Examples
IDAPython examples
This collection of examples organizes all IDAPython sample code into categories for easy reference. Each example demonstrates practical implementation for the IDAPython API, complementing the reference documentation with a real-world usage scenario.
How to run the examples?
Load the script via File Loader
Navigate to File -> Script file....
In the new dialog, select the
.py
script you want to run and click Open.
Load the script via Script command
Navigate to File -> Script command....
Paste the code into Please enter script body field and click Run.
Load the script via output window/console
In the output window/IDAPython console, type the following command:
exec(open("path/to/your_script.py").read())
to execute the script.
Example Categories: Overview
Creating & manipulating user-interface widgets, prompting the user with forms, enriching existing widgets, or creating your own UI through Python Qt bindings.
Various ways to query, or modify the disassembly listing, alter the way analysis is performed, or be notified of changes made to the IDB.
Querying the decompiler, manipulating the decompilation trees (either at the microcode level, or the C-tree), and examples showing how to intervene in the decompilation output.
Driving debugging sessions, be notified of debugging events.
These samples utilize our Type APIs, which allow you to manage the types and perform various operations on them, like creating the structures or enums and adding their members programmatically.
Miscellaneous examples that don't quite fall into another category, but don't really justify one of their own.
User interface
Beginner
Intermediate
Advanced
Disassembly
Beginner
Intermediate
Advanced
Decompilation
Beginner
Intermediate
Advanced
Debuggers
Beginner
Intermediate
Advanced
Working with types
Beginner
Intermediate
Advanced
Miscellaneous
Beginner
Intermediate
Advanced
Examples list
Assign a shortcut to a custom function
ida_kernwin.add_hotkey
is a simpler, but much less flexible alternative to ida_kernwin.register_action
(though it does use the same mechanism under the hood.)
It's particularly useful during prototyping, but note that the actions that are created cannot be inserted in menus, toolbars or cannot provide a custom ida_kernwin.action_handler_t.update
callback.
actions
Beginner
APIs Used:
ida_kernwin.add_hotkey
ida_kernwin.del_hotkey
Add custom menus to IDA
It is possible to add custom menus to IDA, either at the toplevel (i.e., into the menubar), or as submenus of existing menus.
Notes:
the same action can be present in more than 1 menu
this example does not deal with context menus
actions
Beginner
APIs Used:
ida_kernwin.AST_ENABLE_ALWAYS
ida_kernwin.SETMENU_INS
ida_kernwin.action_desc_t
ida_kernwin.action_handler_t
ida_kernwin.attach_action_to_menu
ida_kernwin.create_menu
ida_kernwin.register_action
Assign a background color to an address, function & segment
This illustrates the setting/retrieval of background colours using the IDC wrappers
In order to do so, we'll be assigning colors to specific ranges (item, function, or segment). Those will be persisted in the database.
coloring idc
Beginner
APIs Used:
idc.CIC_FUNC
idc.CIC_ITEM
idc.CIC_SEGM
idc.get_color
idc.here
idc.set_color
Override the default "Functions" chooser colors
Color the function in the Function window according to its size. The larger the function, the darker the color.
The key, is overriding ida_kernwin.UI_Hooks.get_chooser_item_attrs