LogoLogo
IDA 9.1
IDA 9.1
  • Welcome to Hex-Rays docs
    • What's new?
  • Getting Started
    • Install IDA
    • Licensing
    • Basic Usage
    • What's next?
  • User Guide
    • User Interface
      • Menu Bar
        • File
          • Load file
          • Script File
          • Script command
          • Produce output files
          • Invoke OS Shell
          • Take database snapshot
          • Save database
          • Save database as...
          • Abort IDA
          • Exit IDA
        • Edit
          • Export data
          • Undo an action
          • Redo an action
          • Clear undo history
          • Disable undo
          • Convert to instruction
          • Convert to data
          • Convert to string literal
          • Convert to array
          • Undefine a byte
          • Give Name to the Location
          • Operand types
            • Offset
            • Number
            • Perform en masse operation
            • Convert operand to character
            • Convert operand to segment
            • Complex Offset Expression
            • Convert operand to symbolic constant (enum)
            • Convert operand to stack variable
            • Change operand sign
            • Bitwise negate operand
            • User-defined operand
            • Set operand type
          • Comments
          • Functions
          • Structs
          • Segments
          • Patch core
          • Other
            • Rename Any Address
          • Plugins
        • Jump
          • Center current line in window
          • Problems List
        • Search
          • REGULAR EXPRESSION SYNTAX SUMMARY
        • View
          • Open subviews
          • Graphs
          • Arrows window
          • Database snapshot manager
          • Highlighting identifiers
          • Browser options
          • Lumina options
          • Assembler level and C level types
          • C++ type details
          • Bookmarks window
          • Calculator
          • View segment registers
          • View Internal Flags
          • Hide
          • Unhide
          • Del hidden range
          • Hide all items
          • Unhide all items
          • Setup hidden items
        • Debugger
          • Debugger window
          • Process Control
            • Start process
            • Process options
            • Pause process
            • Terminate process
            • Step into
            • Step into (backwards)
            • Step over
            • Step over (backwards)
            • Run to cursor
            • Run to cursor (backwards)
            • Run until return
            • Attach to process
            • Detach from process
            • Set current ip
            • Show application screen
          • Breakpoints
          • Watches
          • Tracing
          • Source code view
            • Watch view (source level)
          • Process Memory
            • Take memory snapshot
            • Manual memory regions
            • Refresh memory
          • Thread list
          • Module list
          • Stack trace
          • Exceptions
          • Debugger options
          • Switch debugger
        • Lumina
        • Options
          • Low & High Suspicious Operand Limits
        • Windows
          • Rename a stack variable
          • Miscellanous Options
          • Environment variables
          • Reset Hidden Messages
          • Various dialog help messages
          • Output window
        • List of all menu options
      • Desktops
      • Command line
      • License Manager
      • How To Use List Viewers in IDA
      • Database conversion from idb to i64
    • Disassembler
      • Interactivity
      • Background Analysis
      • Graph view
        • Graphing tutorial
      • Proximity view
      • Navigation
        • Anchor
        • How to Enter a Segment Value
        • How to Enter a Number
        • How to Enter an Identifier
        • How to enter text
        • How to Enter an Address
      • Disassembly Gallery
        • Philips 51XA-G3
        • 6502 and 65C02 Disassembler
        • 6301, 6303, 6800, 6801 and 6803 Disassembler
        • 68040, Amiga
        • 6805 Disassembler
        • 6808 Disassembler
        • 6809 OS9 Flex Disassembler
        • 6809 Disassembler
        • 6811 Disassembler
        • 68HC12 Disassembler
        • 68HC16 Disassembler
        • 68k Amiga Disassembler
        • 68k Mac OS
        • 68k Palm Pilot
        • Unix COFF
        • NEC 78k0 and 78k0s Processor
        • 80196 Processor
        • 8051 Disassembler
        • Analog Devices 218x.
        • Alpha Processor – NT COFF
        • Alpha Processor – Unix ELF
        • Android ARM Executables (.elf)
        • ARC Processor
        • ARM Processor EPOC App
        • ARM Processor EPOC PE File
        • ARM Processor EPOC ROMFile
        • EPOC SIS File Handler
        • ARM Processor iOS (iPhone): Unlock
        • ARM Processor iOS (iPhone): Objective-C metadata
        • ARM Processor iOS (iPhone): Objective-C Instance variables
        • ARM Processor iOS (iPhone): Parameter Identification & Tracking (PIT)
        • ARM Processor iOS (iPhone): Start
        • ARM Processor iOS (iPhone): Switch statements
        • ARM Processor iOS (iPhone): C++ signatures
        • ARM Processor iOS (iPhone): Write
        • ARM Processor: Linux ELF
        • ARM Processor: AOF SDK
        • ARM Processor: Windows CE COFF Format
        • ARM Processor: Windows CE PE Format
        • ATMEL AVR Disassembler
        • C166 Processor
        • C166 Processor with ELF file
        • Rockwell C39
        • Microsoft .NET CLI Disassembler. VisualBasic library
        • CR16
        • Android Dalvik Executables (.dex)
        • Microsoft .NET CLI Disassembler
        • DSP56K
        • Fujitsu FR (.elf)
        • Gameboy
        • H8 300: COFF FILE Format
        • H8 300s: COFF FILE Format
        • H8 500
        • HPPA Risc Processor: HP-UX SOM
        • i51
        • i860
        • Intel i960
        • Intel IA-64 (Itanium)
        • Java Bytecode
        • Angstrem KR 1878
        • Renesas/Hitachi M16C
        • Renesas/Hitachi M32R
        • M740
        • M7700
        • M7900
        • MIPS Processor: Nintendo N64
        • MIPS R5900 Processor : Sony bin
        • MIPS Processor: Sony ELF
        • MIPS Processor: Sony PSX
        • MIPS Processor: Sony PSX
        • MIPS Processor: Unix COFF File Format
        • MIPS Processor: Unix ELF File Format
        • MIPS Processor: Windows CE PE File Format
        • MIPS Processor: Windows CE PE2 File Format
        • Panasonic MN102
        • Atmel OAK DSP
        • 80×86 Architecture: DOS Extender
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Geos APP
        • 80×86 Architecture: Geos DRV
        • 80×86 Architecture: Geos LIB
        • 80×86 Architecture: GNU COFF Format
        • 80×86 Architecture: OS/2 Linear Executable Format
        • 80×86 Architecture: Netware NLM
        • 80×86 Architecture: QNX Executable
        • 80×86 Architecture: Watcom Runtime
        • 80×86 Architecture: Windows OMF
        • 80×86 Architecture: Windows Portable Executable Format
        • 80×86 Architecture: Windows Virtual Device Driver
        • 80×86 Architecture: Windows 16 bits DLL
        • X-Box Disassembler
        • PDP 11: SAV File
        • PIC
        • PIC 12xx
        • Power PC AIF ECOFF file Format
        • Power PC Linux ELF
        • Mac OS PEF File
        • Mac OS X File
        • Windows NT PE File
        • Hitachi SH-1 Processor
        • Hitachi SH-3 Processor: Windows CE COFF format
        • Hitachi SH-3 Processor: Windows CE PE format
        • Hitachi SH-4 Processor: ELF File Format
        • Hitachi SH-4 Processor: Windows CE PE File Format
        • Super Nintendo Entertainement System (SNES)
        • SPARC Solaris COFF
        • SPARC Solaris ELF
        • SPARC Sun ELF
        • SPARC Sun ELF SO
        • ST 20C4
        • ST 7
        • ST 9
        • Toshiba TLCS 900
        • TMS 320c2 COFF
        • TMS 320c5
        • TMS 320c54
        • TMS 320c6 COFF File Format
        • TRICORE
        • SunPlus unSP
        • NEC V850
        • Z180 COFF File Format
        • Z380 COFF File Format
        • Z8
        • Z80
      • Supported processors
      • Supported file formats
        • Windmp file loader
      • Bitfields
        • Bit Fields tutorial
      • Structures tutorial
      • Union tutorial
      • Variable length structures tutorial
      • Data types, operands and constructs
      • Packed executables
    • Decompiler
      • Prerequisites
      • Quick primer
      • Exception handler
      • Introduction to Decompilation vs. Disassembly
        • Comparisons of ARM disassembly and decompilation
        • Comparisons of PowerPC disassembly and decompilation
        • Comparisons of MIPS disassembly and decompilation
        • Hex-Rays v7.4 vs. v7.3 Decompiler Comparison Page
        • Hex-Rays v7.3 vs. v7.2 Decompiler Comparison Page
        • Hex-Rays v7.2 vs. v7.1 Decompiler Comparison Page
      • Interactive operation
        • Rename
        • Set type
        • Set number representation
        • Edit indented comment
        • Edit block comment
        • Hide/unhide C statements
        • Split/unsplit expression
        • Force call type
        • Set call type
        • Add/del variadic arguments
        • Del function argument
        • Add/delete function return type
        • Jump to cross reference
        • Jump to cross reference globally
        • Generate HTML file
        • Mark/unmark as decompiled
        • Copy to assembly
        • Show/hide casts
        • Reset pointer type
        • Convert to struct *
        • Create new struct type
        • Split variable
        • Select union field
        • Jump to paired paren
        • Collapse/uncollapse item
        • Map to another variable
      • Batch operation
      • Configuration
      • Third party plugins
      • Floating point support
      • Support for intrinsic functions
      • Overlapped variables
      • gooMBA
      • Failures and troubleshooting
      • FAQ
      • Limitations
      • Tips and tricks
    • Debugger
      • Instant debugger
      • Remote debugging
        • Remote iOS Debugger
        • Android debugger
        • Dalvik debugger
        • Remote GDB Debugger
          • Remote GDB Debugger options
          • Debugging with gdbserver
          • Debugging with VMWare
          • Debugging with OpenOCD
          • Debugging with QEMU
          • External programs and GDB Debugger
          • Debugging code snippets with QEMU
        • PIN debugger
          • Building the PIN tool
          • Connecting a remote PIN tool instance from IDA
          • PIN support for MacOSX
        • Replayer debugger
        • Bochs debugger
          • Bochs Disk Image operation mode
          • Bochs IDB operation mode
          • Bochs PE operation mode
          • Bochs debugger FAQ
      • Local debugging
        • WinDbg Debugger
        • WinDbg: Time Travel Debugging
        • Linux debugger
        • Intel/ARM macOS debugger
      • Debugger tutorials
        • Debugging Dalvik Programs
        • IDA Win32 Local Debugging
        • IDA Linux Local Debugging
        • IDA Linux to Win64 Debugging
        • IDA Win32 to Linux Debugging
        • Debugging Mac OSX Applications with IDA Pro
        • Debugging iOS Applications using CoreDevice (iOS 17 and up)
        • Debugging iOS Applications with IDA Pro
        • Debugging Linux Applications locally
        • Debugging Linux/Windows Applications with PIN Tracer module
        • Debugging Windows Applications with IDA Bochs Plugin
        • Debugging Windows Applications with IDA WinDbg Plugin
        • Using the Bochs debugger plugin in Linux
        • Debugging Windows Kernel with VMWare and IDA WinDbg Plugin
        • Debugging Linux Kernel under VMWare using IDA GDB debugger
        • Windows Debugger Hub
        • Linux Debugger
        • Debugging a Windows executable locally and remotely
        • Debugging the XNU Kernel with IDA Pro
        • Remote debugging with IDA Pro
        • IDA Scriptable Debugger: overview
          • IDA Scriptable Debugger: scriptability
        • Debugging code snippets with QEMU debugger (a la IDA Bochs debugger)
        • Trace Replayer and managing traces
        • Using IDA Pro's tracing features
        • Working with PIN
        • Appcall
    • Creating Signatures
      • FLIRT
        • IDA F.L.I.R.T. Technology: In-Depth
        • Generate FLIRT signature file
        • Supported Compilers
          • Turbo Pascal
          • Delphi
      • Makesig
    • Types
      • Creating Type Libraries
        • IDAClang
        • TILIB
    • Configuration
      • Configuration files
      • Command line switches
      • Keyboard macros
      • UI/Fonts/Themes
      • Shortcuts
      • Customizing IDA
      • CSS-based styling
    • Teams
      • Diffing and Merging Databases with IDA Teams
      • Teams lc command reference manual
      • hv command reference manual
      • Hex-Rays Vault’s visual client user manual
    • Lumina
      • lc command reference manual
    • Plugins
      • Open Plugin Architecture
      • Plugin options
      • Plugins Shipped with IDA
        • Swift plugin
        • Golang plugin
        • Rust plugin
        • picture_search
        • Objective-C Analysis Plugin
        • DYLD Shared Cache Utils
        • Borland RTTI descriptors plugin
        • DWARF plugin
        • Patfind plugin
        • IDA Feeds
          • FLIRT Signature Bundle
      • Plugin Contest
      • How to write your own plugin?
    • Helper Tools
    • idalib
    • Third-Party Licenses
      • Apache License for Ghidra
      • Apache License for LLVM
      • Common Public License Version 1.0
      • APPLE PUBLIC SOURCE LICENSE
      • PCRE2 LICENCE
      • GNU Lesser General Public License v2.1 for libiberty
    • Floating licenses
  • Developer Guide
    • C++ SDK
      • Getting Started
      • Reference
      • Using the Decompiler SDK: Decompiler plugin
      • Examples
      • How to create a plugin?
      • Porting Guide from IDA 8.x to 9.0
    • IDAPython
      • Getting Started
      • Reference
      • Examples
      • How to create a plugin?
      • Porting Guide from IDA 8.x to 9.0
    • IDC
      • Core concepts
        • Expressions
        • Statements
        • Functions
        • Variables
        • Constants
        • Exceptions
        • Classes
        • Predefined symbols
        • loader_input_t class
        • Slices
      • Reference
      • Examples
        • Analyzing encrypted code
  • Admin Guide
    • Lumina server
    • Teams server
    • License server
      • Hex-Rays License Server Migration Guide
      • Hex-Rays License Server on WSL
  • Release Notes
    • IDA 9.1
    • IDA 9.0sp1
    • IDA 9.0
    • IDA 8.5
    • IDA 8.4sp2
    • IDA 8.4sp1
    • IDA 8.4
    • IDA 8.3
    • IDA 8.2sp1
    • IDA 8.2
    • IDA 8.1
    • IDA 8.0sp1
    • IDA 8.0
    • IDA 7.7sp1
    • IDA 7.7
    • IDA 7.6sp1
    • IDA 7.6
    • IDA 7.5sp3
    • IDA 7.5sp2
    • IDA 7.5sp1
    • IDA 7.5
    • IDA 7.4sp1
    • IDA 7.4
    • IDA 7.3
      • IDA 7.3 Undo: IDA can do it
    • IDA 7.2
      • IDA 7.2 The Mac Rundown
    • IDA 7.1
      • IDA 7.1 Debugger API 7.1 Porting Guide
    • IDA 7.0sp1
    • IDA 7.0
      • Internationalization (i18n)
      • Automatic discovery of string literals
      • API 7.0 Porting Guide
      • IDAPython backward compatibility
    • IDA 6.95
    • IDA 6.9
    • IDA 6.8
    • IDA 6.7
    • IDA 6.6
    • IDA 6.5
    • IDA 6.4
    • IDA 6.3
    • IDA 6.2
    • IDA 6.1
    • IDA 6.0
    • IDA 5.7
    • IDA 5.6
    • IDA 5.5
      • 5.5 Gallery
      • 5.5 Comparison
    • IDA 5.4
    • IDA 5.3
    • IDA 5.2
    • IDA 5.1
    • IDA 5.0
    • IDA 4.9SP
    • IDA 4.9
    • IDA 4.8
    • IDA 4.7
    • IDA 4.6
    • IDA 4.x
    • IDA 3.x
    • Cumulative bugfix for IDA
  • Archive
    • IDA’s Windbg plugin
    • IDA’s Bochs debugger plugin
    • IDA’s Bochs debugger plugin 2
    • DosWin32
    • Hex-Rays v1.1 vs. v1.0 Decompiler Comparison Page
    • Hex-Rays v1.2 vs. v1.1 Decompiler Comparison Page
    • Hex-Rays v1.3 vs. v1.2 Decompiler Comparison Page
    • Hex-Rays v1.6 vs. v1.5 Decompiler Comparison Page
    • Hex-Rays v1.7 vs. v1.6 Decompiler Comparison Page
    • Costly Greetings – An Adventure In Hostile Code Analysis
    • An Adventure In Hostile Code Analysis: Description
    • An Adventure In Hostile Code Analysis: Disassembly
    • Improved code flow analysis
    • Program Navigation Bar
    • IDA Home Contest
    • Pimp My IDA: vote results
    • Turning off IDA 6.x compatibility in IDAPython
    • Porting guide for IDA 7.4 turning off IDA 6.x API backwards-compatibility by default
    • Porting guide for IDA 7.4 IDAPython and Python 3
    • IDAPython and Python 3
    • Porting guide for changes in IDAPython-on-Python-3 APIs
    • Debugging iOS Applications With IDA
    • IDA Win32 to Win32 Debugging
    • IDA Win32 to Win64 Debugging
    • Legacy license server: Floating Licenses
      • Installing on Linux
      • Installing on Windows
      • Installing on OS X
    • Decompiler Installation
    • Enumerated types tutorial
  • Bug Bounty
Powered by GitBook
LogoLogo

