Skip to main content
5 votes
Accepted

How to get execution time of IDC script?

What you could do as a workaround for the missing time-support in Ida: IDC has an "Exec" command (as mentioned in a comment) allowing you to make arbitrary calls to the OS. This might help. In the "...
josh's user avatar
  • 1,974
4 votes
Accepted

IDA Script, get function that has random characters in its name

As far as I know, IDA doesn't have a function_name_to_address() that gets a pattern and returns an address. You can iterate over all the functions and check if their name matches the one you want. It ...
Megabeets's user avatar
  • 8,999
4 votes

Reverse engineering Lingo scripts .DCR/.CCT files

I found a project which has some rudimentary documentation on the file format and even some Python code to parse it: https://github.com/eriksoe/Schockabsorber It hasn't been updated since 2013 but ...
Igor Skochinsky's user avatar
  • 36.8k
4 votes
Accepted

Retrieve & dump type information from IDA Pro

It's obviously doable (you already noted the Create C header file functionality), but if you want to customize the output, you'll have to code it yourself. Here's what you'll need: ida_typeinf....
Rolf Rolles's user avatar
  • 9,198
3 votes
Accepted

Ghidra scripting: get indirect operand address

This is done with the code/data references related API. See the code below (not checked too much, but runs on my last project, in python): # These imports are accessible when you run the script inside ...
w s's user avatar
  • 8,508
3 votes

Help decrypt lua base64

That's simple a some Lua bytecode (version 5.2) stored as base64. Use base64 -d to decode it, and then check the binary file generated using file: $ file DancingShoes.bin DancingShoes.bin: Lua ...
tibar's user avatar
  • 375
3 votes
Accepted

Obtaining the Pseudocode of a function via a script

You can use the following function: def decompile_func(ea): if not init_hexrays_plugin(): return False f = get_func(ea) if f is None: return False cfunc = decompile(f); if cfunc ...
joxeankoret's user avatar
  • 4,488
2 votes

SQLite access from Ghidra script

It doesn't look like Ghidra ships with any kind of SQLite library by default, but since Ghidra (I think) 9.2 you can import OSGI compatible .jar files in your scripts. Supposedly the official SQLite ...
Florian Magin's user avatar
2 votes

How can I get the inferred register value for an instruction in Ghidra scripting?

After looking into this a bit, I think that it will heavily depend on the exact context. The decompiler can definitely do a basic form of this: In this cases the PCode operation for the call ...
Florian Magin's user avatar
2 votes

Determine if there is a cross reference using idapython given a specific address

You can use the flags which are attached to each address and, among other info, store information about whether the address has any xrefs to it. def hasXREF(addr): return has_xref(...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

Determine if there is a cross reference using idapython given a specific address

Take a look at this link: https://www.hex-rays.com/products/ida/support/idapython_docs/idautils-module.html#XrefsTo You can use the function: XrefsTo(ea, flags=0). From the description, it Return all ...
Guillaume's user avatar
  • 709
2 votes
Accepted

How to run another IDA script using IDApython?

Found it in IDAPython documentation. There is a function exec_idc_script here in module ida_expr.I never used it myself but according to the spec it should work. In addition there is a ...
w s's user avatar
  • 8,508
2 votes
Accepted

IDAPython Script works from "Script File" but not when run with -S from Terminal

You need to run idc.auto_wait in the python script to allow IDA to process all the entries in it's auto-analysis queue before it tries to navigate around based on analysis-dependent features.
theTheodidact's user avatar
2 votes

Running script on the command line with IDA Pro 7.0

This is most likely caused by at least one of three issues: The first time IDA starts up on a machine, it'll prompt you for a license and you'll have to accept it. If the first time you run IDA is ...
NirIzr's user avatar
  • 11.8k
2 votes
Accepted

How to quickly mark functions library in IDA Pro?

Here's how you can automate the labelling process: import idc, idautils FUNC_LIB = 4 # Here go your selected functions # This labels everything unless you specify the start/end args funcs = idautils....
mimak's user avatar
  • 579
1 vote

Removing Ghidra auto-generated labels and create function. Overlapping namespace error

Turn off auto analysis options before running script. This gets in the way as it reacts to changes
Ben's user avatar
  • 11
1 vote

write a windbg sript for a table of linkedlist

it seems to work as documented dumping the _LIST_ENTRY entries to a maxCount of 100 and size of 1 (only Flinks) 0:000> dl @@c++(&@$peb->Ldr->InLoadOrderModuleList) 100 1 00007ff8`5177c4d0 ...
blabb's user avatar
  • 16.4k
1 vote

Problem when opening a script file in IDA (syntax error)(pe_sections.idc)

You probably need the 2003 version of pe_sections.idc. There were some bugs in the older versions related to parsing x64 files. We were learning both IDC scripting and the details of the x64 format ...
peter ferrie's user avatar
  • 4,709

Only top scored, non community-wiki answers of a minimum length are eligible