Dump some of the most interesting bits of information about the function we are currently looking at.
How to create user actions, that once created can be inserted in menus, toolbars, context menus, ...
`ida_kernwin.add_hotkey` is a simpler, but much less flexible alternative to `ida_kernwin.register_action` (though it does use the same mechanism under the hood.)
This is a somewhat ancient way of registering actions & binding shortcuts. It's still here for reference, but "fresher" alternatives should be preferred.
This is an example demonstrating how one can create widgets from a plugin, and have them re-created automatically at IDA startup-time or at desktop load-time.
IDAPython's ida_bytes.bin_search function is pretty powerful, but can be tough to figure out at first. This example introduces
Usage of the API to create & populate a structure with members of different types.
Illustrates how one can add command-line interpreters to IDA
IDA can be extended to support certain data types that it does not know about out-of-the-box.
Use the `ida_lines.get_extra_cmt` API to retrieve anterior and posterior extra comments.
Dumps the current function's flowchart, using 2 methods:
Shows how to retrieve the selection from a listing
widget ("IDA View-A", "Hex View-1", "Pseudocode-A", ...) as
two "cursors", and from there retrieve (in fact, generate)
the corresponding text.
You can add IDC functions to IDA, whose "body" consists of IDAPython statements!
The `idapythonrc.py` file:
By default, disassembly line prefixes contain segment + address information (e.g., '.text:08047718'), but it is possible to "inject" other bits of information in there, thanks to the `ida_lines.user_defined_prefix_t` helper type.
Using the API to enumerate file imports.
Using the API to iterate over all the places in the file, that were patched using IDA.
Using the API to list all problem[atic situation]s that IDA encountered during analysis.
List all the functions in the current segment, as well as all the cross-references to them.
List all the functions in the current segment, as well as all the cross-references to them.
Contrary to (in-memory) data & code xrefs, retrieving stack variables xrefs requires a bit more work than just using ida_xref's first_to(), next_to() (or higher level utilities such as idautils.XrefsTo)
This uses `idautils.Strings` to iterate over the string literals that are present in the IDB. Contrary to @show_selected_strings, this will not require that the "Strings" window is opened & available.
automate IDA to perform auto-analysis on a file and, once that is done, produce a .c file containing the decompilation of all the functions in that file.
automate IDA to perform auto-analysis on a file and, once that is done, produce a .lst file with the disassembly.
Register (possibly repeating) timers.
It's possible to invoke any action programmatically, by using either of those two:
Start a debugging session, step through the first five instructions. Each instruction is disassembled after execution.
This script demonstrates using the low-level tracing hook (ida_dbg.DBG_Hooks.dbg_trace). It can be run like so:
Queries the debugger (possibly remotely) for the list of symbols that the process being debugged, provides.
Using the `ida_idd.Appcall` utility to execute code in the process being debugged.
Using the `ida_idd.Appcall` utility to execute code in the process being debugged.
This illustrates the setting/retrieval of background colours using the IDC wrappers
Provides an action that can be used to dynamically alter the lines background rendering for pseudocode listings (as opposed to using `ida_hexrays.cfunc_t.pseudocode[N].bgcolor`)
Attempts to load a decompiler plugin corresponding to the current architecture (and address size) right after auto-analysis is performed, and then tries to decompile the function at the first entrypoint.
Installs a custom microcode instruction optimization rule, to transform:
Installs a custom microcode block optimization rule, to transform:
Shows a list of direct references to a register from the current instruction.
Generates microcode for selection and dumps it to the output window.
Registers an action opens the "Select offsets" widget (select_udt_by_offset() call).
Installs a custom microcode instruction optimization rule, to transform:
This plugin can greatly improve decompilation of indirect calls:
Registers an action that can be used to invert the `if` and `else` blocks of a `ida_hexrays.cif_t`.
Prints user-defined information to the "Output" window. Namely:
Registers an action that can be used to show the graph of the ctree. The current item will be highlighted in the graph.
modifies the decompilation output in a superficial manner, by removing some white spaces
Using a `ida_hexrays.ctree_visitor_t`, search for `ida_hexrays.cit_block` instances and dump them.
Registers an action that uses a `ida_hexrays.udc_filter_t` to decompile `svc 0x900001` and `svc 0x9000F8` as function calls to `svc_exit()` and `svc_exit_group()` respectively.
Handle `ida_hexrays.hxe_create_hint` notification using hooks, to return our own.
Shows how to hook to many notifications sent by the decompiler.
Use a `ida_hexrays.user_lvar_modifier_t` to modify names, comments and/or types of local variables.
Show decompiler-style Xref when the `Ctrl+X` key is pressed in the Decompiler window.
Show notifications whenever the user changes an instruction's operand, or a data item.
This is a sample script, that will record (in memory) all changes in functions prototypes, in order to re-apply them later. To use this script: - open an IDB (say, "test.idb") - modify some functions prototypes (e.g., by triggering the 'Y' shortcut when the cursor is placed on the first address of a function) - reload that IDB, *without saving it first* - call rpc.replay(), to re-apply the modifications. Note: 'ti_changed' is also called for changes to the function frames, but we'll only record function prototypes changes.
Implements disassembly of BUG_INSTR used in Linux kernel BUG() macro, which is architecturally undefined and is not disassembled by IDA's ARM module
We add support for assembling the following pseudo instructions:
This example illustrates how one can execute commands in the "Output" window, from their own widgets.
Using `ida_kernwin.PluginForm.FormToPyQtWidget`, this script converts IDA's own dockable widget into a type that is recognized by PyQt5, which then enables populating it with regular Qt widgets.
color the function in the Function window according to its size. The larger the function, the darker the color.
shows how one can dynamically alter the lines background rendering (as opposed to, say, using ida_nalt.set_item_color()), and also shows how that rendering can be limited to just a few glyphs, not the whole line.
hooks to be notified about certain UI events, and dump their information to the "Output" window
Using `ida_kernwin.UI_Hooks.preprocess_action`, it is possible to respond to a command instead of the action that would otherwise do it.
How to query for complex user input, using IDA's built-in forms.
Shows how to subclass the ida_kernwin.Choose class to show data organized in a simple table. In addition, registers a couple actions that can be applied to it.
Similar to @{choose}, but with multiple selection
By adding the necessary bits to a ida_kernwin.Choose subclass, IDA can show the otherwise tabular data, in a tree-like fashion.
Showing custom graphs, using `ida_graph.GraphViewer`. In addition, show how to write actions that can be performed on those.
How to create simple listings, that will share many of the features as the built-in IDA widgets (highlighting, copy & paste, notifications, ...)
Partially re-implements the "Functions" widget present in IDA, with a custom widget.
We want our action not only to find the next line containing a comment, but to also place the cursor at the right horizontal position.
Shows how it is possible re-implement IDA's bookmark capability, using 2 custom actions: one action saves the current location, and the other restores it.
Using the progress dialog (aka 'wait box') primitives.
In IDA it's possible to write actions that can be applied even to core (i.e., "standard") widgets. The actions in this example use the action "context" to know what the current selection is.
Since it is possible to be notified of movements that happen take place in a widget, it's possible to "replay" those movements in another.
This is an example illustrating how to manipulate an existing IDA-provided view (and thus possibly its graph), in Python.