Need Help?

  • FAQs
  • Support

Community

  • Forum
  • Plugins

Resources

  • Blog
  • Download center

© 2025 Copyright Hex-Rays

On this page
  • IDAPython examples
  • How to run the examples?
  • Example Categories: Overview
  • User interface
  • Disassembly
  • Decompilation
  • Debuggers
  • Working with types
  • Miscellaneous
  • Examples list
  • Assign a shortcut to a custom function
  • Add custom menus to IDA
  • Assign a background color to an address, function & segment
  • Override the default "Functions" chooser colors
  • Create a dockable container, and populate it with Qt widgets
  • Prevent an action from being triggered
  • Use timers for delayed execution
  • Show, update & hide the progress dialog
  • Custom actions, with icons & tooltips
  • Show tabular data
  • Show tabular data, with multiple selection
  • Create custom listings in IDA
  • Implement an alternative "Functions" window
  • Implement a "jump to next comment" action within IDA's listing
  • Dynamically colorize [parts of] lines
  • React to UI events/notifications
  • Paint on top of the navigation band
  • Save, and then restore, positions in a listing
  • Retrieve the selection from the "Strings" window
  • Follow the movements of one graph, in another
  • Trigger actions programmatically
  • Advanced usage of the form API
  • Restore custom widgets across sessions
  • Showing tabular data in a flat, or tree-like fashion
  • Colorize lines interactively
  • Add a custom command-line interpreter
  • Draw custom graphs
  • Retrieve & dump current selection
  • Inject commands in the "Output" window
  • A lazy-loaded, tree-like data view
  • Paint text on graph view edges
  • Programmatically manipulate disassembly and graph widgets
  • Dump function flowchart
  • Insert information into listing prefixes
  • Enumerate file imports
  • Enumerate patched bytes
  • Enumerate known problems
  • List segment functions (and cross-references to them)
  • List all functions (and cross-references) in segment
  • Dump the strings that are present in the file
  • Produce disassembly listing for the entire file
  • Rewrite the representation of some instructions
  • Implement assembly of instructions
  • Retrieve comments surrounding instructions
  • Dump function information
  • Using "ida_bytes.find_string"
  • Print notifications about function prototype changes
  • List listing bookmarks
  • Showcase (some of) the iterators available on a function
  • React to database events/notifications
  • React to processor events/notifications
  • Record and replay changes in function prototypes
  • Add a new member to an existing function frame
  • Custom data types & printers
  • List operands representing a "path" to a (possibly nested) structure member
  • Notify the user when an instruction operand changes
  • Produce C listing for the entire file
  • Decompile & print current function
  • Generate microcode for the selected range of instructions
  • Dump statement blocks
  • Provide custom decompiler hints
  • Interactively color decompilation lines
  • Decompile entrypoint automatically
  • Add custom microcode instruction optimization rule
  • Dynamically provide a custom call type
  • Dump user-defined information for a function
  • Superficially modify the decompilation output
  • Improve decompilation by turning specific patterns into custom function calls
  • React to decompiler events/notifications
  • Modifying function local variables
  • Print information about the current position in decompilation
  • Add a custom microcode block optimization rule
  • List instruction registers
  • Invoke the structure offset-choosing dialog from decompilation
  • Add a custom microcode instruction optimization rule
  • Invert if/else blocks in decompilation
  • Dump C-tree graph
  • Show decompiler cross-references
  • Print all registers, for all threads in the debugged process
  • Dump symbols from a process being debugged
  • Print call stack
  • Add a custom action to the "registers" widget
  • Programmatically drive a debugging session
  • React to trace notifications
  • Execute code into the application being debugged (on Linux)
  • Execute code into the application being debugged (on Windows)
  • Create a structure by parsing its definition
  • Delete structure members that fall within an offset range
  • Print enumeration members
  • Print function stack frame information
  • List database functions prototypes
  • List structure members
  • List cross-references to a structure
  • List union members
  • Mark a register "spoiled" by a function
  • Apply function prototype to call sites
  • Create an array type
  • Create a structure with bitfield members
  • Create a bitmask enumeration
  • Create a type library file
  • Create a structure programmatically
  • Create & populate a structure
  • Create a union
  • Create a segment, and define (complex) data in it
  • Utilities to detect structure gaps & alignment
  • Get member by offset, taking into account variable sized structures
  • Get information about the "innermost" member of a structure
  • Load a type library from a file, and then a type from it
  • Inject a member in the middle of a structure
  • List all xrefs to a function stack variable
  • List cross-references to function stack frame variables
  • Assign DOS/PE headers structures to a PE binary
  • Recursively visit a type and its members
  • Change the name of an existing stack variable
  • Change the type & name of a function stack frame variable
  • Turn instruction operand into a structure offset
  • Code to be run right after IDAPython initialization
  • Add functions to the IDC runtime, from IDAPython
  • Add 64-bit (.idb->.i64) conversion capabilities to custom plugins
  • Add merge functionality to a simple plugin
  • Implement merging functionality for custom plugins

Was this helpful?

Export as PDF
  1. Developer Guide
  2. IDAPython

Examples

Last updated 2 months ago

Was this helpful?

IDAPython examples

This collection of examples organizes all IDAPython sample code into for easy reference. Each example demonstrates practical implementation for the IDAPython API, complementing the with a real-world usage scenario.

How to run the examples?

Load the script via File Loader

  1. Navigate to File -> Script file....

  2. In the new dialog, select the .py script you want to run and click Open.

Load the script via Script command

  1. Navigate to File -> Script command....

  2. Paste the code into Please enter script body field and click Run.

Load the script via output window/console

  1. In the output window/IDAPython console, type the following command: exec(open("path/to/your_script.py").read()) to execute the script.

Example Categories: Overview

Creating & manipulating user-interface widgets, prompting the user with forms, enriching existing widgets, or creating your own UI through Python Qt bindings.

Various ways to query, or modify the disassembly listing, alter the way analysis is performed, or be notified of changes made to the IDB.

Querying the decompiler, manipulating the decompilation trees (either at the microcode level, or the C-tree), and examples showing how to intervene in the decompilation output.

Driving debugging sessions, be notified of debugging events.

These samples utilize our Type APIs, which allow you to manage the types and perform various operations on them, like creating the structures or enums and adding their members programmatically.

Miscellaneous examples that don't quite fall into another category, but don't really justify one of their own.

User interface

Level
Examples

Beginner

Intermediate

Advanced

Disassembly

Level
Examples

Beginner

Intermediate

Advanced

Decompilation

Level
Examples

Beginner

Intermediate

Advanced

Debuggers

Level
Examples

Beginner

Intermediate

Advanced

Working with types

Level
Examples

Beginner

Intermediate

Advanced

Miscellaneous

Level
Examples

Beginner

Intermediate

Advanced


Examples list

Assign a shortcut to a custom function

ida_kernwin.add_hotkey is a simpler, but much less flexible alternative to ida_kernwin.register_action (though it does use the same mechanism under the hood.)

It's particularly useful during prototyping, but note that the actions that are created cannot be inserted in menus, toolbars or cannot provide a custom ida_kernwin.action_handler_t.update callback.

Source code
Keywords
Level

actions

Beginner

APIs Used:

  • ida_kernwin.add_hotkey

  • ida_kernwin.del_hotkey


Add custom menus to IDA

It is possible to add custom menus to IDA, either at the toplevel (i.e., into the menubar), or as submenus of existing menus.

Notes:

  • the same action can be present in more than 1 menu

  • this example does not deal with context menus

Source code
Keywords
Level

actions

Beginner

APIs Used:

  • ida_kernwin.AST_ENABLE_ALWAYS

  • ida_kernwin.SETMENU_INS

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_menu

  • ida_kernwin.create_menu

  • ida_kernwin.register_action


Assign a background color to an address, function & segment

This illustrates the setting/retrieval of background colours using the IDC wrappers

In order to do so, we'll be assigning colors to specific ranges (item, function, or segment). Those will be persisted in the database.

Source code
Keywords
Level

coloring idc

Beginner

APIs Used:

  • idc.CIC_FUNC

  • idc.CIC_ITEM

  • idc.CIC_SEGM

  • idc.get_color

  • idc.here

  • idc.set_color


Override the default "Functions" chooser colors

Color the function in the Function window according to its size. The larger the function, the darker the color.

The key, is overriding ida_kernwin.UI_Hooks.get_chooser_item_attrs

Source code
Keywords
Level

UI_Hooks

Beginner

APIs Used:

  • ida_funcs.get_func

  • ida_kernwin.UI_Hooks

  • ida_kernwin.enable_chooser_item_attrs


Create a dockable container, and populate it with Qt widgets

Using ida_kernwin.PluginForm.FormToPyQtWidget, this script converts IDA's own dockable widget into a type that is recognized by PyQt5, which then enables populating it with regular Qt widgets.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_kernwin.PluginForm


Prevent an action from being triggered

Using ida_kernwin.UI_Hooks.preprocess_action, it is possible to respond to a command instead of the action that would otherwise do it.

Source code
Keywords
Level

UI_Hooks

Beginner

APIs Used:

  • ida_kernwin.UI_Hooks


Use timers for delayed execution

Register (possibly repeating) timers.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_kernwin.register_timer


Show, update & hide the progress dialog

Using the progress dialog (aka 'wait box') primitives.

Source code
Keywords
Level

actions

Beginner

APIs Used:

  • ida_hexrays.decompile

  • ida_kernwin.hide_wait_box

  • ida_kernwin.replace_wait_box

  • ida_kernwin.show_wait_box

  • ida_kernwin.user_cancelled

  • idautils.Functions


Custom actions, with icons & tooltips

How to create user actions, that once created can be inserted in menus, toolbars, context menus, ...

Those actions, when triggered, will be passed a 'context' that contains some of the most frequently needed bits of information.

In addition, custom actions can determine when they want to be available (through their ida_kernwin.action_handler_t.update callback)

Source code
Keywords
Level

actions ctxmenu UI_Hooks

Intermediate

APIs Used:

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_DISASM

  • ida_kernwin.SETMENU_APP

  • ida_kernwin.UI_Hooks

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_menu

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.attach_action_to_toolbar

  • ida_kernwin.get_widget_type

  • ida_kernwin.load_custom_icon

  • ida_kernwin.register_action

  • ida_kernwin.unregister_action


Show tabular data

Shows how to subclass the ida_kernwin.Choose class to show data organized in a simple table. In addition, registers a couple actions that can be applied to it.

