3 votes
Accepted

IDA API: obtain operand size prefix (x64)

Open up intel.hpp that ships with the SDK. The aux prefix flags are defined at the top; the one you're interested in is as follows: #define aux_natad 0x00001000 // addressing mode is not ...
user avatar
  • 7,879
3 votes
Accepted

API to force reanalyze of function (Alt-P)

ida_auto.auto_make_proc(addr) should do that.
user avatar
2 votes
Accepted

IDA Pro: unknown warnings

This message shows that you, or a script you run, is trying to create a struct with a name that already exists. Common IDAPython analysis scripts try to define known struct types found in the ...
user avatar
  • 832
2 votes
Accepted

idapython: type information with different prefixes

typeinf.hpp is the most complex header file in the IDA SDK. Although it's reasonably well-designed once you understand how to use it, there is likely to be a lot of difficulty in your near future. You ...
user avatar
  • 7,879
2 votes
Accepted

Functions and methods for working with AST tree

Hex-Rays’ version of AST is called “ctree”, so you can search for the term in hexrays.hpp to see what methods are available, as well as in the sample plugins and scripts.
user avatar
  • 34.9k
2 votes

How to create and change variables at address in IDA Python?

The methods I was looking for are: ida_bytes.create_data(and other create_ variations, such as create_byte) to create and change type of variables. ida_bytes.del_items to undefine variables. idc....
user avatar
  • 206
2 votes
Accepted

How to print the value for every member of a custom struct in IDA Pro? (In Decompiler mode the members go off screen)

Use Locals View in Debugger⇾Debugger Windows⇾Locals window.
user avatar
  • 398
2 votes
Accepted

Automatically propagate types in IDA pro when variables are assigned?

HexRaysPyTools has this feature, which it calls "recasting" (SHIFT-L, SHIFT-R). It's generally an excellent piece of software and I recommend it.
user avatar
  • 7,879
2 votes
Accepted

idapython: how to get decompiler output corresponding to the indirect call

This probably takes more code than it should but here's an approach that could work: The idea is to use the decompiled function's ctree to narrow down the pseudocode lines you care about. At a glance: ...
user avatar
  • 156
2 votes
Accepted

how to get indirect callsite function return type and arguments

Don't use regular expressions. Generally speaking, never use regular expressions to solve problems in IDA. All of the text you'd be operating upon is available as data via the API, which provides a ...
user avatar
  • 7,879
1 vote
Accepted

Renaming a local stack variable with IDAPython

I managed to write a function that is doing what I was looking for... sharing my code below: def rename_stack_variable(func_addr, var_name, new_var_name): func = idaapi.get_func(func_addr) ...
user avatar
1 vote
Accepted

How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?

To unload a type library you can use del_til function from typeinf.hpp. Usage with IDAPython: import ida_typeinf ida_typeinf.add_til("ntapi64_win7", ida_typeinf.ADDTIL_DEFAULT) # load a til ...
user avatar
  • 76
1 vote
Accepted

How do I enable Python on IDA 6.8?

Fixed it with the help of this page At the end of the day it was pointing to python 3.8 installation instead of Python 2.7 although both were installed on the machine python27.dll was not in the ...
user avatar
  • 146
1 vote

How to print disassembly code with IDAPython when IDA doesn’t detect it as code

Something like this should work: import ida_auto import ida_bytes def EnsureCode(ea): if ida_bytes.is_data(ida_bytes.get_flags(ea)): ida_bytes.del_items(ea,ida_bytes.DELIT_EXPAND) ...
user avatar
  • 7,879
1 vote

Is there a way to install Python 3 modules into IDAPython with pip?

Found the solution. Basically, IDAPython doesn't use my default system Python installation (in C:\Python10), instead it uses the one in %localappdata%\Programs\Python\Python310\. So all I had to do ...
user avatar
1 vote
Accepted

IDAPython - How can I read the value of a function argument? (IDA 7.6)

The way parameter pass is according x86 calling convention (32-bit program calling convention) that Robert said in the comment. You can see more detail from this answer: https://reverseengineering....
user avatar
  • 166
1 vote
Accepted

IDA: close without saving changes

Use set_database_flag(DBFL_KILL)
user avatar
  • 398
1 vote
Accepted

How can I get the byte size of an operand in IDA Pro?

Module ida_ua now contains a function get_dtype_size, which seems to implement @WHsT's answer. Assuming you have an instruction i, you can use it e.g. like this: ida_ua.get_dtype_size(i.Op1.dtype))
user avatar
  • 1,446
1 vote

Which python library for parsing Linux ELF files?

LIEF is a good choice for parsing ELF binaries. It's written in C++, but comes with proper Python bindings and is readily available via PyPi. Besides parsing ELF files it also supports Windows PE and ...
user avatar
1 vote

How to print custom name of an operand in IDA Python?

After doing a bunch of searches like operand, manual, manual operand on hex-rays's IDA Python docs website, I finally managed to find the appropriate APIs needed to achieve what I want. import ...
user avatar
1 vote

How to get function signature using IDA Python in IDA Pro

if you can use idc or adapt idc to python you can do some thing like this #include <idc.idc> static main() { auto funfirst,funnext,i = 0; funfirst = get_next_func( MinEA() ); while (...
user avatar
  • 15k
1 vote
Accepted

Can I get loaded pdb file path from IDAPython?

i just checked idafree 76 and i dont see an idc function to get the pdb file name but as i commented it is printed in the header you can copy paste it .text:0000000140001000 ; Alignment : default ....
user avatar
  • 15k
1 vote
Accepted

IDAPython: function parameters and return value

The return type is available in the rettype field of the func_type_data_t structure.
user avatar
  • 34.9k
1 vote

Analyze Arm Linux CPP binary in Ida Pro

as you mentioned in comments, you need to build class hierarchy or find vtables. Following are some projects that I know will help you in achieving what you would like. classinformer - https://...
user avatar
  • 1,447
1 vote

Find all x-ref with specific argument with IdaPython

As currently stated, there's no simple solution to such a general problem. Static analysis is quite a complex subject and there are no generic solutions that are available out of the box. A few basic ...
user avatar
  • 11.4k
1 vote

Get instruction by address with IDAPython

To get the full disassembly, you can use: GetDisasm(<address_of_instruction>) To get the instruction only, you can use: ida_ua.ua_mnem(<address_of_instruction>)
user avatar
1 vote

How to force IDA to analyze a function immediately?

ida_auto.auto_make_proc(addr) should do that
user avatar
1 vote

IDAPython: Is it possible to determine whether an instruction operand is a constant rather than a variable?

I believe you can look at the type of the operand with something like this (ideally with some more error and type checking): insn = idaapi.insn_t() idaapi.decode_insn(insn, ea) if insn.ops[0]....
user avatar
  • 11
1 vote
Accepted

BaseHTTPRequestHandler + ThreadingMixin = unclosed port

Some research into the atexit module provided a simple solution. Create a plugin purely to trigger the atexit handlers when it receives a term. import atexit import idc import ida_idaapi class ...
user avatar
1 vote

Undo step with IdaPython?

No. Only interactive user actions can be undone via the UI or keyboard shortcut.
user avatar
  • 34.9k

Only top scored, non community-wiki answers of a minimum length are eligible