5
votes
Accepted
How to get execution time of IDC script?
What you could do as a workaround for the missing time-support in Ida:
IDC has an "Exec" command (as mentioned in a comment) allowing you to make arbitrary calls to the OS. This might help. In the "...
- 1,974
4
votes
Accepted
IDA Script, get function that has random characters in its name
As far as I know, IDA doesn't have a function_name_to_address() that gets a pattern and returns an address. You can iterate over all the functions and check if their name matches the one you want. It ...
- 9,019
4
votes
Reverse engineering Lingo scripts .DCR/.CCT files
I found a project which has some rudimentary documentation on the file format and even some Python code to parse it:
https://github.com/eriksoe/Schockabsorber
It hasn't been updated since 2013 but ...
- 36.9k
4
votes
Accepted
Retrieve & dump type information from IDA Pro
It's obviously doable (you already noted the Create C header file functionality), but if you want to customize the output, you'll have to code it yourself.
Here's what you'll need:
ida_typeinf....
- 9,218
3
votes
Accepted
Ghidra scripting: get indirect operand address
This is done with the code/data references related API. See the code below (not checked too much, but runs on my last project, in python):
# These imports are accessible when you run the script inside ...
- 8,538
2
votes
Accepted
IDAPython Script works from "Script File" but not when run with -S from Terminal
You need to run idc.auto_wait in the python script to allow IDA to process all the entries in it's auto-analysis queue before it tries to navigate around based on analysis-dependent features.
- 380
2
votes
Running script on the command line with IDA Pro 7.0
This is most likely caused by at least one of three issues:
The first time IDA starts up on a machine, it'll prompt you for a license and you'll have to accept it. If the first time you run IDA is ...
- 11.8k
2
votes
SQLite access from Ghidra script
It doesn't look like Ghidra ships with any kind of SQLite library by default, but since Ghidra (I think) 9.2 you can import OSGI compatible .jar files in your scripts. Supposedly the official SQLite ...
- 1,459
2
votes
How can I get the inferred register value for an instruction in Ghidra scripting?
After looking into this a bit, I think that it will heavily depend on the exact context.
The decompiler can definitely do a basic form of this:
In this cases the PCode operation for the call ...
- 1,459
2
votes
Determine if there is a cross reference using idapython given a specific address
You can use the flags which are attached to each address and, among other info, store information about whether the address has any xrefs to it.
def hasXREF(addr):
return has_xref(...
- 36.9k
2
votes
Determine if there is a cross reference using idapython given a specific address
Take a look at this link: https://www.hex-rays.com/products/ida/support/idapython_docs/idautils-module.html#XrefsTo
You can use the function:
XrefsTo(ea, flags=0).
From the description, it
Return all ...
- 709
2
votes
Accepted
How to run another IDA script using IDApython?
Found it in IDAPython documentation.
There is a function exec_idc_script here in module ida_expr.I never used it myself but according to the spec it should work.
In addition there is a ...
- 8,538
2
votes
Accepted
How to quickly mark functions library in IDA Pro?
Here's how you can automate the labelling process:
import idc, idautils
FUNC_LIB = 4
# Here go your selected functions
# This labels everything unless you specify the start/end args
funcs = idautils....
- 577
1
vote
Removing Ghidra auto-generated labels and create function. Overlapping namespace error
Turn off auto analysis options before running script. This gets in the way as it reacts to changes
- 11
1
vote
write a windbg sript for a table of linkedlist
it seems to work as documented
dumping the _LIST_ENTRY entries to a maxCount of 100 and size of 1 (only Flinks)
0:000> dl @@c++(&@$peb->Ldr->InLoadOrderModuleList) 100 1
00007ff8`5177c4d0 ...
- 16.7k
1
vote
Problem when opening a script file in IDA (syntax error)(pe_sections.idc)
You probably need the 2003 version of pe_sections.idc. There were some bugs in the older versions related to parsing x64 files. We were learning both IDC scripting and the details of the x64 format ...
- 4,709
Only top scored, non community-wiki answers of a minimum length are eligible