Source code
Keywords
Level

actions chooser ctxmenu

Intermediate

APIs Used:

  • Choose

  • Choose.ALL_CHANGED

  • Choose.CH_CAN_DEL

  • Choose.CH_CAN_EDIT

  • Choose.CH_CAN_INS

  • Choose.CH_CAN_REFRESH

  • Choose.CH_RESTORE

  • Choose.NOTHING_CHANGED

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.is_chooser_widget

  • ida_kernwin.register_action

  • ida_kernwin.unregister_action


Show tabular data, with multiple selection

Source code
Keywords
Level

actions chooser

Intermediate

APIs Used:

  • Choose

  • Choose.ALL_CHANGED

  • Choose.CHCOL_HEX

  • Choose.CH_MULTI

  • Choose.NOTHING_CHANGED


Create custom listings in IDA

How to create simple listings, that will share many of the features as the built-in IDA widgets (highlighting, copy & paste, notifications, ...)

In addition, creates actions that will be bound to the freshly-created widget (using ida_kernwin.attach_action_to_popup.)

Source code
Keywords
Level

actions ctxmenu listing

Intermediate

APIs Used:

  • ida_kernwin.AST_ENABLE_ALWAYS

  • ida_kernwin.IK_DELETE

  • ida_kernwin.IK_ESCAPE

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.ask_long

  • ida_kernwin.ask_str

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.register_action

  • ida_kernwin.simplecustviewer_t

  • ida_kernwin.simplecustviewer_t.Create

  • ida_kernwin.simplecustviewer_t.Show

  • ida_kernwin.unregister_action

  • ida_lines.COLOR_DEFAULT

  • ida_lines.COLOR_DNAME

  • ida_lines.COLSTR

  • ida_lines.SCOLOR_PREFIX

  • ida_lines.SCOLOR_VOIDOP


Implement an alternative "Functions" window

Partially re-implements the "Functions" widget present in IDA, with a custom widget.

Source code
Keywords
Level

chooser functions

Intermediate

APIs Used:

  • ida_funcs.get_func_name

  • ida_kernwin.Choose

  • ida_kernwin.Choose.ALL_CHANGED

  • ida_kernwin.Choose.CHCOL_FNAME

  • ida_kernwin.Choose.CHCOL_HEX

  • ida_kernwin.Choose.CHCOL_PLAIN

  • ida_kernwin.get_icon_id_by_name

  • idautils.Functions

  • idc.del_func


Implement a "jump to next comment" action within IDA's listing

We want our action not only to find the next line containing a comment, but to also place the cursor at the right horizontal position.

To find that position, we will have to inspect the text that IDA generates, looking for the start of a comment. However, we won't be looking for a comment "prefix" (e.g., "; "), as that would be too fragile.

Instead, we will look for special "tags" that IDA injects into textual lines, and that bear semantic information.

Those tags are primarily used for rendering (i.e., switching colors), but can also be very handy for spotting tokens of interest (registers, addresses, comments, prefixes, instruction mnemonics, ...)

Source code
Keywords
Level

actions idaview

Intermediate

APIs Used:

  • ida_bytes.next_head

  • ida_idaapi.BADADDR

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_DISASM

  • ida_kernwin.CVNF_LAZY

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.custom_viewer_jump

  • ida_kernwin.get_custom_viewer_location

  • ida_kernwin.place_t_as_idaplace_t

  • ida_kernwin.register_action

  • ida_kernwin.unregister_action

  • ida_lines.SCOLOR_AUTOCMT

  • ida_lines.SCOLOR_ON

  • ida_lines.SCOLOR_REGCMT

  • ida_lines.SCOLOR_RPTCMT

  • ida_lines.generate_disassembly

  • ida_lines.tag_strlen

  • ida_moves.lochist_entry_t


Dynamically colorize [parts of] lines

Shows how one can dynamically alter the lines background rendering (as opposed to, say, using ida_nalt.set_item_color()), and also shows how that rendering can be limited to just a few glyphs, not the whole line.

Source code
Keywords
Level

UI_Hooks

Intermediate

APIs Used:

  • ida_bytes.next_head

  • ida_idaapi.BADADDR

  • ida_kernwin.CK_EXTRA1

  • ida_kernwin.CK_EXTRA10

  • ida_kernwin.CK_EXTRA11

  • ida_kernwin.CK_EXTRA12

  • ida_kernwin.CK_EXTRA13

  • ida_kernwin.CK_EXTRA14

  • ida_kernwin.CK_EXTRA15

  • ida_kernwin.CK_EXTRA16

  • ida_kernwin.CK_EXTRA2

  • ida_kernwin.CK_EXTRA3

  • ida_kernwin.CK_EXTRA4

  • ida_kernwin.CK_EXTRA5

  • ida_kernwin.CK_EXTRA6

  • ida_kernwin.CK_EXTRA7

  • ida_kernwin.CK_EXTRA8

  • ida_kernwin.CK_EXTRA9

  • ida_kernwin.CK_TRACE

  • ida_kernwin.CK_TRACE_OVL

  • ida_kernwin.LROEF_CPS_RANGE

  • ida_kernwin.UI_Hooks

  • ida_kernwin.get_screen_ea

  • ida_kernwin.line_rendering_output_entry_t

  • ida_kernwin.refresh_idaview_anyway


React to UI events/notifications

Hooks to be notified about certain UI events, and dump their information to the "Output" window

Source code
Keywords
Level

UI_Hooks

Intermediate

APIs Used:

  • ida_kernwin.UI_Hooks


Paint on top of the navigation band

Using an "event filter", we will intercept paint events targeted at the navigation band widget, let it paint itself, and then add our own markers on top.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_kernwin.PluginForm.FormToPyQtWidget

  • ida_kernwin.get_navband_pixel

  • ida_kernwin.open_navband_window

  • ida_segment.get_segm_qty

  • ida_segment.getnseg

  • idc.here


Save, and then restore, positions in a listing

Shows how it is possible re-implement IDA's bookmark capability, using 2 custom actions: one action saves the current location, and the other restores it.

Note that, contrary to actual bookmarks, this example:

  • remembers only 1 saved position

  • doesn't save that position in the IDB (and therefore cannot be restored if IDA is closed & reopened.)

Source code
Keywords
Level

actions listing

Intermediate

APIs Used:

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_CUSTVIEW

  • ida_kernwin.BWN_DISASM

  • ida_kernwin.BWN_PSEUDOCODE

  • ida_kernwin.BWN_TILVIEW

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.custom_viewer_jump

  • ida_kernwin.find_widget

  • ida_kernwin.get_custom_viewer_location

  • ida_kernwin.register_action

  • ida_kernwin.unregister_action

  • ida_moves.lochist_entry_t


Retrieve the selection from the "Strings" window

In IDA it's possible to write actions that can be applied even to core (i.e., "standard") widgets. The actions in this example use the action "context" to know what the current selection is.

This example shows how you can either retrieve string literals data directly from the chooser (ida_kernwin.get_chooser_data), or by querying the IDB (ida_bytes.get_strlit_contents)

Source code
Keywords
Level

actions ctxmenu

Intermediate

APIs Used:

  • ida_bytes.get_strlit_contents

  • ida_idaapi.BADADDR

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_STRINGS

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.find_widget

  • ida_kernwin.get_chooser_data

  • ida_kernwin.open_strings_window

  • ida_kernwin.register_action

  • ida_kernwin.unregister_action

  • ida_strlist.get_strlist_item

  • ida_strlist.string_info_t


Follow the movements of one graph, in another

Since it is possible to be notified of movements that happen take place in a widget, it's possible to "replay" those movements in another.

In this case, "IDA View-B" (will be opened if necessary) will show the same contents as "IDA View-A", slightly zoomed out.

Source code
Keywords
Level

graph idaview

Intermediate

APIs Used:

  • ida_graph.GLICTL_CENTER

  • ida_graph.viewer_fit_window

  • ida_graph.viewer_get_gli

  • ida_graph.viewer_set_gli

  • ida_kernwin.DP_RIGHT

  • ida_kernwin.IDAViewWrapper

  • ida_kernwin.MFF_FAST

  • ida_kernwin.TCCRT_GRAPH

  • ida_kernwin.execute_sync

  • ida_kernwin.find_widget

  • ida_kernwin.get_custom_viewer_place

  • ida_kernwin.jumpto

  • ida_kernwin.open_disasm_window

  • ida_kernwin.set_dock_pos

  • ida_kernwin.set_view_renderer_type

  • ida_moves.graph_location_info_t


Trigger actions programmatically

It's possible to invoke any action programmatically, by using either of those two:

  • ida_kernwin.execute_ui_requests()

  • ida_kernwin.process_ui_action()

Ideally, this script should be run through the "File > Script file..." menu, so as to keep focus on "IDA View-A" and have the 'ProcessUiActions' part work as intended.

Source code
Keywords
Level

actions

Intermediate

APIs Used:

  • ida_kernwin.ask_yn

  • ida_kernwin.execute_ui_requests

  • ida_kernwin.msg

  • ida_kernwin.process_ui_action


Advanced usage of the form API

How to query for complex user input, using IDA's built-in forms.

Note: while this example produces full-fledged forms for complex input, simpler types of inputs might can be retrieved by using ida_kernwin.ask_str and similar functions.

Source code
Keywords
Level

forms

Advanced

APIs Used:

  • ida_kernwin.Choose

  • ida_kernwin.Choose.CH_MULTI

  • ida_kernwin.Form

  • ida_kernwin.PluginForm.FORM_TAB

  • ida_kernwin.ask_str


Restore custom widgets across sessions

This is an example demonstrating how one can create widgets from a plugin, and have them re-created automatically at IDA startup-time or at desktop load-time.

This example should be placed in the 'plugins' directory of the IDA installation, for it to work.

There are 2 ways to use this example:

  1. reloading an IDB, where the widget was opened

    • open the widget ('View > Open subview > ...')

    • save this IDB, and close IDA

    • restart IDA with this IDB => the widget will be visible

  2. reloading a desktop, where the widget was opened

    • open the widget ('View > Open subview > ...')

    • save the desktop ('Windows > Save desktop...') under, say, the name 'with_auto'

    • start another IDA instance with some IDB, and load that desktop => the widget will be visible

Source code
Keywords
Level

desktop plugin UI_Hooks

Advanced

APIs Used:

  • ida_idaapi.plugin_t

  • ida_kernwin.AST_ENABLE_ALWAYS

  • ida_kernwin.SETMENU_APP

  • ida_kernwin.UI_Hooks

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_menu

  • ida_kernwin.find_widget

  • ida_kernwin.register_action

  • ida_kernwin.simplecustviewer_t

  • ida_kernwin.simplecustviewer_t.Create


Showing tabular data in a flat, or tree-like fashion

By adding the necessary bits to a ida_kernwin.Choose subclass, IDA can show the otherwise tabular data, in a tree-like fashion.

The important bits to enable this are:

  • ida_dirtree.dirspec_t (and my_dirspec_t)

  • ida_kernwin.CH_HAS_DIRTREE

  • ida_kernwin.Choose.OnGetDirTree

  • ida_kernwin.Choose.OnIndexToInode

Source code
Keywords
Level

actions chooser folders

Advanced

APIs Used:

  • ida_dirtree.DTE_OK

  • ida_dirtree.direntry_t

  • ida_dirtree.direntry_t.BADIDX

  • ida_dirtree.dirspec_t

  • ida_dirtree.dirtree_t

  • ida_dirtree.dirtree_t.isdir

  • ida_kernwin.CH_CAN_DEL

  • ida_kernwin.CH_CAN_EDIT

  • ida_kernwin.CH_CAN_INS

  • ida_kernwin.CH_HAS_DIRTREE

  • ida_kernwin.CH_MULTI

  • ida_kernwin.Choose

  • ida_kernwin.Choose.ALL_CHANGED

  • ida_kernwin.Choose.CHCOL_DRAGHINT

  • ida_kernwin.Choose.CHCOL_INODENAME

  • ida_kernwin.Choose.CHCOL_PLAIN

  • ida_kernwin.ask_str

  • ida_netnode.BADNODE

  • ida_netnode.netnode


Colorize lines interactively

This builds upon the ida_kernwin.UI_Hooks.get_lines_rendering_info feature, to provide a quick & easy way to colorize disassembly lines.

Contrary to @colorize_disassembly, the coloring is not persisted in the database, and will therefore be lost after the session.

By triggering the action multiple times, the user can "carousel" across 4 predefined colors (and return to the "no color" state.)

Source code
Keywords
Level

coloring UI_Hooks

Advanced

APIs Used:

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.CK_EXTRA5

  • ida_kernwin.CK_EXTRA6

  • ida_kernwin.CK_EXTRA7

  • ida_kernwin.CK_EXTRA8

  • ida_kernwin.UI_Hooks

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.get_current_viewer

  • ida_kernwin.get_custom_viewer_location

  • ida_kernwin.get_custom_viewer_place_xcoord

  • ida_kernwin.get_widget_title

  • ida_kernwin.line_rendering_output_entry_t

  • ida_kernwin.register_action

  • ida_moves.lochist_entry_t


Add a custom command-line interpreter

Illustrates how one can add command-line interpreters to IDA

This custom interpreter doesn't actually run any code; it's there as a 'getting started'. It provides an example tab completion support.

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_idaapi.NW_CLOSEIDB

  • ida_idaapi.NW_OPENIDB

  • ida_idaapi.NW_REMOVE

  • ida_idaapi.NW_TERMIDA

  • ida_idaapi.notify_when

  • ida_kernwin.cli_t


Draw custom graphs

Showing custom graphs, using ida_graph.GraphViewer. In addition, show how to write actions that can be performed on those.

Source code
Keywords
Level

actions graph View_Hooks

Advanced

APIs Used:

  • ida_funcs.get_func

  • ida_funcs.get_func_name

  • ida_graph.GraphViewer

  • ida_graph.get_graph_viewer

  • ida_graph.screen_graph_selection_t

  • ida_graph.viewer_get_selection

  • ida_idp.is_call_insn

  • ida_kernwin.AST_ENABLE_ALWAYS

  • ida_kernwin.View_Hooks

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_dynamic_action_to_popup

  • ida_kernwin.get_screen_ea

  • ida_ua.decode_insn

  • ida_ua.insn_t

  • ida_xref.XREF_FAR

  • ida_xref.xrefblk_t


Retrieve & dump current selection

Shows how to retrieve the selection from a listing widget ("IDA View-A", "Hex View-1", "Pseudocode-A", ...) as two "cursors", and from there retrieve (in fact, generate) the corresponding text.

