, hooking debugger events and implementing dbg_bpt 1. Using RunTo This is nearly trivial to do, but does not give the ...
user avatar
  • 11.4k
8 votes
Accepted

idapython - Determine if item is code or data

IDA utilizes flags for checking the properties of locations. Looking at the API you can use GetFlags(ea) and pass its output to isCode(flags) to check if a location is flagged as being code. You can ...
user avatar
  • 2,826
8 votes
Accepted

Using IDA Python Iterate Through All Functions and Their Instructions

Please note that it will print only those functions that were recognized as such by IDA autoanalysis or defined manually, exactly as your code snippet. This snippet is not debugged, use on your own ...
user avatar
  • 7,720
7 votes

idapython find functions that contain a loop

There is an IDA plugin called Loop Detection that does that, it comes with source code and a paper explaining how it works. Have a look at loop_detection.cpp and refer to the paper for an explanation ...
user avatar
  • 2,168
7 votes
Accepted

Can I invoke IDA's plugin BinDiff from command line?

You can try the following steps: convert binary file to IDB: $IDA_PATH\\idaq.exe -B -p+ $FILE_TO_CONVERT create BinExport from idb $IDA_PATH\\idaq.exe -A -SC:\\bindiff_export.idc where ...
user avatar
  • 416
7 votes
Accepted

Idapython: How to get the opcode bytes corresponding to an instruction?

Another solution: ea = ScreenEA() # Or whatever you want buf = idc.GetManyBytes(ea, ItemSize(ea))
user avatar
  • 4,315
7 votes
Accepted

How to get cross-references to a struct type in IDA by IDAPython and add comments to variables of the struct type

Stack Variable References The xrefs you are showing are xrefs from stack variables. As you mentioned, when trying to get the xrefs to the struct, you get two types of results: Valid addresses, which ...
user avatar
  • 1,479
7 votes
Accepted

idapython - Get Xrefs to a stack variable

There is one function that does this: build_stkvar_xrefs, defined in C++ but exposed via the Python SWIG bindings. IDA builds stack xrefs dynamically when you ask for it. In order to use the function, ...
user avatar
6 votes

IDAPro, the arguments could not be passed to the python script

Roughly three years have passed and this relatively simple question still lacks a proper answer. Encountering the same issue today using IDA 7.0, I might as well spend the time providing a proper ...
user avatar
  • 11.4k
6 votes
Accepted

A wiki for IDA?

I just created a wikia for IDA Pro. Do add your contributions there! :) I'll also be adding some info every now and then. It is a community wiki, so please do no evil! =P
user avatar
  • 1,253
6 votes
Accepted

IDA Pro: Side effects or disadvantages of "Create function"

Depends on what you would call a disadvantage. This kind of code-relict often results from a function that's present in source code, but doesn't ever get called*, so IDA didn't assign a name to it. If ...
user avatar
6 votes

Can I expand the view of a structure in IDAPython?

Put the text cursor somewhere between the < and > and press + on the numeric keypad.
user avatar
  • 161
6 votes

How can I step through instructions in IDA and know the current EIP?

The valid answer to this problem is in the fact that python script and the debugger execution flows perform asynchornously. So each time we ask the debugger to do a step_into(), we also need to wait ...
user avatar
6 votes
Accepted

IDA: Generic approach to determine if an instruction reads from, or writes to, memory?

While the API may be cumbersome, most of the information you are looking for is "readily" available from IDA during static analysis. Some of it is somewhat generic, while other pieces ...
user avatar
  • 1,479
6 votes
Accepted

Get a list of global variables with IDA python

Although Sark is a good library/tool, if you're only looking for a small utility script you might want to avoid the overhead of installing it. I do recommend you give it a try regardless. The ...
user avatar
  • 11.4k
6 votes

Is it possible to get a list of user-defined names in IDA?

The idautils.Names function might be of interest to you, as it returns a list of (ea, name) tuples for all names defined in the IDB and the ea at which they're located. Additionally, you can use the ...
user avatar
  • 11.4k
6 votes
Accepted

How can I extract the structure of an operand with displacement in IDAPython?

There doesn't seem to be an elegant solution to this. Looks like if you would be writing a plugin in C you would be able to call sib_base, sib_index, sib_scale to get the info. Here's how you could ...
user avatar
  • 516
6 votes

idapython - Get Xrefs to a stack variable

TL;DR: There's no simple API to achieve this, code is at the end of the answer or here. As far as I know, there is no easy way to get the references to stack structure. It seems like calling idautils....
user avatar
  • 11.4k
6 votes
Accepted

IDAPython: How to get function argument values

Answering my own question: I sent an email to Hex-Rays and got back the answer in like minutes. The answer is using idaapi.get_arg_addrs(). For example, given the following code: LOAD:...
user avatar
  • 4,315
5 votes
Accepted

Making operand an offset in IDA Python

I've been using the Ida OpOff function for that. That was idc, not idapython, but https://www.hex-rays.com/products/ida/support/idapython_docs/idc-module.html#OpOff says there's OpOff in idapython as ...
user avatar
5 votes

Idapython - undefining an instruction

Here is a POC from some code I wrote a while back. def fixTheJmpCalls(): # kind of slow to loop through all the functions and instructions but it works # flaw: only defined functions will ...
user avatar
  • 1,052
5 votes

In IDA, is there a way to add a reference to a dynamically imported function into the Imports tab?

If you can not add something to the imports viewer you can write your own. Here is the simple example (it is slightly modified example referenced at this hexblog entry and located here with added ...
user avatar
  • 7,720

Only top scored, non community-wiki answers of a minimum length are eligible