Examples

IDAPython examples

This collection of examples organizes all IDAPython sample code into categories for easy reference. Each example demonstrates practical implementation for the IDAPython API, complementing the reference documentation with a real-world usage scenario.

How to run the examples?

Load the script via File Loader

  1. Navigate to File -> Script file....

  2. In the new dialog, select the .py script you want to run and click Open.

Load the script via Script command

  1. Navigate to File -> Script command....

  2. Paste the code into Please enter script body field and click Run.

Load the script via output window/console

  1. In the output window/IDAPython console, type the following command: exec(open("path/to/your_script.py").read()) to execute the script.

Example Categories: Overview

Creating & manipulating user-interface widgets, prompting the user with forms, enriching existing widgets, or creating your own UI through Python Qt bindings.

Various ways to query, or modify the disassembly listing, alter the way analysis is performed, or be notified of changes made to the IDB.

Querying the decompiler, manipulating the decompilation trees (either at the microcode level, or the C-tree), and examples showing how to intervene in the decompilation output.

Driving debugging sessions, be notified of debugging events.

These samples utilize our Type APIs, which allow you to manage the types and perform various operations on them, like creating the structures or enums and adding their members programmatically.

Miscellaneous examples that don't quite fall into another category, but don't really justify one of their own.

User interface

Level
Examples

Beginner

Intermediate

Advanced

Disassembly

Level
Examples

Beginner

Intermediate

Advanced

Decompilation

Level
Examples

Beginner

Intermediate

Advanced

Debuggers

Level
Examples

Beginner

Intermediate

Advanced

Working with types

Level
Examples

Beginner

Intermediate

Advanced

Miscellaneous

Level
Examples

Beginner

Intermediate

Advanced


Examples list

Assign a shortcut to a custom function

ida_kernwin.add_hotkey is a simpler, but much less flexible alternative to ida_kernwin.register_action (though it does use the same mechanism under the hood.)

It's particularly useful during prototyping, but note that the actions that are created cannot be inserted in menus, toolbars or cannot provide a custom ida_kernwin.action_handler_t.update callback.

Source code
Keywords
Level

actions

Beginner

APIs Used:

  • ida_kernwin.add_hotkey

  • ida_kernwin.del_hotkey


Add custom menus to IDA

It is possible to add custom menus to IDA, either at the toplevel (i.e., into the menubar), or as submenus of existing menus.

Notes:

  • the same action can be present in more than 1 menu

  • this example does not deal with context menus

Source code
Keywords
Level

actions

Beginner

APIs Used:

  • ida_kernwin.AST_ENABLE_ALWAYS

  • ida_kernwin.SETMENU_INS

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_menu

  • ida_kernwin.create_menu

  • ida_kernwin.register_action


Assign a background color to an address, function & segment

This illustrates the setting/retrieval of background colours using the IDC wrappers

In order to do so, we'll be assigning colors to specific ranges (item, function, or segment). Those will be persisted in the database.

Source code
Keywords
Level

coloring idc

Beginner

APIs Used:

  • idc.CIC_FUNC

  • idc.CIC_ITEM

  • idc.CIC_SEGM

  • idc.get_color

  • idc.here

  • idc.set_color


Override the default "Functions" chooser colors

Color the function in the Function window according to its size. The larger the function, the darker the color.

The key, is overriding ida_kernwin.UI_Hooks.get_chooser_item_attrs

Source code