After running this script:

  • select some text in one of the listing widgets (i.e., "IDA View-...", "Local Types", "Pseudocode-...")

  • press Ctrl+Shift+S to dump the selection

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_kernwin.ACF_HAS_SELECTION

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_DISASM

  • ida_kernwin.BWN_PSEUDOCODE

  • ida_kernwin.BWN_TILVIEW

  • ida_kernwin.IWID_ANY_LISTING

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.get_last_widget

  • ida_kernwin.get_viewer_user_data

  • ida_kernwin.l_compare2

  • ida_kernwin.linearray_t

  • ida_kernwin.read_selection

  • ida_kernwin.register_action

  • ida_kernwin.twinpos_t

  • ida_kernwin.unregister_action

  • ida_lines.tag_remove


Inject commands in the "Output" window

This example illustrates how one can execute commands in the "Output" window, from their own widgets.

A few notes:

  • the original, underlying cli:Execute action, that has to be triggered for the code present in the input field to execute and be placed in the history, requires that the input field has focus (otherwise it simply won't do anything.)

  • this, in turn, forces us to do "delayed" execution of that action, hence the need for a QTimer

  • the IDA/SWiG 'TWidget' type that we retrieve through ida_kernwin.find_widget, is not the same type as a QtWidgets.QWidget. We therefore need to convert it using ida_kernwin.PluginForm.TWidgetToPyQtWidget

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_kernwin.PluginForm.TWidgetToPyQtWidget

  • ida_kernwin.disabled_script_timeout_t

  • ida_kernwin.find_widget

  • ida_kernwin.process_ui_action


A lazy-loaded, tree-like data view

Brings lazy-loading of folders to the tree-like tabular views.

The important bit to enable this are:

  • ida_kernwin.Choose.OnLazyLoadDir

Source code
Keywords
Level

actions chooser folders

Advanced


Paint text on graph view edges

This sample registers an action enabling painting of a recognizable string of text over horizontal nodes edge sections beyond a satisfying size threshold.

In a disassembly view, open the context menu and select "Paint on edges". This should work for both graph disassembly, and proximity browser.

Using an "event filter", we will intercept paint events targeted at the disassembly view, let it paint itself, and then add our own markers along.

Source code
Keywords
Level

ctxmenu UI_Hooks

Advanced

APIs Used:

  • ida_gdl.edge_t

  • ida_graph.get_graph_viewer

  • ida_graph.get_viewer_graph

  • ida_graph.point_t

  • ida_graph.viewer_get_gli

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_DISASM

  • ida_kernwin.PluginForm.FormToPyQtWidget

  • ida_kernwin.UI_Hooks

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.get_widget_type

  • ida_kernwin.register_action

  • ida_moves.graph_location_info_t


Programmatically manipulate disassembly and graph widgets

This is an example illustrating how to manipulate an existing IDA-provided view (and thus possibly its graph), in Python.

Source code
Keywords
Level

graph idaview

Advanced

APIs Used:

  • ida_graph.NIF_BG_COLOR

  • ida_graph.NIF_FRAME_COLOR

  • ida_graph.node_info_t

  • ida_kernwin.IDAViewWrapper

  • ida_kernwin.MFF_FAST

  • ida_kernwin.TCCRT_FLAT

  • ida_kernwin.TCCRT_GRAPH

  • ida_kernwin.execute_sync


Dump function flowchart

Dumps the current function's flowchart, using 2 methods:

  • the low-level ida_gdl.qflow_chart_t type

  • the somewhat higher-level, and slightly more pythonic ida_gdl.FlowChart type.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_funcs.get_func

  • ida_gdl.FlowChart

  • ida_gdl.qflow_chart_t

  • ida_kernwin.get_screen_ea


Insert information into listing prefixes

By default, disassembly line prefixes contain segment + address information (e.g., '.text:08047718'), but it is possible to "inject" other bits of information in there, thanks to the ida_lines.user_defined_prefix_t helper type.

Source code
Keywords
Level

plugin

Beginner

APIs Used:

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t

  • ida_lines.SCOLOR_INV

  • ida_lines.user_defined_prefix_t


Enumerate file imports

Using the API to enumerate file imports.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_nalt.enum_import_names

  • ida_nalt.get_import_module_name

  • ida_nalt.get_import_module_qty


Enumerate patched bytes

Using the API to iterate over all the places in the file, that were patched using IDA.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_bytes.visit_patched_bytes

  • ida_idaapi.BADADDR


Enumerate known problems

Using the API to list all problems that IDA encountered during analysis.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_ida.inf_get_min_ea

  • ida_idaapi.BADADDR

  • ida_problems.PR_ATTN

  • ida_problems.PR_BADSTACK

  • ida_problems.PR_COLLISION

  • ida_problems.PR_DECIMP

  • ida_problems.PR_DISASM

  • ida_problems.PR_FINAL

  • ida_problems.PR_HEAD

  • ida_problems.PR_ILLADDR

  • ida_problems.PR_JUMP

  • ida_problems.PR_MANYLINES

  • ida_problems.PR_NOBASE

  • ida_problems.PR_NOCMT

  • ida_problems.PR_NOFOP

  • ida_problems.PR_NONAME

  • ida_problems.PR_NOXREFS

  • ida_problems.PR_ROLLED

  • ida_problems.get_problem

  • ida_problems.get_problem_name


List segment functions (and cross-references to them)

List all the functions in the current segment, as well as all the cross-references to them.

Source code
Keywords
Level

xrefs

Beginner

APIs Used:

  • ida_funcs.get_func

  • ida_funcs.get_func_name

  • ida_funcs.get_next_func

  • ida_kernwin.get_screen_ea

  • ida_segment.getseg

  • ida_xref.xrefblk_t


List all functions (and cross-references) in segment

List all the functions in the current segment, as well as all the cross-references to them.

Contrary to @list_segment_functions, this uses the somewhat higher-level idautils module.

Source code
Keywords
Level

xrefs

Beginner

APIs Used:

  • ida_funcs.get_func_name

  • ida_idaapi.BADADDR

  • ida_kernwin.get_screen_ea

  • ida_segment.getseg

  • idautils.CodeRefsTo

  • idautils.Functions


Dump the strings that are present in the file

This uses idautils.Strings to iterate over the string literals that are present in the IDB. Contrary to @show_selected_strings, this will not require that the "Strings" window is opened & available.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_nalt.STRTYPE_C

  • ida_nalt.STRTYPE_C_16

  • idautils.Strings


Produce disassembly listing for the entire file

Automate IDA to perform auto-analysis on a file and, once that is done, produce a .lst file with the disassembly.

Run like so:

  ida -A "-S...path/to/produce_lst_file.py" <binary-file>

where:

  • -A instructs IDA to run in non-interactive mode

  • -S holds a path to the script to run (note this is a single token; there is no space between '-S' and its path.)

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_auto.auto_wait

  • ida_fpro.qfile_t

  • ida_ida.inf_get_max_ea

  • ida_ida.inf_get_min_ea

  • ida_loader.OFILE_LST

  • ida_loader.PATH_TYPE_IDB

  • ida_loader.gen_file

  • ida_loader.get_path

  • ida_pro.qexit


Rewrite the representation of some instructions

Implements disassembly of BUG_INSTR used in Linux kernel BUG() macro, which is architecturally undefined and is not disassembled by IDA's ARM module

See Linux/arch/arm/include/asm/bug.h for more info

Source code
Keywords
Level

IDP_Hooks

Intermediate

APIs Used:

  • ida_bytes.get_wide_dword

  • ida_bytes.get_wide_word

  • ida_idp.CUSTOM_INSN_ITYPE

  • ida_idp.IDP_Hooks

  • ida_idp.PLFM_ARM

  • ida_idp.ph.id

  • ida_idp.str2reg

  • ida_segregs.get_sreg


Implement assembly of instructions

We add support for assembling the following pseudo instructions:

  • "zero eax" -> xor eax, eax

  • "nothing" -> nop

Source code
Keywords
Level

IDP_Hooks

Intermediate

APIs Used:

  • ida_idp.IDP_Hooks

  • idautils.DecodeInstruction


Retrieve comments surrounding instructions

Use the ida_lines.get_extra_cmt API to retrieve anterior and posterior extra comments.

This script registers two actions, that can be used to dump the previous and next extra comments.

Source code
Keywords
Level

ctxmenu

Intermediate

APIs Used:

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_DISASM

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.find_widget

  • ida_kernwin.get_screen_ea

  • ida_kernwin.register_action

  • ida_kernwin.unregister_action

  • ida_lines.E_NEXT

  • ida_lines.E_PREV

  • ida_lines.get_extra_cmt

  • ida_view


Dump function information

Dump some of the most interesting bits of information about the function we are currently looking at.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_funcs.FUNC_FRAME

  • ida_funcs.FUNC_LUMINA

  • ida_funcs.FUNC_OUTLINE

  • ida_funcs.FUNC_THUNK

  • ida_funcs.get_fchunk

  • ida_funcs.is_func_entry

  • ida_funcs.is_func_tail

  • ida_kernwin.get_screen_ea


Using "ida_bytes.find_string"

IDAPython's ida_bytes.find_string can be used to implement a simple replacement for the 'Search > Sequence of bytes...' dialog, that lets users search for sequences of bytes that compose string literals in the binary file (either in the default 1-byte-per-char encoding, or as UTF-16.)

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_bytes.BIN_SEARCH_FORWARD

  • ida_bytes.BIN_SEARCH_NOBREAK

  • ida_bytes.BIN_SEARCH_NOSHOW

  • ida_bytes.find_string

  • ida_ida.inf_get_max_ea

  • ida_idaapi.BADADDR

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_DISASM

  • ida_kernwin.Form

  • ida_kernwin.Form.ChkGroupControl

  • ida_kernwin.Form.StringInput

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.get_screen_ea

  • ida_kernwin.jumpto

  • ida_kernwin.register_action

  • ida_nalt.BPU_1B

  • ida_nalt.BPU_2B

  • ida_nalt.get_default_encoding_idx


Print notifications about function prototype changes

The goal of this script is to demonstrate some usage of the type API. In this script, we will create an IDB hook that intercepts ti_changed IDB events, and if it is a function prototype that changed, print it.

Source code
Keywords
Level

IDB_Hooks

Intermediate

APIs Used:

  • ida_funcs.get_func_name

  • ida_idp.IDB_Hooks

  • ida_typeinf.tinfo_t


List listing bookmarks

This sample shows how to programmatically access the list of bookmarks placed in a listing widget (e.g., "IDA View-A", "Pseudocode-", …) using the low-level ida_moves.bookmarks_t type.

Source code
Keywords
Level

bookmarks

Intermediate

APIs Used:

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.get_current_viewer

  • ida_kernwin.get_viewer_user_data

  • ida_kernwin.get_widget_title

  • ida_kernwin.register_action

  • ida_moves.bookmarks_t


Showcase (some of) the iterators available on a function

This demonstrates how to use some of the iterators available on the func_t type.

This example will focus on:

  • func_t[.__iter__]: the default iterator; iterates on instructions

  • func_t.data_items: iterate on data items contained within a function

  • func_t.head_items: iterate on 'heads' (i.e., addresses containing the start of an instruction, or a data item.

  • func_t.addresses: iterate on all addresses within function (code and data, beginning of an item or not)

Type help(ida_funcs.func_t) for a full list of iterators.

In addition, one can use:

  • func_tail_iterator_t: iterate on all the chunks (including the main one) of the function

  • func_parent_iterator_t: iterate on all the parent functions, that include this chunk

Source code
Keywords
Level

funcs iterator

Intermediate

APIs Used:

  • ida_bytes.get_flags

  • ida_bytes.is_code

  • ida_bytes.is_data

  • ida_bytes.is_tail

  • ida_bytes.is_unknown

  • ida_funcs.func_tail_iterator_t

  • ida_funcs.get_fchunk

  • ida_funcs.get_func

  • ida_funcs.get_func_name

  • ida_kernwin.get_screen_ea

  • ida_ua.print_insn_mnem


React to database events/notifications

These hooks will be notified about IDB events, and dump their information to the "Output" window

Source code
Keywords
Level

IDB_Hooks

Intermediate

APIs Used:

  • ida_idp.IDB_Hooks


React to processor events/notifications

These hooks will be notified about IDP events, and dump their information to the "Output" window

Source code
Keywords
Level

IDP_Hooks

Intermediate

APIs Used:

  • ida_idp.IDP_Hooks


Record and replay changes in function prototypes

This is a sample script, that will record (in memory) all changes in functions prototypes, in order to re-apply them later.

To use this script:

  • open an IDB (say, "test.idb")

  • modify some functions prototypes (e.g., by triggering the 'Y' shortcut when the cursor is placed on the first address of a function)

  • reload that IDB, without saving it first

  • call rpc.replay(), to re-apply the modifications.

Note: 'ti_changed' is also called for changes to the function frames, but we'll only record function prototypes changes.

Source code
Keywords
Level

IDB_Hooks

Intermediate

APIs Used:

  • ida_funcs.get_func

  • ida_idp.IDB_Hooks

  • ida_typeinf.PRTYPE_1LINE

  • ida_typeinf.TINFO_DEFINITE

  • ida_typeinf.apply_tinfo

  • ida_typeinf.get_idati

  • ida_typeinf.tinfo_t


Add a new member to an existing function frame

The goal of this script is to demonstrate some usage of the type API. In this script, we show a way to add a new frame member (a pointer to an uint64) inside a wide enough gap in the frame:

  • Get the function object surrounding cursor location.

  • Use this function to retrieve the corresponding frame object.

  • Find a wide enough gap to create our new member.

  • If found, we use cal_frame_offset() to get the actual offset in the frame structure.

