mirror of
https://github.com/idapython/src
synced 2026-06-08 14:47:00 +00:00
Arnaud Diederen
4387 lines
150 KiB
HTML
4387 lines
150 KiB
HTML
<!--
|
|
Used keywords:
|
|
actions
|
|
chooser
|
|
coloring
|
|
colors
|
|
ctxmenu
|
|
DBG_Hooks
|
|
desktop
|
|
folders
|
|
forms
|
|
funcs iterator
|
|
functions
|
|
graph
|
|
Hexrays_Hooks
|
|
idaview
|
|
IDB_Hooks
|
|
idc
|
|
IDP_Hooks
|
|
listing
|
|
plugin
|
|
UI_Hooks
|
|
View_Hooks
|
|
xrefs
|
|
-->
|
|
<html>
|
|
<head>
|
|
<meta charset="UTF-8">
|
|
<title>IDAPython examples</title>
|
|
<link rel="stylesheet" href="index.css">
|
|
<script type="text/javascript" src="index.js"></script>
|
|
</head>
|
|
|
|
<body>
|
|
<div style="margin:20px 20px 50px 20px">
|
|
<a href="http://htmlpreview.github.io/?https://github.com/idapython/src/blob/master/examples/index.html">View on GitHub</a>
|
|
</div>
|
|
<div class="toplevel-actions" onclick="handle_toplevel_action()">
|
|
<a href="#" class="exp-col-all expand-all">Expand all</a>
|
|
|
|
|
<a href="#" class="exp-col-all collapse-all">Collapse all</a>
|
|
</div>
|
|
|
|
<h1>IDAPython examples:</h1>
|
|
<h2>Category: analysis</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="dump_func_info">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="analysis/dump_func_info.py">dump_func_info</a>: <i>Dump (some) information about the current function.</i>
|
|
</div>
|
|
<div class="details" id="DIV_dump_func_info">
|
|
|
|
<pre>
|
|
Dump some of the most interesting bits of information about
|
|
the function we are currently looking at.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: analysis</li>
|
|
<li>Summary: Dump (some) information about the current function.</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/analysis/dump_func_info.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.FUNC_FRAME</li>
|
|
<li>ida_funcs.FUNC_LUMINA</li>
|
|
<li>ida_funcs.FUNC_OUTLINE</li>
|
|
<li>ida_funcs.FUNC_THUNK</li>
|
|
<li>ida_funcs.get_fchunk</li>
|
|
<li>ida_funcs.is_func_entry</li>
|
|
<li>ida_funcs.is_func_tail</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: core</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="actions">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/actions.py">actions</a>: <i>Custom actions, with icons & tooltips</i>
|
|
</div>
|
|
<div class="details" id="DIV_actions">
|
|
|
|
<pre>
|
|
How to create user actions, that once created can be
|
|
inserted in menus, toolbars, context menus, ...
|
|
|
|
Those actions, when triggered, will be passed a 'context'
|
|
that contains some of the most frequently needed bits of
|
|
information.
|
|
|
|
In addition, custom actions can determine when they want
|
|
to be available (through their
|
|
`ida_kernwin.action_handler_t.update` callback)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Custom actions, with icons & tooltips</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/actions.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
ctxmenu
|
|
UI_Hooks
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
Ctrl+F12
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_DISASM</li>
|
|
<li>ida_kernwin.SETMENU_APP</li>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_menu</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.attach_action_to_toolbar</li>
|
|
<li>ida_kernwin.get_widget_type</li>
|
|
<li>ida_kernwin.load_custom_icon</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.unregister_action</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#add_hotkey">add_hotkey</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="add_hotkey">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/add_hotkey.py">add_hotkey</a>: <i>Triggering bits of code by pressing a shortcut</i>
|
|
</div>
|
|
<div class="details" id="DIV_add_hotkey">
|
|
|
|
<pre>
|
|
`ida_kernwin.add_hotkey` is a simpler, but much less flexible
|
|
alternative to `ida_kernwin.register_action` (though it does
|
|
use the same mechanism under the hood.)
|
|
|
|
It's particularly useful during prototyping, but note that the
|
|
actions that are created cannot be inserted in menus, toolbars
|
|
or cannot provide a custom `ida_kernwin.action_handler_t.update`
|
|
callback.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Triggering bits of code by pressing a shortcut</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/add_hotkey.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.add_hotkey</li>
|
|
<li>ida_kernwin.del_hotkey</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#actions">actions</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="add_idc_hotkey">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/add_idc_hotkey.py">add_idc_hotkey</a>: <i>Triggering bits of code by pressing a shortcut (older version)</i>
|
|
</div>
|
|
<div class="details" id="DIV_add_idc_hotkey">
|
|
|
|
<pre>
|
|
This is a somewhat ancient way of registering actions & binding
|
|
shortcuts. It's still here for reference, but "fresher" alternatives
|
|
should be preferred.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Triggering bits of code by pressing a shortcut (older version)</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/add_idc_hotkey.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_expr.compile_idc_text</li>
|
|
<li>ida_kernwin.add_idc_hotkey</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#actions">actions</a></li>
|
|
<li><a class="ex_link" href="#add_hotkey">add_hotkey</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="auto_instantiate_widget_plugin">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/auto_instantiate_widget_plugin.py">auto_instantiate_widget_plugin</a>: <i>Better integrating custom widgets in the desktop layout</i>
|
|
</div>
|
|
<div class="details" id="DIV_auto_instantiate_widget_plugin">
|
|
|
|
<pre>
|
|
This is an example demonstrating how one can create widgets from a plugin,
|
|
and have them re-created automatically at IDA startup-time or at desktop load-time.
|
|
|
|
This example should be placed in the 'plugins' directory of the
|
|
IDA installation, for it to work.
|
|
|
|
There are 2 ways to use this example:
|
|
1) reloading an IDB, where the widget was opened
|
|
- open the widget ('View > Open subview > ...')
|
|
- save this IDB, and close IDA
|
|
- restart IDA with this IDB
|
|
=> the widget will be visible
|
|
|
|
2) reloading a desktop, where the widget was opened
|
|
- open the widget ('View > Open subview > ...')
