Skip to main content
3 votes

How to convert Unexplored data in IDA Pro to codeļ¼Ÿ

Using MakeCode function with idc or idaPython is completely OK, this function is exactly what you need. However (especially when analyzing malware) you can encounter the following problems: It may be ...
w s's user avatar
  • 8,508
2 votes
Accepted

Renaming a local stack variable with IDAPython

I managed to write a function that is doing what I was looking for... sharing my code below: def rename_stack_variable(func_addr, var_name, new_var_name): func = idaapi.get_func(func_addr) ...
rotem.salinas's user avatar
2 votes
Accepted

How to unload a type library (.til) programmatically (preferably using IDC, but IDAPython is fine, too)?

To unload a type library you can use del_til function from typeinf.hpp. Usage with IDAPython: import ida_typeinf ida_typeinf.add_til("ntapi64_win7", ida_typeinf.ADDTIL_DEFAULT) # load a til ...
y_v's user avatar
  • 86
2 votes
Accepted

How to have arrays in IDA's IDC

IDC is closer to C than C++ but both limited in some ways and more flexible in others than C. It supports several variable types but arrays is not one of them: A variable can contain: LONG: a 32-bit ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

How to get the current offset use IDC or IDAPython?

offset = idaapi.get_fileregion_offset(ea) ea = idaapi.get_fileregion_ea(offset) ref:How to extract the input file offset of a byte in idapython?
user6903's user avatar
  • 411
1 vote

Patch all calls to a single function using IDC

For IDC scripting you can use the patch_byte() function [1], perhaps you can try idapython [2]: import ida_bytes ea = 0x41414141 ida_bytes.patch_byte(ea, 0x90) this will patch the address at 'ea' ...
serv0's user avatar
  • 21
1 vote

How to rebuild the string list programmatically (i.e. in IDC and/or IDAPython)?

To rebuild the string list: ida_strlist.build_strlist(). I'm not sure if you can set the default type. ida_strlist.get_strlist_options() returns the options, but the return type is const.
Rolf Rolles's user avatar
  • 9,198
1 vote

ApplyPatches to input file via IDC

Look at patch_bytes() and put_bytes() in bytes.hpp, they should do what you need. You can also look at this python script on GitHub that produces a patched file from the patched bytes in the db.
vmallet's user avatar
  • 166
1 vote

How to set conditional breakpoint to modify ZF (Zero flag)

Since in your case the final value of ZF will be zero, there is no need to check the initial value but simply always zero it: ZF=0,0 The ,0 at the end will ensure that the result of expression is 0 ...
Igor Skochinsky's user avatar
  • 36.8k
1 vote
Accepted

How to set conditional breakpoint to modify ZF (Zero flag)

shift + f2 Message("zf flag when bp hit = %x\n" , GetRegValue("zf")); SetRegValue(0,"zf"); Message("zf flag after setting it %x\n" , GetRegValue("zf"))...
blabb's user avatar
  • 16.4k
1 vote

Best way to quickly mark all lines as code in IDA?

Select a range (or everything: Ctrl-PgUp, Alt-L, Ctrl-PgDn) Press C Choose how you want your code converted
Igor Skochinsky's user avatar
  • 36.8k

Only top scored, non community-wiki answers of a minimum length are eligible