  • Use the previous result to add the new member.

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_frame.add_frame_member

  • ida_frame.calc_frame_offset

  • ida_frame.get_func_frame

  • ida_funcs.get_func

  • ida_range.rangeset_t

  • ida_typeinf.BTF_UINT64

  • ida_typeinf.tinfo_t

  • idc.here


Custom data types & printers

IDA can be extended to support certain data types that it does not know about out-of-the-box.

A 'custom data type' provide information about the type & size of a piece of data, while a 'custom data format' is in charge of formatting that data (there can be more than one format for a specific 'custom data type'.)

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_bytes.data_format_t

  • ida_bytes.data_type_t

  • ida_bytes.find_custom_data_type

  • ida_bytes.get_byte

  • ida_bytes.register_data_types_and_formats

  • ida_bytes.unregister_data_types_and_formats

  • ida_idaapi.NW_CLOSEIDB

  • ida_idaapi.NW_OPENIDB

  • ida_idaapi.NW_REMOVE

  • ida_idaapi.NW_TERMIDA

  • ida_idaapi.notify_when

  • ida_idaapi.struct_unpack

  • ida_lines.COLSTR

  • ida_lines.SCOLOR_IMPNAME

  • ida_lines.SCOLOR_INSN

  • ida_lines.SCOLOR_NUMBER

  • ida_lines.SCOLOR_REG

  • ida_nalt.get_input_file_path

  • ida_netnode.netnode

  • ida_typeinf.tinfo_t


List operands representing a "path" to a (possibly nested) structure member

It is possible to assign, to instruction operands, the notion of "structure offset", which really is a pointer to a specific offset in a type, leading to a possible N-deep path within types.

E.g., assuming the following types

    struct c
    {
        int foo;
        int bar;
        int baz;
        int quux;
        int trail;
    };

    struct b
    {
        int gap;
        c c_instance;
    };

    struct a
    {
        int count;
        b b_instance;
    };

and assuming an instruction that initially looks like this:

    mov eax, 10h

by pressing t, the user will be able set the "structure offset" to either:

  • c.trail

  • b.c_instance.quux

  • a.b_inscance.c_instance.baz

Here's why IDA offers a.b_inscance.c_instance.baz:

    0000   struct a
           {
    0000       int count;
    0004       struct b
               {
    0004           int gap;
    0008           struct c
                   {
    0008               int foo;
    000C               int bar;
    0010               int baz;
    0014               int quux;
    0018               int trail;
                   };
               };
           };

This sample shows how to programmatically retrieve information about that "structure member path" that an operand was made pointing to.

Source code
Keywords
Level

bookmarks

Advanced

APIs Used:

  • ida_bytes.get_full_flags

  • ida_bytes.get_stroff_path

  • ida_bytes.is_stroff

  • ida_typeinf.get_tid_name

  • ida_typeinf.tinfo_t

  • ida_ua.decode_insn

  • ida_ua.insn_t

  • ida_ua.o_imm

  • ida_ua.o_void


Notify the user when an instruction operand changes

Show notifications whenever the user changes an instruction's operand, or a data item.

Source code
Keywords
Level

IDB_Hooks

Advanced

APIs Used:

  • ida_bytes.ALOPT_IGNCLT

  • ida_bytes.ALOPT_IGNHEADS

  • ida_bytes.get_flags

  • ida_bytes.get_max_strlit_length

  • ida_bytes.get_opinfo

  • ida_bytes.get_strlit_contents

  • ida_bytes.is_custfmt

  • ida_bytes.is_custom

  • ida_bytes.is_enum

  • ida_bytes.is_off

  • ida_bytes.is_strlit

  • ida_bytes.is_stroff

  • ida_bytes.is_struct

  • ida_idp.IDB_Hooks

  • ida_nalt.STRENC_DEFAULT

  • ida_nalt.get_default_encoding_idx

  • ida_nalt.get_encoding_name

  • ida_nalt.get_str_encoding_idx

  • ida_nalt.get_strtype_bpu

  • ida_nalt.opinfo_t

  • ida_typeinf.get_tid_name

  • ida_typeinf.tinfo_t


Produce C listing for the entire file

Automate IDA to perform auto-analysis on a file and, once that is done, produce a .c file containing the decompilation of all the functions in that file.

Run like so:

  ida -A "-S...path/to/produce_c_file.py" <binary-file>

where:

  • -A instructs IDA to run in non-interactive mode

  • -S holds a path to the script to run (note this is a single token; there is no space between '-S' and its path.)

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_auto.auto_wait

  • ida_hexrays.VDRUN_MAYSTOP

  • ida_hexrays.VDRUN_NEWFILE

  • ida_hexrays.VDRUN_SILENT

  • ida_hexrays.decompile_many

  • ida_loader.PATH_TYPE_IDB

  • ida_loader.get_path

  • ida_pro.qexit


Decompile & print current function

Decompile the function under the cursor

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_funcs.get_func

  • ida_hexrays.decompile

  • ida_hexrays.get_hexrays_version

  • ida_hexrays.init_hexrays_plugin

  • ida_kernwin.get_screen_ea

  • ida_lines.tag_remove


Generate microcode for the selected range of instructions

Generates microcode for selection and dumps it to the output window.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_bytes.get_flags

  • ida_bytes.is_code

  • ida_hexrays.DECOMP_WARNINGS

  • ida_hexrays.gen_microcode

  • ida_hexrays.hexrays_failure_t

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.mba_ranges_t

  • ida_hexrays.vd_printer_t

  • ida_kernwin.read_range_selection

  • ida_kernwin.warning

  • ida_range.range_t


Dump statement blocks

Using a ida_hexrays.ctree_visitor_t, search for ida_hexrays.cit_block instances and dump them.

Source code
Keywords
Level

Hexrays_Hooks

Beginner

APIs Used:

  • ida_hexrays.CMAT_BUILT

  • ida_hexrays.CV_FAST

  • ida_hexrays.Hexrays_Hooks

  • ida_hexrays.cit_block

  • ida_hexrays.ctree_visitor_t

  • ida_hexrays.init_hexrays_plugin


Provide custom decompiler hints

Handle ida_hexrays.hxe_create_hint notification using hooks, to return our own.

If the object under the cursor is:

  • a function call, prefix the original decompiler hint with ==>

  • a local variable declaration, replace the hint with our own in the form of !{varname} (where {varname} is replaced with the variable name)

  • an if statement, replace the hint with our own, saying "condition"

Source code
Keywords
Level

Hexrays_Hooks

Beginner

APIs Used:

  • ida_hexrays.Hexrays_Hooks

  • ida_hexrays.USE_MOUSE

  • ida_hexrays.VDI_EXPR

  • ida_hexrays.VDI_LVAR

  • ida_hexrays.cit_if

  • ida_hexrays.cot_call


Interactively color decompilation lines

Provides an action that can be used to dynamically alter the lines background rendering for pseudocode listings (as opposed to using ida_hexrays.cfunc_t.pseudocode[N].bgcolor)

After running this script, pressing 'M' on a line in a "Pseudocode-?" widget, will cause that line to be rendered with a special background color.

Source code
Keywords
Level

colors UI_Hooks

Intermediate

APIs Used:

  • ida_hexrays.get_widget_vdui

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_PSEUDOCODE

  • ida_kernwin.CK_EXTRA11

  • ida_kernwin.UI_Hooks

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.get_custom_viewer_location

  • ida_kernwin.line_rendering_output_entry_t

  • ida_kernwin.refresh_custom_viewer

  • ida_kernwin.register_action

  • ida_moves.lochist_entry_t


Decompile entrypoint automatically

Attempts to load a decompiler plugin corresponding to the current architecture right after auto-analysis is performed, and then tries to decompile the function at the first entrypoint.

It is particularly suited for use with the '-S' flag, for example: idat -Ldecompile.log -Sdecompile_entry_points.py -c file

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_auto.auto_wait

  • ida_entry.get_entry

  • ida_entry.get_entry_ordinal

  • ida_entry.get_entry_qty

  • ida_hexrays.decompile

  • ida_hexrays.init_hexrays_plugin

  • ida_idp.PLFM_386

  • ida_idp.PLFM_ARM

  • ida_idp.PLFM_MIPS

  • ida_idp.PLFM_PPC

  • ida_idp.PLFM_RISCV

  • ida_idp.ph.id

  • ida_kernwin.cvar.batch

  • ida_kernwin.msg

  • ida_loader.load_plugin

  • ida_pro.qexit

  • idc.get_idb_path


Add custom microcode instruction optimization rule

Installs a custom microcode instruction optimization rule, to transform:

call   !DbgRaiseAssertionFailure <fast:>.0

into

call   !DbgRaiseAssertionFailure <fast:"char *" "assertion text">.0

To see this plugin in action please use arm64_brk.i64

Source code
Keywords
Level

plugin

Intermediate

APIs Used:

  • ida_bytes.get_cmt

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.mop_str

  • ida_hexrays.optinsn_t

  • ida_idaapi.PLUGIN_HIDE

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t

  • ida_typeinf.STI_PCCHAR

  • ida_typeinf.tinfo_t.get_stock


Dynamically provide a custom call type

This plugin can greatly improve decompilation of indirect calls:

call    [eax+4]

For them, the decompiler has to guess the prototype of the called function. This has to be done at a very early phase of decompilation because the function prototype influences the data flow analysis. On the other hand, we do not have global data flow analysis results yet because we haven't analyzed all calls in the function. It is a chicked-and-egg problem.

The decompiler uses various techniques to guess the called function prototype. While it works very well, it may fail in some cases.

To fix, the user can specify the call prototype manually, using "Edit, Operand types, Set operand type" at the call instruction.

This plugin illustrates another approach to the problem: if you happen to be able to calculate the call prototypes dynamically, this is how to inform the decompiler about them.

Source code
Keywords
Level

Hexrays_Hooks plugin

Intermediate

APIs Used:

  • ida_hexrays.Hexrays_Hooks

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.m_call

  • ida_hexrays.mcallinfo_t

  • ida_idaapi.PLUGIN_HIDE

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t

  • ida_kernwin.msg

  • ida_kernwin.warning

  • ida_nalt.get_op_tinfo

  • ida_typeinf.BT_INT

  • ida_typeinf.CM_CC_STDCALL

  • ida_typeinf.CM_N32_F48

  • ida_typeinf.parse_decl

  • ida_typeinf.tinfo_t


Dump user-defined information for a function

Prints user-defined information to the "Output" window. Namely:

  • user defined label names

  • user defined indented comments

  • user defined number formats

  • user defined local variable names, types, comments

This script loads information from the database without decompiling anything.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_bytes.get_radix

  • ida_funcs.get_func

  • ida_hexrays.CIT_COLLAPSED

  • ida_hexrays.NF_NEGATE

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.lvar_uservec_t

  • ida_hexrays.restore_user_cmts

  • ida_hexrays.restore_user_iflags

  • ida_hexrays.restore_user_labels

  • ida_hexrays.restore_user_lvar_settings

  • ida_hexrays.restore_user_numforms

  • ida_hexrays.user_cmts_free

  • ida_hexrays.user_iflags_free

  • ida_hexrays.user_labels_free

  • ida_hexrays.user_numforms_free

  • ida_kernwin.get_screen_ea


Superficially modify the decompilation output

Modifies the decompilation output in a superficial manner, by removing some white spaces

Note: this is rather crude, not quite "pythonic" code.

Source code
Keywords
Level

Hexrays_Hooks plugin

Intermediate

APIs Used:

  • ida_hexrays.Hexrays_Hooks

  • ida_hexrays.init_hexrays_plugin

  • ida_idaapi.PLUGIN_HIDE

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t

  • ida_lines.tag_advance

  • ida_lines.tag_skipcodes


Improve decompilation by turning specific patterns into custom function calls

Registers an action that uses a ida_hexrays.udc_filter_t to decompile svc 0x900001 and svc 0x9000F8 as function calls to svc_exit() and svc_exit_group() respectively.

You will need to have an ARM + Linux IDB for this script to be usable

In addition to having a shortcut, the action will be present in the context menu.

Source code
Keywords
Level

ctxmenu UI_Hooks

Intermediate

APIs Used:

  • ida_allins.ARM_svc

  • ida_hexrays.get_widget_vdui

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.install_microcode_filter

  • ida_hexrays.udc_filter_t

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_PSEUDOCODE

  • ida_kernwin.UI_Hooks

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.get_widget_type

  • ida_kernwin.register_action


React to decompiler events/notifications

Shows how to hook to many notifications sent by the decompiler.

This plugin doesn't really accomplish anything: it just prints the parameters.

The list of notifications handled below should be exhaustive, and is there to hint at what is possible to accomplish by subclassing ida_hexrays.Hexrays_Hooks

Source code
Keywords
Level

Hexrays_Hooks

Intermediate

APIs Used:

  • ida_hexrays.Hexrays_Hooks

  • ida_hexrays.cfunc_t

  • ida_hexrays.lvar_t

  • ida_hexrays.vdui_t


Modifying function local variables

Use a ida_hexrays.user_lvar_modifier_t to modify names, comments and/or types of local variables.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_hexrays.modify_user_lvars

  • ida_hexrays.user_lvar_modifier_t

  • ida_typeinf.parse_decl

  • idc.here


Print information about the current position in decompilation

Shows how user input information can be retrieved during processing of a notification triggered by that input

Source code
Keywords
Level

Hexrays_Hooks

Advanced

APIs Used:

  • ida_hexrays.Hexrays_Hooks

  • ida_kernwin.get_user_input_event

  • ida_kernwin.iek_key_press

  • ida_kernwin.iek_key_release

  • ida_kernwin.iek_mouse_button_press

  • ida_kernwin.iek_mouse_button_release

  • ida_kernwin.iek_mouse_wheel

  • ida_kernwin.iek_shortcut

  • ida_kernwin.input_event_t


Add a custom microcode block optimization rule

Installs a custom microcode block optimization rule, to transform:

  goto L1
  ...
L1:
  goto L2

into

  goto L2

In other words we fix a goto target if it points to a chain of gotos. This improves the decompiler output in some cases.