|
|
- save the desktop ('Windows > Save desktop...') under, say, the name 'with_auto'
|
|
- start another IDA instance with some IDB, and load that desktop
|
|
=> the widget will be visible
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Better integrating custom widgets in the desktop layout</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/auto_instantiate_widget_plugin.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
desktop
|
|
plugin
|
|
UI_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_kernwin.AST_ENABLE_ALWAYS</li>
|
|
<li>ida_kernwin.SETMENU_APP</li>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_menu</li>
|
|
<li>ida_kernwin.find_widget</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.simplecustviewer_t</li>
|
|
<li>ida_kernwin.simplecustviewer_t.Create</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="bin_search">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/bin_search.py">bin_search</a>: <i>Showcasing `ida_bytes.bin_search`</i>
|
|
</div>
|
|
<div class="details" id="DIV_bin_search">
|
|
|
|
<pre>
|
|
IDAPython's ida_bytes.bin_search function is pretty powerful,
|
|
but can be tough to figure out at first. This example introduces
|
|
|
|
* `ida_bytes.bin_search`, and
|
|
* `ida_bytes.parse_binpat_str`
|
|
|
|
in order to implement a simple replacement for the
|
|
'Search > Sequence of bytes...' dialog, that lets users
|
|
search for sequences of bytes that compose string literals
|
|
in the binary file (either in the default 1-byte-per-char
|
|
encoding, or as UTF-16.)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Showcasing `ida_bytes.bin_search`</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/bin_search.py">GitHub</a></li>
|
|
|
|
<li>Shortcut:
|
|
Ctrl+Shift+S
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.BIN_SEARCH_FORWARD</li>
|
|
<li>ida_bytes.BIN_SEARCH_NOBREAK</li>
|
|
<li>ida_bytes.BIN_SEARCH_NOSHOW</li>
|
|
<li>ida_bytes.bin_search</li>
|
|
<li>ida_bytes.compiled_binpat_vec_t</li>
|
|
<li>ida_bytes.parse_binpat_str</li>
|
|
<li>ida_ida.inf_get_max_ea</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_DISASM</li>
|
|
<li>ida_kernwin.Form</li>
|
|
<li>ida_kernwin.Form.ChkGroupControl</li>
|
|
<li>ida_kernwin.Form.StringInput</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_kernwin.jumpto</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_nalt.BPU_1B</li>
|
|
<li>ida_nalt.BPU_2B</li>
|
|
<li>ida_nalt.get_default_encoding_idx</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="colorize_disassembly_on_the_fly">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/colorize_disassembly_on_the_fly.py">colorize_disassembly_on_the_fly</a>: <i>An easy-to-use way to colorize lines</i>
|
|
</div>
|
|
<div class="details" id="DIV_colorize_disassembly_on_the_fly">
|
|
|
|
<pre>
|
|
This builds upon the `ida_kernwin.UI_Hooks.get_lines_rendering_info`
|
|
feature, to provide a quick & easy way to colorize disassembly
|
|
lines.
|
|
|
|
Contrary to @colorize_disassembly, the coloring is not persisted in
|
|
the database, and will therefore be lost after the session.
|
|
|
|
By triggering the action multiple times, the user can "carousel"
|
|
across 4 predefined colors (and return to the "no color" state.)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: An easy-to-use way to colorize lines</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/colorize_disassembly_on_the_fly.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
coloring
|
|
UI_Hooks
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
!
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.CK_EXTRA5</li>
|
|
<li>ida_kernwin.CK_EXTRA6</li>
|
|
<li>ida_kernwin.CK_EXTRA7</li>
|
|
<li>ida_kernwin.CK_EXTRA8</li>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.get_current_viewer</li>
|
|
<li>ida_kernwin.get_custom_viewer_location</li>
|
|
<li>ida_kernwin.get_custom_viewer_place_xcoord</li>
|
|
<li>ida_kernwin.get_widget_title</li>
|
|
<li>ida_kernwin.line_rendering_output_entry_t</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_moves.lochist_entry_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#colorize_disassembly">colorize_disassembly</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="create_structure_programmatically">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/create_structure_programmatically.py">create_structure_programmatically</a>: <i>Programmatically create & populate a structure</i>
|
|
</div>
|
|
<div class="details" id="DIV_create_structure_programmatically">
|
|
|
|
<pre>
|
|
Usage of the API to create & populate a structure with
|
|
members of different types.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Programmatically create & populate a structure</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/create_structure_programmatically.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.FF_BYTE</li>
|
|
<li>ida_bytes.FF_DATA</li>
|
|
<li>ida_bytes.FF_DOUBLE</li>
|
|
<li>ida_bytes.FF_DWORD</li>
|
|
<li>ida_bytes.FF_FLOAT</li>
|
|
<li>ida_bytes.FF_OWORD</li>
|
|
<li>ida_bytes.FF_PACKREAL</li>
|
|
<li>ida_bytes.FF_QWORD</li>
|
|
<li>ida_bytes.FF_STRLIT</li>
|
|
<li>ida_bytes.FF_STRUCT</li>
|
|
<li>ida_bytes.FF_TBYTE</li>
|
|
<li>ida_bytes.FF_WORD</li>
|
|
<li>ida_bytes.off_flag</li>
|
|
<li>ida_bytes.stroff_flag</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_nalt.STRTYPE_C</li>
|
|
<li>ida_struct.add_struc</li>
|
|
<li>ida_struct.get_struc_id</li>
|
|
<li>ida_struct.get_struc_size</li>
|
|
<li>idc.add_struc</li>
|
|
<li>idc.add_struc_member</li>
|
|
<li>idc.del_struc</li>
|
|
<li>idc.set_member_type</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
<li>Author: Gergely Erdelyi (gergely.erdelyi@d-dome.net)</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="custom_cli">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/custom_cli.py">custom_cli</a>: <i>A custom command-line interpreter</i>
|
|
</div>
|
|
<div class="details" id="DIV_custom_cli">
|
|
|
|
<pre>
|
|
Illustrates how one can add command-line interpreters to IDA
|
|
|
|
This custom interpreter doesn't actually run any code; it's
|
|
there as a 'getting started'.
|
|
It provides an example tab completion support.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: A custom command-line interpreter</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/custom_cli.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_idaapi.NW_CLOSEIDB</li>
|
|
<li>ida_idaapi.NW_OPENIDB</li>
|
|
<li>ida_idaapi.NW_REMOVE</li>
|
|
<li>ida_idaapi.NW_TERMIDA</li>
|
|
<li>ida_idaapi.notify_when</li>
|
|
<li>ida_kernwin.cli_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="custom_data_types_and_formats">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/custom_data_types_and_formats.py">custom_data_types_and_formats</a>: <i>Using custom data types & printers</i>
|
|
</div>
|
|
<div class="details" id="DIV_custom_data_types_and_formats">
|
|
|
|
<pre>
|
|
IDA can be extended to support certain data types that it
|
|
does not know about out-of-the-box.
