rev-idapython

# rev-idapython - IDAPython / IDALib Script Reference IDAPython script snippets for IDA interactive use and IDALib headless analysis. Use as reference when generating IDAPython code. - **IDAPython**: scripts run inside IDA GUI (Script Command, plugin, or IDC console) - **IDALib**: headless mode introduced in IDA 9.0 — run analysis scripts without opening the IDA GUI --- ## Common API ### Register Operations ```python idc.get_reg_value('rax') idaapi.set_reg_val("rax", 1234) ``` ### Debug Memory Operations ```python idc.read_dbg_byte(addr) idc.read_dbg_memory(addr, size) idc.read_dbg_dword(addr) idc.read_dbg_qword(addr) idc.patch_dbg_byte(addr, val) idc.add_bpt(0x409437) # add breakpoint idaapi.get_imagebase() # get image base address ``` ### Local Memory Operations (modifies IDB database) ```python idc.get_qword(addr) idc.patch_qword(addr, val) idc.patch_dword(addr, val) idc.patch_word(addr, val) idc.patch_byte(addr, val) idc.get_db_byte(addr) idc.get_bytes(addr, size) idaapi.get_dword(addr) idc.get_strlit_contents # read string literal ``` ### Disassembly ```python GetDisasm(addr) # get disassembly text idc.next_head(ea) # get next instruction address idc.create_insn(addr) # c, Make Code ida_bytes.create_strlit # create string, same as 'A' key ida_funcs.add_func(addr) # p, create function idc.del_items(addr) # U, undefine ``` ### Address Conversion ```python idc.get_name_ea(0, '_sub_6051') # get address by function name ``` ### Function Operations ```python ida_funcs.get_func(ea) # get function descriptor # enumerate all functions for func in idautils.Functions(): print("0x%x, %s" % (func, idc.get_func_name(func))) ``` --- ## Code Snippets ### Byte Pattern Search ```python import ida_bytes import ida_idaapi import ida_funcs import idc # find_bytes_list("90 90 90 90 90") # find_bytes_list("55 ??") # returns list of matching addresses def find_bytes_list(bytes_pattern): ea = -1 result = [] while True: ea = idc.find_bytes(bytes_pattern, ea + 1) if ea == ida_idaapi.BADADDR: break result.append(ea) return result ``` ### Appcall - Call Debuggee Functions ```python # test check_passwd(char *passwd) -> int passwd = ida_idd.Appcall.byref("MyFirstGuess") res = ida_idd.Appcall.check_passwd(passwd) if res.value == 0: print("Good passwd !") else: print("Bad passwd...") ``` ```python # Explicitly create the buffer as a byref object s_in = Appcall.byref("SomeEncryptedBuffer") # Buffers are always returned byref s_out = Appcall.buffer(" ", SizeOfBuffer) # Call the debuggee Appcall.decrypt_buffer(s_in, s_out, SizeOfBuffer) # Print the result print "decrypted=", s_out.value ``` ```python loadlib = Appcall.proto("kernel32_LoadLibraryA", "int __stdcall loadlib(const char *fn);") hmod = loadlib("dll_to_inject.dll") getlasterror = Appcall.proto("kernel32_GetLastError", "DWORD __stdcall GetLastError();") print "lasterror=", getlasterror() getcmdline = Appcall.proto("kernel32_GetCommandLineA", "const char *__stdcall getcmdline();") print "command line:", getcmdline() ``` ### Cross References ```python for ref in idautils.XrefsTo(ea): print(hex(ref.frm)) # shorthand [ref.frm for ref in idautils.XrefsTo(start_ea)] ``` ### Basic Block Traversal ```python fn = 0x4800 f_blocks = idaapi.FlowChart(idaapi.get_func(fn), flags=idaapi.FC_PREDS) for block in f_blocks: print(hex(block.start_ea)) ``` ```python # successor blocks for succ in block.succs(): print hex(succ.start_ea) # predecessor blocks for pred in block.preds(): print hex(pred.start_ea) ``` ### Debug Memory Read/Write ```python def patch_dbg_mem(addr, data): for i in range(len(data)): idc.patch_dbg_byte(addr + i, data[i]) def read_dbg_mem(addr, size): dd = [] for i in range(size): dd.append(idc.read_dbg_byte(addr + i)) return bytes(dd) ``` ### Read std::string (64-bit) ```python def dbg_read_cppstr_64(objectAddr): strPtr = idc.read_dbg_qword(objectAddr) result = '' i = 0 while True: onebyte = idc.read_dbg_byte(strPtr + i) if onebyte == 0: break else: result += chr(onebyte) i += 1 return result ``` ### Read C String (64-bit) ```python def dbg_read_cstr_64(objectAddr): strPtr = objectAddr result = '' i = 0 while True: onebyte = idc.read_dbg_byte(strPtr + i) if onebyte == 0: break else: result += chr(onebyte) i += 1 return result ``` ### Parse GNU C++ std::map ```python import idautils import idaapi import idc def parse_gnu_map_header(address): root = idc.read_dbg_qword(address + 0x10) return root def parse_gnu_map_node(address): left = idc.read_dbg_qword(address + 0x10) right = idc.read_dbg_qword(address + 0x18) data = address + 0x20 return left, right, data def