Source code
Keywords
Level

plugin

Advanced

APIs Used:

  • ida_hexrays.getf_reginsn

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.m_goto

  • ida_hexrays.optblock_t

  • ida_idaapi.PLUGIN_HIDE

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t


List instruction registers

Shows a list of direct references to a register from the current instruction.

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_bytes.get_flags

  • ida_bytes.is_code

  • ida_funcs.get_func

  • ida_hexrays.ACFL_GUESS

  • ida_hexrays.DECOMP_NO_CACHE

  • ida_hexrays.DECOMP_WARNINGS

  • ida_hexrays.GCO_DEF

  • ida_hexrays.GCO_USE

  • ida_hexrays.GC_REGS_AND_STKVARS

  • ida_hexrays.MERR_OK

  • ida_hexrays.MMAT_PREOPTIMIZED

  • ida_hexrays.MUST_ACCESS

  • ida_hexrays.gco_info_t

  • ida_hexrays.gen_microcode

  • ida_hexrays.get_current_operand

  • ida_hexrays.get_merror_desc

  • ida_hexrays.hexrays_failure_t

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.mba_ranges_t

  • ida_hexrays.mlist_t

  • ida_hexrays.op_parent_info_t

  • ida_hexrays.voff_t

  • ida_kernwin.Choose

  • ida_kernwin.get_screen_ea

  • ida_kernwin.jumpto

  • ida_kernwin.warning

  • ida_lines.GENDSM_REMOVE_TAGS

  • ida_lines.generate_disasm_line

  • ida_pro.eavec_t


Invoke the structure offset-choosing dialog from decompilation

Registers an action opens the "Select offsets" widget (select_udt_by_offset() call).

This effectively repeats the functionality already available through Alt+Y.

Place cursor on the union field and press Shift+T

Source code
Keywords
Level

plugin

Advanced

APIs Used:

  • ida_hexrays.USE_KEYBOARD

  • ida_hexrays.cot_add

  • ida_hexrays.cot_cast

  • ida_hexrays.cot_memptr

  • ida_hexrays.cot_memref

  • ida_hexrays.cot_num

  • ida_hexrays.cot_ref

  • ida_hexrays.get_hexrays_version

  • ida_hexrays.get_widget_vdui

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.select_udt_by_offset

  • ida_hexrays.ui_stroff_applicator_t

  • ida_hexrays.ui_stroff_ops_t

  • ida_idaapi.BADADDR

  • ida_idaapi.PLUGIN_HIDE

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_PSEUDOCODE

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.get_custom_viewer_curline

  • ida_kernwin.msg

  • ida_kernwin.register_action

  • ida_kernwin.warning

  • ida_lines.tag_remove

  • ida_typeinf.PRTYPE_1LINE

  • ida_typeinf.print_tinfo

  • ida_typeinf.remove_pointer


Add a custom microcode instruction optimization rule

Installs a custom microcode instruction optimization rule, to transform:

x | ~x

into

-1

To see this plugin in action please use be_ornot_be.idb

Source code
Keywords
Level

plugin

Advanced

APIs Used:

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.m_bnot

  • ida_hexrays.m_mov

  • ida_hexrays.m_or

  • ida_hexrays.minsn_visitor_t

  • ida_hexrays.mop_t

  • ida_hexrays.optinsn_t

  • ida_idaapi.PLUGIN_HIDE

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t


Invert if/else blocks in decompilation

Registers an action that can be used to invert the if and else blocks of a ida_hexrays.cif_t.

For example, a statement like

if ( cond )
{
  statements1;
}
else
{
  statements2;
}

will be displayed as

if ( !cond )
{
  statements2;
}
else
{
  statements1;
}

The modifications are persistent: the user can quit & restart IDA, and the changes will be present.

Source code
Keywords
Level

ctxmenu Hexrays_Hooks IDP_Hooks plugin

Advanced

APIs Used:

  • ida_hexrays.CMAT_FINAL

  • ida_hexrays.CV_FAST

  • ida_hexrays.CV_INSNS

  • ida_hexrays.Hexrays_Hooks

  • ida_hexrays.ITP_ELSE

  • ida_hexrays.USE_KEYBOARD

  • ida_hexrays.VDI_TAIL

  • ida_hexrays.cexpr_t

  • ida_hexrays.cit_if

  • ida_hexrays.ctree_visitor_t

  • ida_hexrays.get_widget_vdui

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.lnot

  • ida_hexrays.qswap

  • ida_idaapi.PLUGIN_HIDE

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t

  • ida_idp.IDP_Hooks

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_PSEUDOCODE

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.register_action

  • ida_netnode.netnode


Dump C-tree graph

Registers an action that can be used to show the graph of the ctree. The current item will be highlighted in the graph.

The command shortcut is Ctrl+Shift+G, and is also added to the context menu.

To display the graph, we produce a .gdl file, and request that ida displays that using ida_gdl.display_gdl.

Source code
Keywords
Level

ctxmenu Hexrays_Hooks plugin

Advanced

APIs Used:

  • ida_gdl.display_gdl

  • ida_hexrays.Hexrays_Hooks

  • ida_hexrays.USE_KEYBOARD

  • ida_hexrays.cit_asm

  • ida_hexrays.cit_goto

  • ida_hexrays.cot_helper

  • ida_hexrays.cot_memptr

  • ida_hexrays.cot_memref

  • ida_hexrays.cot_num

  • ida_hexrays.cot_obj

  • ida_hexrays.cot_ptr

  • ida_hexrays.cot_str

  • ida_hexrays.cot_var

  • ida_hexrays.ctree_parentee_t

  • ida_hexrays.get_ctype_name

  • ida_hexrays.get_widget_vdui

  • ida_hexrays.init_hexrays_plugin

  • ida_idaapi.PLUGIN_HIDE

  • ida_idaapi.PLUGIN_KEEP

  • ida_idaapi.plugin_t

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_PSEUDOCODE

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.register_action

  • ida_kernwin.warning

  • ida_lines.tag_remove

  • ida_pro.str2user


Show decompiler cross-references

Show decompiler-style Xref when the Ctrl+X key is pressed in the Decompiler window.

  • supports any global name: functions, strings, integers, ...

  • supports structure member.

Source code
Keywords
Level

ctxmenu Hexrays_Hooks

Advanced

APIs Used:

  • ida_funcs.get_func_name

  • ida_hexrays.DECOMP_GXREFS_FORCE

  • ida_hexrays.Hexrays_Hooks

  • ida_hexrays.USE_KEYBOARD

  • ida_hexrays.VDI_EXPR

  • ida_hexrays.VDI_FUNC

  • ida_hexrays.cexpr_t

  • ida_hexrays.cfunc_t

  • ida_hexrays.cinsn_t

  • ida_hexrays.decompile

  • ida_hexrays.get_widget_vdui

  • ida_hexrays.init_hexrays_plugin

  • ida_hexrays.open_pseudocode

  • ida_hexrays.qstring_printer_t

  • ida_idaapi.BADADDR

  • ida_kernwin.AST_DISABLE

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE

  • ida_kernwin.BWN_PSEUDOCODE

  • ida_kernwin.PluginForm

  • ida_kernwin.PluginForm.Show

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.register_action

  • ida_typeinf.PRTYPE_1LINE

  • ida_typeinf.STRMEM_OFFSET

  • ida_typeinf.print_tinfo

  • ida_typeinf.tinfo_t

  • ida_typeinf.udm_t

  • idautils.Functions

  • idautils.XrefsTo


Print all registers, for all threads in the debugged process

Iterate over the list of threads in the program being debugged, and dump all registers contents

To use this example:

  • run ida64 on test program simple_appcall_linux64, or ida on test program simple_appcall_linux32, and wait for auto-analysis to finish

  • put a breakpoint somewhere in the code

  • select the 'linux debugger' (either local, or remote)

  • start debugging

  • Press Alt+Shift+C at the breakpoint

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_dbg.get_reg_vals

  • ida_dbg.get_thread_qty

  • ida_dbg.getn_thread

  • ida_idd.get_dbg

  • ida_kernwin.AST_ENABLE_ALWAYS

  • ida_kernwin.action_desc_t

  • ida_kernwin.register_action


Dump symbols from a process being debugged

Queries the debugger (possibly remotely) for the list of symbols that the process being debugged, provides.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_dbg.DSTATE_SUSP

  • ida_dbg.get_process_state

  • ida_dbg.is_debugger_on

  • ida_ida.inf_get_max_ea

  • ida_ida.inf_get_min_ea

  • ida_name.get_debug_names


Print call stack

Print the return addresses from the call stack at a breakpoint, when debugging a Linux binary. (and also print the module and the debug name from debugger)

To use this example:

  • run ida on test program simple_appcall_linux64, or ida on test program simple_appcall_linux32, and wait for auto-analysis to finish

  • put a breakpoint where you want to see the call stack

  • select the 'linux debugger' (either local, or remote)

  • start debugging

  • Press Shift+C at the breakpoint

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_dbg.collect_stack_trace

  • ida_dbg.get_current_thread

  • ida_dbg.get_module_info

  • ida_idd.call_stack_t

  • ida_idd.modinfo_t

  • ida_kernwin.AST_ENABLE_ALWAYS

  • ida_kernwin.action_desc_t

  • ida_kernwin.register_action

  • ida_name.GNCN_NOCOLOR

  • ida_name.GNCN_NOLABEL

  • ida_name.GNCN_NOSEG

  • ida_name.GNCN_PREFDBG

  • ida_name.get_nice_colored_name


Add a custom action to the "registers" widget

It's possible to add actions to the context menu of pretty much all widgets in IDA.

This example shows how to do just that for registers-displaying widgets (e.g., "General registers")

Source code
Keywords
Level

ctxmenu UI_Hooks

Intermediate

APIs Used:

  • ida_dbg.get_dbg_reg_info

  • ida_dbg.get_reg_val

  • ida_idd.register_info_t

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_CPUREGS

  • ida_kernwin.UI_Hooks

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.attach_action_to_popup

  • ida_kernwin.get_widget_type

  • ida_kernwin.register_action

  • ida_ua.dt_byte

  • ida_ua.dt_dword

  • ida_ua.dt_qword

  • ida_ua.dt_word


Programmatically drive a debugging session

Start a debugging session, step through the first five instructions. Each instruction is disassembled after execution.

Source code
Keywords
Level

DBG_Hooks

Advanced

APIs Used:

  • ida_dbg.DBG_Hooks

  • ida_dbg.get_reg_val

  • ida_dbg.request_exit_process

  • ida_dbg.request_run_to

  • ida_dbg.request_step_over

  • ida_dbg.run_requests

  • ida_ida.inf_get_start_ip

  • ida_idaapi.BADADDR

  • ida_lines.generate_disasm_line

  • ida_lines.tag_remove


React to trace notifications

This script demonstrates using the low-level tracing hook (ida_dbg.DBG_Hooks.dbg_trace). It can be run like so:

 ida.exe -B -Sdbg_trace.py -Ltrace.log file.exe
Source code
Keywords
Level

DBG_Hooks

Advanced

APIs Used:

  • GENDSM_FORCE_CODE

  • GENDSM_REMOVE_TAGS

  • NN_call

  • NN_callfi

  • NN_callni

  • generate_disasm_line

  • ida_dbg.DBG_Hooks

  • ida_dbg.ST_OVER_DEBUG_SEG

  • ida_dbg.ST_OVER_LIB_FUNC

  • ida_dbg.enable_step_trace

  • ida_dbg.get_process_state

  • ida_dbg.get_reg_val

  • ida_dbg.get_step_trace_options

  • ida_dbg.load_debugger

  • ida_dbg.refresh_debugger_memory

  • ida_dbg.request_continue_process

  • ida_dbg.request_enable_step_trace

  • ida_dbg.request_set_step_trace_options

  • ida_dbg.run_requests

  • ida_dbg.run_to

  • ida_dbg.set_step_trace_options

  • ida_dbg.wait_for_next_event

  • ida_ida.f_ELF

  • ida_ida.f_MACHO

  • ida_ida.f_PE

  • ida_ida.inf_get_filetype

  • ida_ida.inf_get_max_ea

  • ida_ida.inf_get_min_ea

  • ida_ida.inf_get_start_ip

  • ida_pro.qexit

  • ida_ua.decode_insn

  • ida_ua.insn_t

  • idc.ARGV


Execute code into the application being debugged (on Linux)

Using the ida_idd.Appcall utility to execute code in the process being debugged.

This example will run the test program and stop wherever the cursor currently is, and then perform an appcall to execute the ref4 and ref8 functions.

To use this example:

  • run ida64 on test program simple_appcall_linux64, or ida on test program simple_appcall_linux32, and wait for auto-analysis to finish

  • select the 'linux debugger' (either local, or remote)

  • run this script

Note: the real body of code is in simple_appcall_common.py.

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_dbg.DBG_Hooks

  • ida_dbg.run_to

  • ida_idaapi.BADADDR

  • ida_idd.Appcall

  • ida_idd.Appcall.byref

  • ida_idd.Appcall.int64

  • ida_kernwin.get_screen_ea

  • ida_name.get_name_ea

  • ida_name.set_name

  • ida_typeinf.apply_cdecl


Execute code into the application being debugged (on Windows)

Using the ida_idd.Appcall utility to execute code in the process being debugged.

This example will run the test program and stop wherever the cursor currently is, and then perform an appcall to execute the ref4 and ref8 functions.

To use this example:

  • run ida on test program simple_appcall_win64.exe, or ida on test program simple_appcall_win32.exe, and wait for auto-analysis to finish

  • select the 'windows debugger' (either local, or remote)

  • run this script

Note: the real body of code is in simple_appcall_common.py.