|
|
|
|
A 'custom data type' provide information about the type &
|
|
size of a piece of data, while a 'custom data format' is in
|
|
charge of formatting that data (there can be more than
|
|
one format for a specific 'custom data type'.)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Using custom data types & printers</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/custom_data_types_and_formats.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.data_format_t</li>
|
|
<li>ida_bytes.data_type_t</li>
|
|
<li>ida_bytes.find_custom_data_type</li>
|
|
<li>ida_bytes.get_byte</li>
|
|
<li>ida_bytes.register_data_types_and_formats</li>
|
|
<li>ida_bytes.unregister_data_types_and_formats</li>
|
|
<li>ida_idaapi.NW_CLOSEIDB</li>
|
|
<li>ida_idaapi.NW_OPENIDB</li>
|
|
<li>ida_idaapi.NW_REMOVE</li>
|
|
<li>ida_idaapi.NW_TERMIDA</li>
|
|
<li>ida_idaapi.notify_when</li>
|
|
<li>ida_idaapi.struct_unpack</li>
|
|
<li>ida_lines.COLSTR</li>
|
|
<li>ida_lines.SCOLOR_IMPNAME</li>
|
|
<li>ida_lines.SCOLOR_INSN</li>
|
|
<li>ida_lines.SCOLOR_NUMBER</li>
|
|
<li>ida_lines.SCOLOR_REG</li>
|
|
<li>ida_nalt.get_input_file_path</li>
|
|
<li>ida_netnode.netnode</li>
|
|
<li>ida_struct.is_member_id</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="dump_extra_comments">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/dump_extra_comments.py">dump_extra_comments</a>: <i>Retrieve extra comments</i>
|
|
</div>
|
|
<div class="details" id="DIV_dump_extra_comments">
|
|
|
|
<pre>
|
|
Use the `ida_lines.get_extra_cmt` API to retrieve anterior
|
|
and posterior extra comments.
|
|
|
|
This script registers two actions, that can be used to dump
|
|
the previous and next extra comments.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Retrieve extra comments</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/dump_extra_comments.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
ctxmenu
|
|
</li>
|
|
|
|
<li>Shortcuts:
|
|
Ctrl+Shift+Y
|
|
Ctrl+Shift+Z
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_DISASM</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.find_widget</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.unregister_action</li>
|
|
<li>ida_lines.E_NEXT</li>
|
|
<li>ida_lines.E_PREV</li>
|
|
<li>ida_lines.get_extra_cmt</li>
|
|
<li>ida_view</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="dump_flowchart">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/dump_flowchart.py">dump_flowchart</a>: <i>Dump function flowchart</i>
|
|
</div>
|
|
<div class="details" id="DIV_dump_flowchart">
|
|
|
|
<pre>
|
|
Dumps the current function's flowchart, using 2 methods:
|
|
|
|
* the low-level `ida_gdl.qflow_chart_t` type
|
|
* the somewhat higher-level, and slightly more pythonic
|
|
`ida_gdl.FlowChart` type.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Dump function flowchart</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/dump_flowchart.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_gdl.FlowChart</li>
|
|
<li>ida_gdl.qflow_chart_t</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="dump_selection">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/dump_selection.py">dump_selection</a>: <i>Retrieve & dump current selection</i>
|
|
</div>
|
|
<div class="details" id="DIV_dump_selection">
|
|
|
|
<pre>
|
|
Shows how to retrieve the selection from a listing
|
|
widget ("IDA View-A", "Hex View-1", "Pseudocode-A", ...) as
|
|
two "cursors", and from there retrieve (in fact, generate)
|
|
the corresponding text.
|
|
|
|
After running this script:
|
|
|
|
* select some text in one of the listing widgets (i.e.,
|
|
"IDA View-*", "Enums", "Structures", "Pseudocode-*")
|
|
* press Ctrl+Shift+S to dump the selection
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Retrieve & dump current selection</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/dump_selection.py">GitHub</a></li>
|
|
|
|
<li>Shortcut:
|
|
Ctrl+Shift+S
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.ACF_HAS_SELECTION</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_DISASM</li>
|
|
<li>ida_kernwin.BWN_ENUMS</li>
|
|
<li>ida_kernwin.BWN_PSEUDOCODE</li>
|
|
<li>ida_kernwin.BWN_STRUCTS</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.get_viewer_user_data</li>
|
|
<li>ida_kernwin.l_compare2</li>
|
|
<li>ida_kernwin.linearray_t</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.unregister_action</li>
|
|
<li>ida_lines.tag_remove</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="extend_idc">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/extend_idc.py">extend_idc</a>: <i>Add functions to the IDC runtime from IDAPython</i>
|
|
</div>
|
|
<div class="details" id="DIV_extend_idc">
|
|
|
|
<pre>
|
|
You can add IDC functions to IDA, whose "body" consists of
|
|
IDAPython statements!
|
|
|
|
We'll register a 'pow' function, available to all IDC code,
|
|
that when invoked will call back into IDAPython, and execute
|
|
the provided function body.
|
|
|
|
After running this script, try switching to the IDC interpreter
|
|
(using the button on the lower-left corner of IDA) and executing
|
|
`pow(3, 7)`
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Add functions to the IDC runtime from IDAPython</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/extend_idc.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_expr.VT_LONG</li>
|
|
<li>ida_expr.add_idc_func</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="idapythonrc">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/idapythonrc.py">idapythonrc</a>: <i>Code to be run right after IDAPython initialization</i>
|
|
</div>
|
|
<div class="details" id="DIV_idapythonrc">
|
|
|
|
<pre>
|
|
The `idapythonrc.py` file:
|
|
|
|
* %APPDATA%\Hex-Rays\IDA Pro\idapythonrc.py (on Windows)
|
|
* ~/.idapro/idapythonrc.py (on Linux & Mac)
|
|
|
|
can contain any IDAPython code that will be run as soon as
|
|
IDAPython is done successfully initializing.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Code to be run right after IDAPython initialization</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/idapythonrc.py">GitHub</a></li>
|
|
|
|
|
|
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="install_user_defined_prefix">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/install_user_defined_prefix.py">install_user_defined_prefix</a>: <i>Inserting information into disassembly prefixes</i>
|
|
</div>
|
|
<div class="details" id="DIV_install_user_defined_prefix">
|
|
|
|
<pre>
|
|
By default, disassembly line prefixes contain segment + address
|
|
information (e.g., '.text:08047718'), but it is possible to
|
|
"inject" other bits of information in there, thanks to the
|
|
`ida_lines.user_defined_prefix_t` helper type.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Inserting information into disassembly prefixes</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/install_user_defined_prefix.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
plugin
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_lines.SCOLOR_INV</li>
|
|
<li>ida_lines.user_defined_prefix_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="list_function_items">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/list_function_items.py">list_function_items</a>: <i>Showcases (a few of) the iterators available on a function</i>
|
|
</div>
|
|
<div class="details" id="DIV_list_function_items">
|
|
|
|
<pre>
|
|
This demonstrates how to use some of the iterators available on the func_t type.
|
|
|
|
This example will focus on:
|
|
|
|
* `func_t[.__iter__]`: the default iterator; iterates on instructions
|
|
* `func_t.data_items`: iterate on data items contained within a function
|
|
* `func_t.head_items`: iterate on 'heads' (i.e., addresses containing
|
|
the start of an instruction, or a data item.
|
|
* `func_t.addresses`: iterate on all addresses within function (code
|
|
and data, beginning of an item or not)
|
|
|
|
Type `help(ida_funcs.func_t)` for a full list of iterators.