parse_gnu_map_travel(address): # address <- std::map struct address result = [] worklist = [parse_gnu_map_header(address)] while len(worklist) > 0: addr = worklist.pop() (left, right, data) = parse_gnu_map_node(addr) if left > 0: worklist.append(left) if right > 0: worklist.append(right); result.append(data) return result # example elements = parse_gnu_map_travel(0x0000557518073EB0) for elem in elements: print(hex(elem)) ``` ### Read XMM Register (Debug) ```python def read_xmm_reg(name): rv = idaapi.regval_t() idaapi.get_reg_val(name, rv) return (struct.unpack('Q', rv.bytes())[0]) ``` ### Step Over and Wait for Debug Event ```python while ida_dbg.step_over(): wait_for_next_event(WFNE_ANY, -1) rip = idc.get_reg_value("rip") # ..... ``` ### Iterate Instructions in a Function ```python for ins in idautils.FuncItems(0x401000): print(hex(ins)) ``` ### Get Function Callees (Instruction-Based) ```python def ida_get_callees(func_addr: int) -> list: callees = [] for head in idautils.Heads(func_addr, idaapi.get_func(func_addr).end_ea): if idaapi.is_call_insn(head): callee_ea = idc.get_operand_value(head, 0) callees.append(callee_ea) return callees ``` ### Double / Complex Number Memory Operations ```python def float_to_double_bytearray(value): double_value = ctypes.c_double(value) byte_array = bytearray(ctypes.string_at(ctypes.byref(double_value), ctypes.sizeof(double_value))) return byte_array def set_pos(x, y): # complex<double, double> rbp = idc.get_reg_value("rbp") complex_base = rbp - 0x260 patch_dbg_mem(complex_base, float_to_double_bytearray(x)) patch_dbg_mem(complex_base + 8, float_to_double_bytearray(y)) set_pos(5.0, 6.0) ``` --- ## Import Table ### Enumerate Import Table ```python import ida_nalt nimps = ida_nalt.get_import_module_qty() print("Found %d import(s)..." % nimps) for i in range(nimps): name = ida_nalt.get_import_module_name(i) if not name: print("Failed to get import module name for #%d" % i) name = "<unnamed>" print("Walking imports for module %s" % name) def imp_cb(ea, name, ordinal): if not name: print("%08x: ordinal #%d" % (ea, ordinal)) else: print("%08x: %s (ordinal #%d)" % (ea, name, ordinal)) return True ida_nalt.enum_import_names(i, imp_cb) print("All done...") ``` ### Check if Address is an Import Function ```python def ida_is_import_function(addr: int) -> bool: is_find = False nimps = ida_nalt.get_import_module_qty() for i in range(nimps): def imp_cb(ea, name, ordinal): nonlocal is_find if ea == addr: is_find = True return False return True ida_nalt.enum_import_names(i, imp_cb) return is_find ``` ### Enumerate Import Addresses ```python def ida_enum_import_addr() -> List[int]: import_addrs = [] nimps = ida_nalt.get_import_module_qty() for i in range(nimps): def imp_cb(ea, name, ordinal): nonlocal import_addrs import_addrs.append(ea) return True ida_nalt.enum_import_names(i, imp_cb) return import_addrs ``` --- ## Type Information ### Struct Member Traversal ```python def extract_struct_members(type_name): fields = [] tif = ida_typeinf.tinfo_t() if tif.get_named_type(None, type_name): offset = 0 for iter in tif.iter_struct(): # udm fsize = iter.type.get_size() fields.append({ "offset": iter.offset // 8, # bit offset "size": fsize, "type": iter.type._print() }) offset += fsize else: print(f"Unable to get {type_name} type info.") return fields extract_struct_members("sqlite3_vfs") ``` ### Enumerate All Types ```python til = ida_typeinf.get_idati() for type_name in til.get_type_names(): print(type_name) ``` ### List All Struct Types ```python def list_struct_types(): types = [] til = ida_typeinf.get_idati() for type_name in til.get_type_names(): tif = ida_typeinf.tinfo_t() if tif.get_named_type(None, type_name): if tif.is_struct(): types.append(type_name) return types ``` --- ## Hex-Rays Decompiler API ### Decompile a Function ```python # verified: IDA 9.0 dec = ida_hexrays.decompile(func_addr) # dec is an object, str(dec) converts to text print(str(dec)) ``` ### Print Microcode at Different Maturity Levels ```python def print_microcode(func_ea): maturity = ida_hexrays.MMAT_GLBOPT3 # maturity: # MMAT_ZERO, ///< microcode does not exist # MMAT_GENERATED, ///< generated microcode # MMAT_PREOPTIMIZED, ///< preoptimized pass is complete # MMAT_LOCOPT, ///< local optimization of each basic block is complete. # ///< control flow graph is ready too. # MMAT_CALLS, ///< detected call arguments # MMAT_GLBOPT1, ///< performed the first pass of global optimization # MMAT_GLBOPT2, ///< most global optimization passes are done # MMAT_GLBOPT3, ///< completed all global optimization. microcode is fixed now.