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_dbg.DBG_Hooks

  • ida_dbg.run_to

  • ida_ida.inf_is_64bit

  • ida_idaapi.BADADDR

  • ida_idd.Appcall

  • ida_idd.Appcall.byref

  • ida_idd.Appcall.int64

  • ida_kernwin.get_screen_ea

  • ida_name.get_name_ea

  • ida_name.set_name

  • ida_typeinf.apply_cdecl


Create a structure by parsing its definition

The goal of this script is to demonstrate some usage of the type API. In this script, we create a structure using the "parsing" method.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_typeinf.tinfo_t


Delete structure members that fall within an offset range

The goal of this script is to demonstrate some usage of the type API. In this script, we first create a structure with many members, and then remove all those that fall within a range.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_typeinf.STRMEM_OFFSET

  • ida_typeinf.TERR_OK

  • ida_typeinf.tinfo_t

  • ida_typeinf.udm_t


Print enumeration members

In this example, we will first ask the user to provide the name of an enumeration, and then iterate on it

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_kernwin.ask_str


Print function stack frame information

The goal of this script is to demonstrate some usage of the type API. In this script, we retrieve the function frame structure, and iterate on the frame members.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_funcs.get_func

  • ida_kernwin.get_screen_ea


List database functions prototypes

This script demonstrates how to list a function return type along with its parameters types and name if any. We do this for all the functions found in the database.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_funcs.get_func

  • idautils.Functions


List structure members

The goal of this script is to demonstrate some usage of the type API. In this script, we:

  • Ask the user for a structure name. It must already be present in the local types.

  • Retrieve the structure type info from the local type

  • Extract its type details (udt)

  • Iterates it members and prints their names.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_kernwin.ask_str

  • ida_typeinf.BTF_STRUCT

  • ida_typeinf.get_idati

  • ida_typeinf.tinfo_t

  • ida_typeinf.udt_type_data_t


List cross-references to a structure

The goal of this script is to demonstrate some usage of the type API. In this script, we:

  • Ask the user for a structure name. It must already be present in the local types.

  • Get its tid

  • Create the list of all the reference.

  • Print it

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_kernwin.choose_struct

  • ida_typeinf.tinfo_t

  • ida_xref.xrefblk_t


List union members

The goal of this script is to demonstrate some usage of the type API. In this script, we:

  • Ask the user for a union name. It must already be present in the local types.

  • Retrieve the union type info from the local type

  • Extract its type details (udt)

  • Iterates it members and prints their names.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_kernwin.ask_str

  • ida_typeinf.BTF_UNION

  • ida_typeinf.get_idati

  • ida_typeinf.tinfo_t

  • ida_typeinf.udt_type_data_t


Mark a register "spoiled" by a function

At least two possibilies are offered in order to indicate that a function spoils registers (excluding the "normal" ones):

You can either parse & apply a declaration:

  func_tfinfo = ida_typeinf.tinfo_t("int _spoils<rsi> main();")
  ida_typeinf.apply_tinfo(func.start_ea, func_tinfo, ida_typeinf.TINFO_DEFINITE)

or retrieve & modify the tinfo_t object directly.

This script showcases the latter.

Source code
Keywords
Level

Beginner

APIs Used:

  • ida_funcs.get_func

  • ida_idp.parse_reg_name

  • ida_idp.reg_info_t

  • ida_kernwin.get_screen_ea

  • ida_nalt.get_tinfo

  • ida_typeinf.FTI_SPOILED

  • ida_typeinf.TINFO_DEFINITE

  • ida_typeinf.apply_tinfo

  • ida_typeinf.func_type_data_t

  • ida_typeinf.tinfo_t


Apply function prototype to call sites

The goal of this script is to demonstrate some usage of the type API. In this script, we:

  • Open the private type libary.

  • Load its declaration in the type library by parsing its declaration and keep the return tuple for future use.

  • Deserialize the type info stored in the returned tuple.

  • Get the address of the function.

  • Get the address of the code reference to the function and apply the type info there.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_idaapi.BADADDR

  • ida_name.get_name_ea

  • ida_typeinf.PT_REPLACE

  • ida_typeinf.apply_callee_tinfo

  • ida_typeinf.get_idati

  • ida_typeinf.idc_parse_decl

  • ida_typeinf.tinfo_t

  • idautils.CodeRefsTo


Create an array type

The goal of this script is to demonstrate some usage of the type API. In this script, we create an array using both versions of create_array tinfo_t method.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.BTF_INT

  • ida_typeinf.array_type_data_t

  • ida_typeinf.tinfo_t


Create a structure with bitfield members

The goal of this script is to demonstrate some usage of the type API. In this script, we:

  • Create a bitfield structure. In the present case the bitfield is an int32 made of three 'members' spanning it entirely: bit0->bit19: bf1 bit20->bit25: bf2 bit26->bit31: bf3

  • For each member create a repeatable comment.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.tinfo_t

  • ida_typeinf.udm_t

  • ida_typeinf.udt_type_data_t


Create a bitmask enumeration

The goal of this script is to demonstrate some usage of the type API. In this script, we create a bitmask enumeration member by member.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.BTE_BITMASK

  • ida_typeinf.BTE_HEX

  • ida_typeinf.tinfo_t


Create a type library file

The goal of this script is to demonstrate some usage of the type API. In this script:

  • We create a new libssh2-64.til file holding some libssh2 64-bit structures.

  • Once the file has been created, it can copied in the IDA install til directory or in the user IDA til directory.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.HTI_DCL

  • ida_typeinf.HTI_PAKDEF

  • ida_typeinf.compact_til

  • ida_typeinf.free_til

  • ida_typeinf.new_til

  • ida_typeinf.parse_decls

  • ida_typeinf.store_til


Create a structure programmatically

The goal of this script is to demonstrate some usage of the type API. In this script, we create a structure by building it member by member.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.BTF_UINT32

  • ida_typeinf.NTF_TYPE

  • ida_typeinf.del_named_type

  • ida_typeinf.tinfo_errstr

  • ida_typeinf.tinfo_t

  • ida_typeinf.udt_type_data_t


Create & populate a structure

Usage of the API to create & populate a structure with members of different types.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.BTF_BYTE

  • ida_typeinf.BTF_DOUBLE

  • ida_typeinf.BTF_FLOAT

  • ida_typeinf.BTF_INT

  • ida_typeinf.BTF_INT128

  • ida_typeinf.BTF_INT16

  • ida_typeinf.BTF_INT64

  • ida_typeinf.BTF_TBYTE

  • ida_typeinf.BTF_UINT32

  • ida_typeinf.FRB_NUMO

  • ida_typeinf.NTF_TYPE

  • ida_typeinf.PRTYPE_DEF

  • ida_typeinf.PRTYPE_MULTI

  • ida_typeinf.PRTYPE_TYPE

  • ida_typeinf.del_named_type

  • ida_typeinf.idc_parse_types

  • ida_typeinf.tinfo_errstr

  • ida_typeinf.tinfo_t

  • ida_typeinf.udm_t

  • ida_typeinf.udt_type_data_t

  • ida_typeinf.value_repr_t


Create a union

The goal of this script is to demonstrate some usage of the type API. In this script, we create a union by building it member after member.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.BTF_CHAR

  • ida_typeinf.BTF_FLOAT

  • ida_typeinf.BTF_INT32

  • ida_typeinf.BTF_UNION

  • ida_typeinf.NTF_TYPE

  • ida_typeinf.PRTYPE_DEF

  • ida_typeinf.PRTYPE_MULTI

  • ida_typeinf.PRTYPE_TYPE

  • ida_typeinf.del_named_type

  • ida_typeinf.tinfo_t

  • ida_typeinf.udm_t

  • ida_typeinf.udt_type_data_t


Create a segment, and define (complex) data in it

The goal of this script is to demonstrate some usage of the type API. In this script, we show how to create, set type and name of a user shared data region in an ntdll IDB:

  • Load the _KUSER_SHARED_DATA data type from a type info library shipped with IDA, and import it into the IDB's "local types"

  • Create a data segment with UserSharedData as its name.

  • Apply the type to the start of the newly created segment base address.

  • Set the address name.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_name.set_name

  • ida_segment.add_segm_ex

  • ida_segment.saRelPara

  • ida_segment.scPub

  • ida_segment.segment_t

  • ida_segment.setup_selector

  • ida_typeinf.TINFO_DEFINITE

  • ida_typeinf.apply_tinfo

  • ida_typeinf.free_til

  • ida_typeinf.load_til


Utilities to detect structure gaps & alignment

The goal of this script is to illustrate ways to detect gaps & alignments in structures, from a structure name & (byte) offset.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_range.rangeset_t


Get member by offset, taking into account variable sized structures

The goal of this script is to provide a way to figure out what structure member, is most likely referenced by an offset.

This also works for variable sized types.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.tinfo_t

  • ida_typeinf.udt_type_data_t


Get information about the "innermost" member of a structure

Assuming the 2 following types:

    struct b
    {
        int low;
        int high;
    };

    struct a
    {
        int foo;
        b b_instance;
        int bar;
    };

looking at an offset of 5 bytes inside an a instance, might be interpreted as pointing somewhere inside member b_instance, of type b. Alternatively, that same offset might be intprereted as pointing somewhere inside low, of type int.

We refer to that latter interpretation as "innermost", and this sample shows how the API lets us "drill down" to retrieve that innermost member.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.get_idati

  • ida_typeinf.parse_decls


Load a type library from a file, and then a type from it

The goal of this script is to demonstrate some usage of the type API. In this script, we:

  • ask the user for a specific til to be lodaed

  • if successfully loaded ask the user for a type name to be imported.

  • append the type to the local types.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_kernwin.ask_str

  • ida_typeinf.load_til


Inject a member in the middle of a structure

This sample will retrieve the type info object by its name, find the member at the specified offset, and insert a new member right before it

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_typeinf.TERR_OK

  • ida_typeinf.tinfo_t


List all xrefs to a function stack variable

Contrary to (in-memory) data & code xrefs, retrieving stack variables xrefs requires a bit more work than just using ida_xref's first_to(), next_to() (or higher level utilities such as idautils.XrefsTo)

Source code
Keywords
Level

xrefs

Intermediate

APIs Used:

  • ida_bytes.get_flags

  • ida_bytes.is_stkvar

  • ida_frame.calc_stkvar_struc_offset

  • ida_funcs.get_func

  • ida_ida.UA_MAXOP

  • ida_kernwin.AST_DISABLE_FOR_WIDGET

  • ida_kernwin.AST_ENABLE_FOR_WIDGET

  • ida_kernwin.BWN_DISASM

  • ida_kernwin.action_desc_t

  • ida_kernwin.action_handler_t

  • ida_kernwin.get_current_viewer

  • ida_kernwin.get_highlight

  • ida_kernwin.get_screen_ea

  • ida_kernwin.register_action

  • ida_typeinf.tinfo_t

  • ida_ua.decode_insn

  • ida_ua.insn_t


List cross-references to function stack frame variables

The goal of this script is to demonstrate some usage of the type API. In this script, we demonstrate how to list each stack variables xref:

  • Get the function object surrounding cursor location.

  • Use this function to retrieve the corresponding frame object.

  • For each frame element:

    • Build the stack variable xref list

    • Print it.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_frame.build_stkvar_xrefs

  • ida_frame.get_func_frame

  • ida_frame.xreflist_t

  • ida_funcs.get_func

  • ida_kernwin.get_screen_ea

  • ida_typeinf.tinfo_t

  • ida_typeinf.udt_type_data_t

  • ida_xref.dr_R

  • ida_xref.dr_W


Assign DOS/PE headers structures to a PE binary

The goal of this script is to demonstrate some usage of the type API.

In this script, we:

  • load a PE64 file in binary mode

  • import some types from the mssdk64 til

  • apply these types at the correct ofsset in the DB

  • finally, rebase the program based on the information stored in the ImageBase field of the IMAGE_OPTIONAL_HEADER64.

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_bytes.create_struct

  • ida_bytes.get_dword

  • ida_bytes.get_qword

  • ida_bytes.get_word

  • ida_hexrays.get_type

  • ida_name.set_name

  • ida_netnode.BADNODE

  • ida_segment.MSF_FIXONCE

  • ida_segment.rebase_program

  • ida_typeinf.ADDTIL_DEFAULT

  • ida_typeinf.BTF_STRUCT

  • ida_typeinf.add_til

  • ida_typeinf.tinfo_t

  • ida_typeinf.udt_type_data_t

  • idc.import_type


Recursively visit a type and its members

In this script, we show an example of tinfo_visitor_t to list a user define type members, recursively.

This scripts skips array & pointer members (by calling tinfo_visitor_t.prune_now())

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_netnode.BADNODE

  • ida_typeinf.ADDTIL_DEFAULT

  • ida_typeinf.TVST_DEF

  • ida_typeinf.add_til

  • ida_typeinf.array_type_data_t

  • ida_typeinf.get_idati

  • ida_typeinf.tinfo_t

  • ida_typeinf.tinfo_visitor_t

  • idc.import_type


Change the name of an existing stack variable

The goal of this script is to demonstrate some usage of the type API. In this script, we demonstrate a way to change the name of a stack variable:

  • Get the function object surrounding cursor location.

  • Use this function to retrieve the corresponding frame object.

  • Find the frame member matching the given name.

  • Using its offset in the frame structure object, calculate the actual stack delta.

  • Use the previous result to redefine the stack variable name if it is not a special or argument member.

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_frame.define_stkvar

  • ida_frame.get_func_frame

  • ida_frame.is_funcarg_off

  • ida_frame.is_special_frame_member

  • ida_frame.soff_to_fpoff

  • ida_funcs.get_func

  • ida_typeinf.tinfo_t

  • ida_typeinf.udm_t

  • idc.here


Change the type & name of a function stack frame variable

The goal of this script is to demonstrate some usage of the type API.

In this script, we show a way to change the type and the name of a stack variable. In this case we will take advantage of the fact that RtlImageNtHeader calls RtlImageNtHeaderEx which takes a pointer to PIMAGE_NT_HEADERS as its fourth parameter and, for this, uses a stack variable of its caller.

  • Get the function object for RtlImageNtHeader.

  • Iterate through the function item to localize the load of the stack variable address before the call to RtlImageNtHeaderEx. We keep this information.