|
|
|
|
In addition, one can use:
|
|
|
|
* `func_tail_iterator_t`: iterate on all the chunks (including
|
|
the main one) of the function
|
|
* `func_parent_iterator_t`: iterate on all the parent functions,
|
|
that include this chunk
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Showcases (a few of) the iterators available on a function</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/list_function_items.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
funcs iterator
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.get_flags</li>
|
|
<li>ida_bytes.is_code</li>
|
|
<li>ida_bytes.is_data</li>
|
|
<li>ida_bytes.is_tail</li>
|
|
<li>ida_bytes.is_unknown</li>
|
|
<li>ida_funcs.func_tail_iterator_t</li>
|
|
<li>ida_funcs.get_fchunk</li>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_funcs.get_func_name</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_ua.print_insn_mnem</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="list_imports">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/list_imports.py">list_imports</a>: <i>Enumerate file imports</i>
|
|
</div>
|
|
<div class="details" id="DIV_list_imports">
|
|
|
|
<pre>
|
|
Using the API to enumerate file imports.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Enumerate file imports</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/list_imports.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_nalt.enum_import_names</li>
|
|
<li>ida_nalt.get_import_module_name</li>
|
|
<li>ida_nalt.get_import_module_qty</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="list_patched_bytes">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/list_patched_bytes.py">list_patched_bytes</a>: <i>Enumerate patched bytes</i>
|
|
</div>
|
|
<div class="details" id="DIV_list_patched_bytes">
|
|
|
|
<pre>
|
|
Using the API to iterate over all the places in the file,
|
|
that were patched using IDA.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Enumerate patched bytes</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/list_patched_bytes.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.visit_patched_bytes</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="list_problems">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/list_problems.py">list_problems</a>: <i>Enumerate problems</i>
|
|
</div>
|
|
<div class="details" id="DIV_list_problems">
|
|
|
|
<pre>
|
|
Using the API to list all problem[atic situation]s that IDA
|
|
encountered during analysis.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Enumerate problems</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/list_problems.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_ida.inf_get_min_ea</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_problems.PR_ATTN</li>
|
|
<li>ida_problems.PR_BADSTACK</li>
|
|
<li>ida_problems.PR_COLLISION</li>
|
|
<li>ida_problems.PR_DECIMP</li>
|
|
<li>ida_problems.PR_DISASM</li>
|
|
<li>ida_problems.PR_FINAL</li>
|
|
<li>ida_problems.PR_HEAD</li>
|
|
<li>ida_problems.PR_ILLADDR</li>
|
|
<li>ida_problems.PR_JUMP</li>
|
|
<li>ida_problems.PR_MANYLINES</li>
|
|
<li>ida_problems.PR_NOBASE</li>
|
|
<li>ida_problems.PR_NOCMT</li>
|
|
<li>ida_problems.PR_NOFOP</li>
|
|
<li>ida_problems.PR_NONAME</li>
|
|
<li>ida_problems.PR_NOXREFS</li>
|
|
<li>ida_problems.PR_ROLLED</li>
|
|
<li>ida_problems.get_problem</li>
|
|
<li>ida_problems.get_problem_name</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="list_segment_functions">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/list_segment_functions.py">list_segment_functions</a>: <i>List all functions (and xrefs) in segment</i>
|
|
</div>
|
|
<div class="details" id="DIV_list_segment_functions">
|
|
|
|
<pre>
|
|
List all the functions in the current segment, as well as
|
|
all the cross-references to them.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: List all functions (and xrefs) in segment</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/list_segment_functions.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
xrefs
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_funcs.get_func_name</li>
|
|
<li>ida_funcs.get_next_func</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_segment.getseg</li>
|
|
<li>ida_xref.xrefblk_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#list_segment_functions_using_idautils">list_segment_functions_using_idautils</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="list_segment_functions_using_idautils">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/list_segment_functions_using_idautils.py">list_segment_functions_using_idautils</a>: <i>List all functions (and xrefs) in segment</i>
|
|
</div>
|
|
<div class="details" id="DIV_list_segment_functions_using_idautils">
|
|
|
|
<pre>
|
|
List all the functions in the current segment, as well as
|
|
all the cross-references to them.
|
|
|
|
Contrary to @list_segment_functions, this uses the somewhat
|
|
higher-level `idautils` module.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: List all functions (and xrefs) in segment</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/list_segment_functions_using_idautils.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
xrefs
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func_name</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_segment.getseg</li>
|
|
<li>idautils.CodeRefsTo</li>
|
|
<li>idautils.Functions</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#list_segment_functions">list_segment_functions</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="list_stkvar_xrefs">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/list_stkvar_xrefs.py">list_stkvar_xrefs</a>: <i>List all xrefs to a function stack variable</i>
|
|
</div>
|
|
<div class="details" id="DIV_list_stkvar_xrefs">
|
|
|
|
<pre>
|
|
Contrary to (in-memory) data & code xrefs, retrieving stack variables
|
|
xrefs requires a bit more work than just using ida_xref's first_to(),
|
|
next_to() (or higher level utilities such as idautils.XrefsTo)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: List all xrefs to a function stack variable</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/list_stkvar_xrefs.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
xrefs
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
Ctrl+Shift+F7
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.get_flags</li>
|
|
<li>ida_bytes.is_stkvar</li>
|
|
<li>ida_frame.calc_stkvar_struc_offset</li>
|
|
<li>ida_frame.get_frame</li>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_ida.UA_MAXOP</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_DISASM</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.get_current_viewer</li>
|
|
<li>ida_kernwin.get_highlight</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_struct.get_member_by_name</li>
|
|
<li>ida_struct.get_struc</li>
|
|
<li>ida_ua.decode_insn</li>
|
|
<li>ida_ua.insn_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="list_strings">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/list_strings.py">list_strings</a>: <i>Retrieve the strings that are present in the IDB</i>
|
|
</div>
|
|
<div class="details" id="DIV_list_strings">
|
|
|
|
<pre>
|
|
This uses `idautils.Strings` to iterate over the string literals
|
|
that are present in the IDB. Contrary to @show_selected_strings,
|
|
this will not require that the "Strings" window is opened & available.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Retrieve the strings that are present in the IDB</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/list_strings.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_nalt.STRTYPE_C</li>
|
|
<li>ida_nalt.STRTYPE_C_16</li>
|
|
<li>idautils.Strings</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#show_selected_strings">show_selected_strings</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="produce_c_file">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/produce_c_file.py">produce_c_file</a>: <i>Decompile entire file</i>
|
|
</div>
|
|
<div class="details" id="DIV_produce_c_file">
|
|
|
|
<pre>
|
|
Automate IDA to perform auto-analysis on a file and,
|
|
once that is done, produce a .c file containing the
|
|
decompilation of all the functions in that file.
|
|
|
|
Run like so:
|
|
|
|
ida -A "-S...path/to/produce_c_file.py" <binary-file>
|
|
|
|
where:
|
|
|
|
* -A instructs IDA to run in non-interactive mode
|
|
* -S holds a path to the script to run (note this is a single token;
|
|
there is no space between '-S' and its path.)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Decompile entire file</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/produce_c_file.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_auto.auto_wait</li>
|
|
<li>ida_hexrays.VDRUN_MAYSTOP</li>
|
|
<li>ida_hexrays.VDRUN_NEWFILE</li>
|
|
<li>ida_hexrays.VDRUN_SILENT</li>
|
|
<li>ida_hexrays.decompile_many</li>
|
|
<li>ida_loader.PATH_TYPE_IDB</li>
|
|
<li>ida_loader.get_path</li>
|
|
<li>ida_pro.qexit</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="produce_lst_file">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/produce_lst_file.py">produce_lst_file</a>: <i>Produce listing</i>
|
|
</div>
|
|
<div class="details" id="DIV_produce_lst_file">
|
|
|
|
<pre>
|
|
Automate IDA to perform auto-analysis on a file and,
|
|
once that is done, produce a .lst file with the disassembly.
|
|
|
|
Run like so:
|
|
|
|
ida -A "-S...path/to/produce_lst_file.py" <binary-file>
|
|
|
|
where:
|
|
|
|
* -A instructs IDA to run in non-interactive mode
|
|
* -S holds a path to the script to run (note this is a single token;
|
|
there is no space between '-S' and its path.)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Produce listing</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/produce_lst_file.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_auto.auto_wait</li>
|
|
<li>ida_fpro.qfile_t</li>
|
|
<li>ida_ida.inf_get_max_ea</li>
|
|
<li>ida_ida.inf_get_min_ea</li>
|
|
<li>ida_loader.OFILE_LST</li>
|
|
<li>ida_loader.PATH_TYPE_IDB</li>
|
|
<li>ida_loader.gen_file</li>
|
|
<li>ida_loader.get_path</li>
|
|
<li>ida_pro.qexit</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="register_timer">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/register_timer.py">register_timer</a>: <i>Using timers for delayed execution</i>
|
|
</div>
|
|
<div class="details" id="DIV_register_timer">
|
|
|
|
<pre>
|
|
Register (possibly repeating) timers.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Using timers for delayed execution</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/register_timer.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.register_timer</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="trigger_actions_programmatically">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/trigger_actions_programmatically.py">trigger_actions_programmatically</a>: <i>Execute existing actions programmatically</i>
|
|
</div>
|
|
<div class="details" id="DIV_trigger_actions_programmatically">
|
|
|
|
<pre>
|
|
It's possible to invoke any action programmatically, by using
|
|
either of those two:
|
|
|
|
* ida_kernwin.execute_ui_requests()
|
|
* ida_kernwin.process_ui_action()
|
|
|
|
Ideally, this script should be run through the "File > Script file..."
|
|
menu, so as to keep focus on "IDA View-A" and have the
|
|
'ProcessUiActions' part work as intended.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: core</li>
|
|
<li>Summary: Execute existing actions programmatically</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/trigger_actions_programmatically.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.ask_yn</li>
|
|
<li>ida_kernwin.execute_ui_requests</li>
|
|
<li>ida_kernwin.msg</li>
|
|
<li>ida_kernwin.process_ui_action</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: debugging</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="automatic_steps">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="debugging/dbghooks/automatic_steps.py">automatic_steps</a>: <i>Programmatically drive a debugging session</i>
|
|
</div>
|
|
<div class="details" id="DIV_automatic_steps">
|
|
|
|
<pre>
|
|
Start a debugging session, step through the first five
|
|
instructions. Each instruction is disassembled after
|
|
execution.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: debugging</li>
|
|
<li>Summary: Programmatically drive a debugging session</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/debugging/dbghooks/automatic_steps.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
DBG_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_dbg.DBG_Hooks</li>
|
|
<li>ida_dbg.get_reg_val</li>
|
|
<li>ida_dbg.request_exit_process</li>
|
|
<li>ida_dbg.request_run_to</li>
|
|
<li>ida_dbg.request_step_over</li>
|
|
<li>ida_dbg.run_requests</li>
|
|
<li>ida_ida.inf_get_start_ip</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_lines.generate_disasm_line</li>
|
|
<li>ida_lines.tag_remove</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="dbg_trace">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="debugging/dbghooks/dbg_trace.py">dbg_trace</a>: <i>Using the low-level tracing hook</i>
|
|
</div>
|
|
<div class="details" id="DIV_dbg_trace">
|
|
|
|
<pre>
|
|
This script demonstrates using the low-level tracing hook
|
|
(ida_dbg.DBG_Hooks.dbg_trace). It can be run like so:
|
|
|
|
ida[t].exe -B -Sdbg_trace.py -Ltrace.log file.exe
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: debugging</li>
|
|
<li>Summary: Using the low-level tracing hook</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/debugging/dbghooks/dbg_trace.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
DBG_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>GENDSM_FORCE_CODE</li>
|
|
<li>GENDSM_REMOVE_TAGS</li>
|
|
<li>NN_call</li>
|
|
<li>NN_callfi</li>
|
|
<li>NN_callni</li>
|
|
<li>generate_disasm_line</li>
|
|
<li>ida_dbg.DBG_Hooks</li>
|
|
<li>ida_dbg.ST_OVER_DEBUG_SEG</li>
|
|
<li>ida_dbg.ST_OVER_LIB_FUNC</li>
|
|
<li>ida_dbg.enable_step_trace</li>
|
|
<li>ida_dbg.get_process_state</li>
|
|
<li>ida_dbg.get_reg_val</li>
|
|
<li>ida_dbg.get_step_trace_options</li>
|
|
<li>ida_dbg.load_debugger</li>
|
|
<li>ida_dbg.refresh_debugger_memory</li>
|
|
<li>ida_dbg.request_continue_process</li>
|
|
<li>ida_dbg.request_enable_step_trace</li>
|
|
<li>ida_dbg.request_set_step_trace_options</li>
|
|
<li>ida_dbg.run_requests</li>
|
|
<li>ida_dbg.run_to</li>
|
|
<li>ida_dbg.set_step_trace_options</li>
|
|
<li>ida_dbg.wait_for_next_event</li>
|
|
<li>ida_ida.f_ELF</li>
|
|
<li>ida_ida.f_MACHO</li>
|
|
<li>ida_ida.f_PE</li>
|
|
<li>ida_ida.inf_get_filetype</li>
|
|
<li>ida_ida.inf_get_max_ea</li>
|
|
<li>ida_ida.inf_get_min_ea</li>
|
|
<li>ida_ida.inf_get_start_ip</li>
|
|
<li>ida_pro.qexit</li>
|
|
<li>ida_ua.decode_insn</li>
|
|
<li>ida_ua.insn_t</li>
|
|
<li>idc.ARGV</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="print_call_stack">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="debugging/misc/print_call_stack.py">print_call_stack</a>: <i>Print call stack (on Linux)</i>
|
|
</div>
|
|
<div class="details" id="DIV_print_call_stack">
|
|
|
|
<pre>
|
|
Print the return addresses from the call stack at a breakpoint.