  • Localize the call and take advantage of the previoulsy stored instruction to get the stack variable index in the frame.

  • Set the type and rename the stack variable.

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_allins.NN_call

  • ida_allins.NN_lea

  • ida_frame.get_func_frame

  • ida_funcs.func_item_iterator_t

  • ida_funcs.get_func

  • ida_funcs.get_func_name

  • ida_ida.inf_get_procname

  • ida_ida.inf_is_64bit

  • ida_idaapi.BADADDR

  • ida_name.get_name_ea

  • ida_typeinf.BTF_STRUCT

  • ida_typeinf.TERR_OK

  • ida_typeinf.tinfo_t

  • ida_ua.decode_insn

  • ida_ua.insn_t

  • ida_ua.o_reg

  • idautils.procregs.r9.reg


Turn instruction operand into a structure offset

The goal of this script is to demonstrate some usage of the type API. In this script, we:

  • ask the user to choose the structure that will be used for the conversion.

  • build the structure path and call ida_bytes.op_stroff. In case an enum is found a modal chooser is displayed in order to select a member.

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_bytes.op_stroff

  • ida_kernwin.Choose

  • ida_kernwin.Choose.CHCOL_HEX

  • ida_kernwin.Choose.CHCOL_PLAIN

  • ida_kernwin.choose_struct

  • ida_kernwin.get_opnum

  • ida_kernwin.get_screen_ea

  • ida_pro.tid_array

  • ida_typeinf.STRMEM_OFFSET

  • ida_typeinf.tinfo_t

  • ida_typeinf.udm_t

  • ida_typeinf.udt_type_data_t

  • ida_ua.decode_insn

  • ida_ua.insn_t


Code to be run right after IDAPython initialization

The idapythonrc.py file:

  • %APPDATA%\Hex-Rays\IDA Pro\idapythonrc.py (on Windows)

  • ~/.idapro/idapythonrc.py (on Linux & Mac)

can contain any IDAPython code that will be run as soon as IDAPython is done successfully initializing.

Source code
Keywords
Level

Beginner


Add functions to the IDC runtime, from IDAPython

You can add IDC functions to IDA, whose "body" consists of IDAPython statements!

We'll register a 'pow' function, available to all IDC code, that when invoked will call back into IDAPython, and execute the provided function body.

After running this script, try switching to the IDC interpreter (using the button on the lower-left corner of IDA) and executing pow(3, 7)

Source code
Keywords
Level

Intermediate

APIs Used:

  • ida_expr.VT_LONG

  • ida_expr.add_idc_func


Add 64-bit (.idb->.i64) conversion capabilities to custom plugins

For more infortmation see SDK/plugins/cvt64_sample example

Source code
Keywords
Level

Advanced

APIs Used:

  • ida_idaapi.BADADDR

  • ida_idaapi.BADADDR32

  • ida_netnode.atag

  • ida_netnode.htag

  • ida_netnode.stag


Add merge functionality to a simple plugin

This is a primitive plugin which asks user for some info and saves it for some addresses.

We will add a merge functionality to plugin.

An IDA plugin may have two kinds of data with permanent storage:

  1. Data common for entire database (e.g. the options). To describe them we will use the idbattr_info_t type.

  2. Data specific to a particular address. To describe them we will use the merge_node_info_t type.

Also, see SDK/plugins/mex1 example

Source code
Keywords
Level

IDP_Hooks plugin

Advanced

APIs Used:

  • ida_funcs.get_func

  • ida_ida.IDI_ALTVAL

  • ida_ida.IDI_CSTR

  • ida_ida.IDI_SCALAR

  • ida_ida.IDI_SUPVAL

  • ida_ida.idbattr_info_t

  • ida_idaapi.BADADDR

  • ida_idaapi.PLUGIN_MOD

  • ida_idaapi.PLUGIN_MULTI

  • ida_idaapi.plugin_t

  • ida_idaapi.plugmod_t

  • ida_idp.IDP_Hooks

  • ida_kernwin.Form

  • ida_kernwin.Form.ChkGroupControl

  • ida_kernwin.Form.StringInput

  • ida_kernwin.get_screen_ea

  • ida_merge.MERGE_KIND_END

  • ida_merge.MERGE_KIND_NONE

  • ida_merge.NDS_IS_STR

  • ida_merge.NDS_MAP_IDX

  • ida_merge.merge_handler_params_t

  • ida_merge.merge_node_info_t

  • ida_merge.moddata_diff_helper_t

  • ida_mergemod.create_std_modmerge_handlers

  • ida_netnode.BADNODE

  • ida_netnode.SIZEOF_nodeidx_t

  • ida_netnode.atag

  • ida_netnode.netnode

  • ida_netnode.stag


Implement merging functionality for custom plugins

IDA Teams uses a chooser to display the merge conflicts. To fill the chooser columns IDA Teams uses the following methods from diff_source_t type:

  • print_diffpos_name()

  • print_diffpos_details()

and UI hints from merge_handler_params_t type:

  • ui_has_details()

  • ui_complex_details()

  • ui_complex_name()

In general, chooser columns are filled as following:

      columns.clear()
      NAME = print_diffpos_name()
      if ui_complex_name()
      then
        columns.add(split NAME by ui_split_char())
      else
        columns[0] = NAME
      if not ui_complex_details()
      then
        columns.add(print_diffpos_details())

Also, see SDK/plugins/mex3 example

Source code
Keywords
Level

IDP_Hooks plugin

Advanced

APIs Used:

  • ida_funcs.get_func

  • ida_ida.IDI_ALTVAL

  • ida_ida.IDI_CSTR

  • ida_ida.IDI_SCALAR

  • ida_ida.IDI_SUPVAL

  • ida_ida.idbattr_info_t

  • ida_idaapi.BADADDR

  • ida_idaapi.PLUGIN_MOD

  • ida_idaapi.PLUGIN_MULTI

  • ida_idaapi.plugin_t

  • ida_idaapi.plugmod_t

  • ida_idp.IDP_Hooks

  • ida_kernwin.Form

  • ida_kernwin.Form.ChkGroupControl

  • ida_kernwin.Form.StringInput

  • ida_kernwin.get_screen_ea

  • ida_merge.MERGE_KIND_END

  • ida_merge.MERGE_KIND_NONE

  • ida_merge.MH_UI_COLONNAME

  • ida_merge.MH_UI_COMMANAME

  • ida_merge.MH_UI_NODETAILS

  • ida_merge.NDS_IS_STR

  • ida_merge.NDS_MAP_IDX

  • ida_merge.create_nodeval_merge_handlers

  • ida_merge.get_ea_diffpos_name

  • ida_merge.merge_handler_params_t

  • ida_merge.merge_node_helper_t

  • ida_merge.merge_node_info_t

  • ida_merge.moddata_diff_helper_t

  • ida_mergemod.create_std_modmerge_handlers

  • ida_nalt.node2ea

  • ida_netnode.BADNODE

  • ida_netnode.SIZEOF_nodeidx_t

  • ida_netnode.atag

  • ida_netnode.netnode

  • ida_netnode.stag


Similar to , but with multiple selection

reference documentation
categories
choose
add_hotkey.py
add_menus.py
colorize_disassembly.py
func_chooser_coloring.py
populate_pluginform_with_pyqt_widgets.py
prevent_jump.py
register_timer.py
show_and_hide_waitbox.py
actions.py
choose.py
choose_multi.py
custom_viewer.py
func_chooser.py
jump_next_comment.py
lines_rendering.py
log_misc_events.py
paint_over_navbar.py
save_and_restore_listing_pos.py
show_selected_strings.py
sync_two_graphs.py
trigger_actions_programmatically.py
askusingform.py
auto_instantiate_widget_plugin.py
chooser_with_folders.py
colorize_disassembly_on_the_fly.py
custom_cli.py
custom_graph_with_actions.py
dump_selection.py
inject_command.py
lazy_loaded_chooser.py
paint_over_graph.py
wrap_idaview.py
dump_flowchart.py
install_user_defined_prefix.py
list_imports.py
list_patched_bytes.py
list_problems.py
list_segment_functions.py
list_segment_functions_using_idautils.py
list_strings.py
produce_lst_file.py
ana_emu_out.py
assemble.py
dump_extra_comments.py
dump_func_info.py
find_string.py
func_ti_changed_listener.py
list_bookmarks.py
list_function_items.py
log_idb_events.py
log_idp_events.py
replay_prototypes_changes.py
add_frame_member.py
custom_data_types_and_formats.py
list_struct_accesses.py
operand_changed.py
produce_c_file.py
vds1.py
vds13.py
vds7.py
vds_create_hint.py
colorize_pseudocode_lines.py
decompile_entry_points.py
vds10.py
vds21.py
vds4.py
vds6.py
vds8.py
vds_hooks.py
vds_modify_user_lvars.py
curpos_details.py
vds11.py
vds12.py
vds17.py
vds19.py
vds3.py
vds5.py
vds_xrefs.py
print_registers.py
show_debug_names.py
print_call_stack.py
registers_context_menu.py
automatic_steps.py
dbg_trace.py
simple_appcall_linux.py
simple_appcall_win.py
create_struct_by_parsing.py
del_struct_members.py
list_enum_member.py
list_frame_info.py
list_func_details.py
list_struct_member.py
list_struct_xrefs.py
list_union_member.py
mark_func_spoiled.py
apply_callee_tinfo.py
create_array.py
create_bfstruct.py
create_bmenum.py
create_libssh2_til.py
create_struct_by_member.py
create_structure_programmatically.py
create_union_by_member.py
create_user_shared_data.py
gap_size_align_snippet.py
get_best_fit_member.py
get_innermost_member.py
import_type_from_til.py
insert_struct_member.py
list_stkvar_xrefs.py
print_stkvar_xrefs.py
setpehdr.py
visit_tinfo.py
change_stkvar_name.py
change_stkvar_type.py
operand_to_struct_member.py
idapythonrc.py
extend_idc.py
py_cvt64_sample.py
py_mex1.py
py_mex3.py
User interface
Disassembly
Decompilation
Debuggers
Working with types
Miscellaneous
Assign a shortcut to a custom function
Add custom menus to IDA
Assign a background color to an address, function & segment
Override the default "Functions" chooser colors
Create a dockable container, and populate it with Qt widgets
Prevent an action from being triggered
Use timers for delayed execution
Show, update & hide the progress dialog
Custom actions, with icons & tooltips
Show tabular data
Show tabular data, with multiple selection
Create custom listings in IDA
Implement an alternative "Functions" window
Implement a "jump to next comment" action within IDA's listing
Dynamically colorize [parts of] lines
React to UI events/notifications
Paint on top of the navigation band
Save, and then restore, positions in a listing
Retrieve the selection from the "Strings" window
Follow the movements of one graph, in another
Trigger actions programmatically
Advanced usage of the form API
Restore custom widgets across sessions
Showing tabular data in a flat, or tree-like fashion
Colorize lines interactively
Add a custom command-line interpreter
Draw custom graphs
Retrieve & dump current selection
Inject commands in the "Output" window
A lazy-loaded, tree-like data view
Paint text on graph view edges
Programmatically manipulate disassembly and graph widgets
Dump function flowchart
Insert information into listing prefixes
Enumerate file imports
Enumerate patched bytes
Enumerate known problems
List segment functions (and cross-references to them)
List all functions (and cross-references) in segment
Dump the strings that are present in the file
Produce disassembly listing for the entire file
Rewrite the representation of some instructions
Implement assembly of instructions
Retrieve comments surrounding instructions
Dump function information
Using "ida_bytes.find_string"
Print notifications about function prototype changes
List listing bookmarks
Showcase (some of) the iterators available on a function
React to database events/notifications
React to processor events/notifications
Record and replay changes in function prototypes
Add a new member to an existing function frame
Custom data types & printers
List operands representing a "path" to a (possibly nested) structure member
Notify the user when an instruction operand changes
Produce C listing for the entire file
Decompile & print current function
Generate microcode for the selected range of instructions
Dump statement blocks
Provide custom decompiler hints
Interactively color decompilation lines
Decompile entrypoint automatically
Add custom microcode instruction optimization rule
Dynamically provide a custom call type
Dump user-defined information for a function
Superficially modify the decompilation output
Improve decompilation by turning specific patterns into custom function calls
React to decompiler events/notifications
Modifying function local variables
Print information about the current position in decompilation
Add a custom microcode block optimization rule
List instruction registers
Invoke the structure offset-choosing dialog from decompilation
Add a custom microcode instruction optimization rule
Invert if/else blocks in decompilation
Dump C-tree graph
Show decompiler cross-references
Print all registers, for all threads in the debugged process
Dump symbols from a process being debugged
Print call stack
Add a custom action to the "registers" widget
Programmatically drive a debugging session
React to trace notifications
Execute code into the application being debugged (on Linux)
Execute code into the application being debugged (on Windows)
Create a structure by parsing its definition
Delete structure members that fall within an offset range
Print enumeration members
Print function stack frame information
List database functions prototypes
List structure members
List cross-references to a structure
List union members
Mark a register "spoiled" by a function
Apply function prototype to call sites
Create an array type
Create a structure with bitfield members
Create a bitmask enumeration
Create a type library file
Create a structure programmatically
Create & populate a structure
Create a union
Create a segment, and define (complex) data in it
Utilities to detect structure gaps & alignment
Get member by offset, taking into account variable sized structures
Get information about the "innermost" member of a structure
Load a type library from a file, and then a type from it
Inject a member in the middle of a structure
List all xrefs to a function stack variable
List cross-references to function stack frame variables
Assign DOS/PE headers structures to a PE binary
Recursively visit a type and its members
Change the name of an existing stack variable
Change the type & name of a function stack frame variable
Turn instruction operand into a structure offset
Code to be run right after IDAPython initialization
Add functions to the IDC runtime, from IDAPython
Add 64-bit (.idb->.i64) conversion capabilities to custom plugins
Add merge functionality to a simple plugin
Implement merging functionality for custom plugins