|
|
(and print also the module and the debug name from debugger)
|
|
|
|
To use this example:
|
|
|
|
* run `ida64` on test program `simple_appcall_linux64`, or
|
|
`ida` on test program `simple_appcall_linux32`, and wait for
|
|
auto-analysis to finish
|
|
* put a breakpoint where you want to see the call stack
|
|
* select the 'linux debugger' (either local, or remote)
|
|
* start debugging
|
|
* Press Shift+C at the breakpoint
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: debugging</li>
|
|
<li>Summary: Print call stack (on Linux)</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/debugging/misc/print_call_stack.py">GitHub</a></li>
|
|
|
|
<li>Shortcut:
|
|
Shift+C
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_dbg.collect_stack_trace</li>
|
|
<li>ida_dbg.get_current_thread</li>
|
|
<li>ida_dbg.get_module_info</li>
|
|
<li>ida_idd.call_stack_t</li>
|
|
<li>ida_idd.modinfo_t</li>
|
|
<li>ida_kernwin.AST_ENABLE_ALWAYS</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_name.GNCN_NOCOLOR</li>
|
|
<li>ida_name.GNCN_NOLABEL</li>
|
|
<li>ida_name.GNCN_NOSEG</li>
|
|
<li>ida_name.GNCN_PREFDBG</li>
|
|
<li>ida_name.get_nice_colored_name</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="print_registers">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="debugging/misc/print_registers.py">print_registers</a>: <i>Print all registers, for all threads</i>
|
|
</div>
|
|
<div class="details" id="DIV_print_registers">
|
|
|
|
<pre>
|
|
Iterate over the list of threads in the program being
|
|
debugged, and dump all registers contents
|
|
|
|
To use this example:
|
|
|
|
* run `ida64` on test program `simple_appcall_linux64`, or
|
|
`ida` on test program `simple_appcall_linux32`, and wait for
|
|
auto-analysis to finish
|
|
* put a breakpoint somewhere in the code
|
|
* select the 'linux debugger' (either local, or remote)
|
|
* start debugging
|
|
* Press Alt+Shift+C at the breakpoint
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: debugging</li>
|
|
<li>Summary: Print all registers, for all threads</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/debugging/misc/print_registers.py">GitHub</a></li>
|
|
|
|
<li>Shortcut:
|
|
Alt+Shift+C
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_dbg.get_reg_vals</li>
|
|
<li>ida_dbg.get_thread_qty</li>
|
|
<li>ida_dbg.getn_thread</li>
|
|
<li>ida_idd.get_dbg</li>
|
|
<li>ida_kernwin.AST_ENABLE_ALWAYS</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="registers_context_menu">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="debugging/misc/registers_context_menu.py">registers_context_menu</a>: <i>Adding actions to the "registers" widget(s)</i>
|
|
</div>
|
|
<div class="details" id="DIV_registers_context_menu">
|
|
|
|
<pre>
|
|
It's possible to add actions to the context menu of
|
|
pretty much all widgets in IDA.
|
|
|
|
This example shows how to do just that for
|
|
registers-displaying widgets (e.g., "General registers")
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: debugging</li>
|
|
<li>Summary: Adding actions to the "registers" widget(s)</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/debugging/misc/registers_context_menu.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
ctxmenu
|
|
UI_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_dbg.get_dbg_reg_info</li>
|
|
<li>ida_dbg.get_reg_val</li>
|
|
<li>ida_idd.register_info_t</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_CPUREGS</li>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.get_widget_type</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_ua.dt_byte</li>
|
|
<li>ida_ua.dt_dword</li>
|
|
<li>ida_ua.dt_qword</li>
|
|
<li>ida_ua.dt_word</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="show_debug_names">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="debugging/show_debug_names.py">show_debug_names</a>: <i>Retrieving & dumping debuggee symbols</i>
|
|
</div>
|
|
<div class="details" id="DIV_show_debug_names">
|
|
|
|
<pre>
|
|
Queries the debugger (possibly remotely) for the list of
|
|
symbols that the process being debugged, provides.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: debugging</li>
|
|
<li>Summary: Retrieving & dumping debuggee symbols</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/debugging/show_debug_names.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_dbg.get_process_state</li>
|
|
<li>ida_dbg.is_debugger_on</li>
|
|
<li>ida_ida.inf_get_max_ea</li>
|
|
<li>ida_ida.inf_get_min_ea</li>
|
|
<li>ida_name.get_debug_names</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="simple_appcall_linux">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="debugging/appcall/simple_appcall_linux.py">simple_appcall_linux</a>: <i>Executing code into the application being debugged (on Linux)</i>
|
|
</div>
|
|
<div class="details" id="DIV_simple_appcall_linux">
|
|
|
|
<pre>
|
|
Using the `ida_idd.Appcall` utility to execute code in
|
|
the process being debugged.
|
|
|
|
This example will run the test program and stop wherever
|
|
the cursor currently is, and then perform an appcall to
|
|
execute the `ref4` and `ref8` functions.
|
|
|
|
To use this example:
|
|
|
|
* run `ida64` on test program `simple_appcall_linux64`, or
|
|
`ida` on test program `simple_appcall_linux32`, and wait for
|
|
auto-analysis to finish
|
|
* select the 'linux debugger' (either local, or remote)
|
|
* run this script
|
|
|
|
Note: the real body of code is in `simple_appcall_common.py`.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: debugging</li>
|
|
<li>Summary: Executing code into the application being debugged (on Linux)</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/debugging/appcall/simple_appcall_linux.py">GitHub</a></li>
|
|
|
|
|
|
<li>Imports
|
|
<ul>
|
|
<li>simple_appcall_common</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_dbg.DBG_Hooks</li>
|
|
<li>ida_dbg.run_to</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_idd.Appcall</li>
|
|
<li>ida_idd.Appcall.byref</li>
|
|
<li>ida_idd.Appcall.int64</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_name.get_name_ea</li>
|
|
<li>ida_name.set_name</li>
|
|
<li>ida_typeinf.apply_cdecl</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="simple_appcall_win">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="debugging/appcall/simple_appcall_win.py">simple_appcall_win</a>: <i>Executing code into the application being debugged (on Windows)</i>
|
|
</div>
|
|
<div class="details" id="DIV_simple_appcall_win">
|
|
|
|
<pre>
|
|
Using the `ida_idd.Appcall` utility to execute code in
|
|
the process being debugged.
|
|
|
|
This example will run the test program and stop wherever
|
|
the cursor currently is, and then perform an appcall to
|
|
execute the `ref4` and `ref8` functions.
|
|
|
|
To use this example:
|
|
|
|
* run `ida64` on test program `simple_appcall_win64.exe`, or
|
|
`ida` on test program `simple_appcall_win32.exe`, and wait for
|
|
auto-analysis to finish
|
|
* select the 'windows debugger' (either local, or remote)
|
|
* run this script
|
|
|
|
Note: the real body of code is in `simple_appcall_common.py`.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: debugging</li>
|
|
<li>Summary: Executing code into the application being debugged (on Windows)</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/debugging/appcall/simple_appcall_win.py">GitHub</a></li>
|
|
|
|
|
|
<li>Imports
|
|
<ul>
|
|
<li>simple_appcall_common</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_dbg.DBG_Hooks</li>
|
|
<li>ida_dbg.run_to</li>
|
|
<li>ida_ida.inf_is_64bit</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_idd.Appcall</li>
|
|
<li>ida_idd.Appcall.byref</li>
|
|
<li>ida_idd.Appcall.int64</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_name.get_name_ea</li>
|
|
<li>ida_name.set_name</li>
|
|
<li>ida_typeinf.apply_cdecl</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: disassembly</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="colorize_disassembly">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="core/colorize_disassembly.py">colorize_disassembly</a>: <i>Change background colours</i>
|
|
</div>
|
|
<div class="details" id="DIV_colorize_disassembly">
|
|
|
|
<pre>
|
|
This illustrates the setting/retrieval of background colours
|
|
using the IDC wrappers
|
|
|
|
In order to do so, we'll be assigning colors to specific ranges
|
|
(item, function, or segment). Those will be persisted in the
|
|
database.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: disassembly</li>
|
|
<li>Summary: Change background colours</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/core/colorize_disassembly.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
coloring
|
|
idc
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>idc.CIC_FUNC</li>
|
|
<li>idc.CIC_ITEM</li>
|
|
<li>idc.CIC_SEGM</li>
|
|
<li>idc.get_color</li>
|
|
<li>idc.here</li>
|
|
<li>idc.set_color</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#colorize_disassembly_on_the_fly">colorize_disassembly_on_the_fly</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: hexrays</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="colorize_pseudocode_lines">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/colorize_pseudocode_lines.py">colorize_pseudocode_lines</a>: <i>Interactively color certain pseudocode lines</i>
|
|
</div>
|
|
<div class="details" id="DIV_colorize_pseudocode_lines">
|
|
|
|
<pre>
|
|
Provides an action that can be used to dynamically alter the
|
|
lines background rendering for pseudocode listings (as opposed to
|
|
using `ida_hexrays.cfunc_t.pseudocode[N].bgcolor`)
|
|
|
|
After running this script, pressing 'M' on a line in a
|
|
"Pseudocode-?" widget, will cause that line to be rendered
|
|
with a special background color.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Interactively color certain pseudocode lines</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/colorize_pseudocode_lines.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
colors
|
|
UI_Hooks
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
M
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.get_widget_vdui</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_PSEUDOCODE</li>
|
|
<li>ida_kernwin.CK_EXTRA11</li>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.get_custom_viewer_location</li>
|
|
<li>ida_kernwin.line_rendering_output_entry_t</li>
|
|
<li>ida_kernwin.refresh_custom_viewer</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_moves.lochist_entry_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="curpos_details">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/curpos_details.py">curpos_details</a>: <i>A focus on the 'curpos' hook, printing additional details about user input</i>
|
|
</div>
|
|
<div class="details" id="DIV_curpos_details">
|
|
|
|
<pre>
|
|
Shows how user input information can be retrieved during
|
|
processing of a notification triggered by that input
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: A focus on the 'curpos' hook, printing additional details about user input</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/curpos_details.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
Hexrays_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_kernwin.get_user_input_event</li>
|
|
<li>ida_kernwin.iek_key_press</li>
|
|
<li>ida_kernwin.iek_key_release</li>
|
|
<li>ida_kernwin.iek_mouse_button_press</li>
|
|
<li>ida_kernwin.iek_mouse_button_release</li>
|
|
<li>ida_kernwin.iek_mouse_wheel</li>
|
|
<li>ida_kernwin.iek_shortcut</li>
|
|
<li>ida_kernwin.input_event_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#vds_hooks">vds_hooks</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="decompile_entry_points">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/decompile_entry_points.py">decompile_entry_points</a>: <i>Automatic decompilation of functions</i>
|
|
</div>
|
|
<div class="details" id="DIV_decompile_entry_points">
|
|
|
|
<pre>
|
|
Attempts to load a decompiler plugin corresponding to the current
|
|
architecture (and address size) right after auto-analysis is performed,
|
|
and then tries to decompile the function at the first entrypoint.
|
|
|
|
It is particularly suited for use with the '-S' flag, for example:
|
|
idat -Ldecompile.log -Sdecompile_entry_points.py -c file
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Automatic decompilation of functions</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/decompile_entry_points.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_auto.auto_wait</li>
|
|
<li>ida_entry.get_entry</li>
|
|
<li>ida_entry.get_entry_ordinal</li>
|
|
<li>ida_entry.get_entry_qty</li>
|
|
<li>ida_hexrays.decompile</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_ida.inf_is_64bit</li>
|
|
<li>ida_idp.PLFM_386</li>
|
|
<li>ida_idp.PLFM_ARM</li>
|
|
<li>ida_idp.PLFM_MIPS</li>
|
|
<li>ida_idp.PLFM_PPC</li>
|
|
<li>ida_idp.ph.id</li>
|
|
<li>ida_kernwin.cvar.batch</li>
|
|
<li>ida_kernwin.msg</li>
|
|
<li>ida_loader.load_plugin</li>
|
|
<li>ida_pro.qexit</li>
|
|
<li>idc.get_idb_path</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds1">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds1.py">vds1</a>: <i>Decompile & print current function.</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds1">
|
|
|
|
<pre>
|
|
Decompile & print current function.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Decompile & print current function.</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds1.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_hexrays.decompile</li>
|
|
<li>ida_hexrays.get_hexrays_version</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_lines.tag_remove</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds10">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds10.py">vds10</a>: <i>A custom microcode instruction optimization rule</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds10">
|
|
|
|
<pre>
|
|
Installs a custom microcode instruction optimization rule,
|
|
to transform:
|
|
|
|
call !DbgRaiseAssertionFailure <fast:>.0
|
|
|
|
into
|
|
|
|
call !DbgRaiseAssertionFailure <fast:"char *" "assertion text">.0
|
|
|
|
To see this plugin in action please use arm64_brk.i64
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: A custom microcode instruction optimization rule</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds10.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
plugin
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.get_cmt</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.mop_str</li>
|
|
<li>ida_hexrays.optinsn_t</li>
|
|
<li>ida_idaapi.PLUGIN_HIDE</li>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_typeinf.STI_PCCHAR</li>
|
|
<li>ida_typeinf.tinfo_t.get_stock</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds11">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds11.py">vds11</a>: <i>A custom microcode block optimization rule (resolve `goto` chains)</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds11">
|
|
|
|
<pre>
|
|
Installs a custom microcode block optimization rule,
|
|
to transform:
|
|
|
|
goto L1
|
|
...
|
|
L1:
|
|
goto L2
|
|
|
|
into
|
|
|
|
goto L2
|
|
|
|
In other words we fix a goto target if it points to a chain of gotos.
|
|
This improves the decompiler output in some cases.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: A custom microcode block optimization rule (resolve `goto` chains)</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds11.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
plugin
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.getf_reginsn</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.m_goto</li>
|
|
<li>ida_hexrays.optblock_t</li>
|
|
<li>ida_idaapi.PLUGIN_HIDE</li>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds12">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds12.py">vds12</a>: <i>List instruction registers</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds12">
|
|
|
|
<pre>
|
|
Shows a list of direct references to a register from the
|
|
current instruction.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: List instruction registers</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds12.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.get_flags</li>
|
|
<li>ida_bytes.is_code</li>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_hexrays.ACFL_GUESS</li>
|
|
<li>ida_hexrays.DECOMP_NO_CACHE</li>
|
|
<li>ida_hexrays.DECOMP_WARNINGS</li>
|
|
<li>ida_hexrays.GCO_DEF</li>
|
|
<li>ida_hexrays.GCO_USE</li>
|
|
<li>ida_hexrays.GC_REGS_AND_STKVARS</li>
|
|
<li>ida_hexrays.MERR_OK</li>
|
|
<li>ida_hexrays.MMAT_PREOPTIMIZED</li>
|
|
<li>ida_hexrays.MUST_ACCESS</li>
|
|
<li>ida_hexrays.gco_info_t</li>
|
|
<li>ida_hexrays.gen_microcode</li>
|
|
<li>ida_hexrays.get_current_operand</li>
|
|
<li>ida_hexrays.get_merror_desc</li>
|
|
<li>ida_hexrays.hexrays_failure_t</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.mba_ranges_t</li>
|
|
<li>ida_hexrays.mlist_t</li>
|
|
<li>ida_hexrays.op_parent_info_t</li>
|
|
<li>ida_hexrays.voff_t</li>
|
|
<li>ida_kernwin.Choose</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_kernwin.jumpto</li>
|
|
<li>ida_kernwin.warning</li>
|
|
<li>ida_lines.GENDSM_REMOVE_TAGS</li>
|
|
<li>ida_lines.generate_disasm_line</li>
|
|
<li>ida_pro.eavec_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds13">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds13.py">vds13</a>: <i>Generates microcode for selection</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds13">
|
|
|
|
<pre>
|
|
Generates microcode for selection and dumps it to the output window.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Generates microcode for selection</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds13.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.get_flags</li>
|
|
<li>ida_bytes.is_code</li>
|
|
<li>ida_hexrays.DECOMP_WARNINGS</li>
|
|
<li>ida_hexrays.gen_microcode</li>
|
|
<li>ida_hexrays.hexrays_failure_t</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.mba_ranges_t</li>
|
|
<li>ida_hexrays.vd_printer_t</li>
|
|
<li>ida_kernwin.read_range_selection</li>
|
|
<li>ida_kernwin.warning</li>
|
|
<li>ida_range.range_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds17">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds17.py">vds17</a>: <i>Using the "Select offsets" widget</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds17">
|
|
|
|
<pre>
|
|
Registers an action opens the "Select offsets" widget
|
|
(select_udt_by_offset() call).
|
|
|
|
This effectively repeats the functionality already available
|
|
through Alt+Y.
|
|
|
|
Place cursor on the union field and press Shift+T
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Using the "Select offsets" widget</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds17.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
plugin
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
Shift+T
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.USE_KEYBOARD</li>
|
|
<li>ida_hexrays.cot_add</li>
|
|
<li>ida_hexrays.cot_cast</li>
|
|
<li>ida_hexrays.cot_memptr</li>
|
|
<li>ida_hexrays.cot_memref</li>
|
|
<li>ida_hexrays.cot_num</li>
|
|
<li>ida_hexrays.cot_ref</li>
|
|
<li>ida_hexrays.get_hexrays_version</li>
|
|
<li>ida_hexrays.get_widget_vdui</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.select_udt_by_offset</li>
|
|
<li>ida_hexrays.ui_stroff_applicator_t</li>
|
|
<li>ida_hexrays.ui_stroff_ops_t</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_idaapi.PLUGIN_HIDE</li>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_PSEUDOCODE</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.get_custom_viewer_curline</li>
|
|
<li>ida_kernwin.msg</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.warning</li>
|
|
<li>ida_lines.tag_remove</li>
|
|
<li>ida_typeinf.PRTYPE_1LINE</li>
|
|
<li>ida_typeinf.print_tinfo</li>
|
|
<li>ida_typeinf.remove_pointer</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds19">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds19.py">vds19</a>: <i>A custom microcode instruction optimization rule (`x | ~x => -1`)</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds19">
|
|
|
|
<pre>
|
|
Installs a custom microcode instruction optimization rule,
|
|
to transform:
|
|
|
|
x | ~x
|
|
|
|
into
|
|
|
|
-1
|
|
|
|
To see this plugin in action please use be_ornot_be.idb
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: A custom microcode instruction optimization rule (`x | ~x => -1`)</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds19.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
plugin
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.m_bnot</li>
|
|
<li>ida_hexrays.m_mov</li>
|
|
<li>ida_hexrays.m_or</li>
|
|
<li>ida_hexrays.minsn_visitor_t</li>
|
|
<li>ida_hexrays.mop_t</li>
|
|
<li>ida_hexrays.optinsn_t</li>
|
|
<li>ida_idaapi.PLUGIN_HIDE</li>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds21">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds21.py">vds21</a>: <i>Dynamically provide a custom call type</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds21">
|
|
|
|
<pre>
|
|
This plugin can greatly improve decompilation of indirect calls:
|
|
|
|
call [eax+4]
|
|
|
|
For them, the decompiler has to guess the prototype of the called function.
|
|
This has to be done at a very early phase of decompilation because
|
|
the function prototype influences the data flow analysis. On the other
|
|
hand, we do not have global data flow analysis results yet because
|
|
we haven't analyzed all calls in the function. It is a chicked-and-egg
|
|
problem.
|
|
|
|
The decompiler uses various techniques to guess the called function
|
|
prototype. While it works very well, it may fail in some cases.
|
|
|
|
To fix, the user can specify the call prototype manually, using
|
|
"Edit, Operand types, Set operand type" at the call instruction.
|
|
|
|
This plugin illustrates another approach to the problem:
|
|
if you happen to be able to calculate the call prototypes dynamically,
|
|
this is how to inform the decompiler about them.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Dynamically provide a custom call type</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds21.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
Hexrays_Hooks
|
|
plugin
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.m_call</li>
|
|
<li>ida_hexrays.mcallinfo_t</li>
|
|
<li>ida_idaapi.PLUGIN_HIDE</li>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_kernwin.msg</li>
|
|
<li>ida_kernwin.warning</li>
|
|
<li>ida_nalt.get_op_tinfo</li>
|
|
<li>ida_typeinf.BT_INT</li>
|
|
<li>ida_typeinf.CM_CC_STDCALL</li>
|
|
<li>ida_typeinf.CM_N32_F48</li>
|
|
<li>ida_typeinf.parse_decl</li>
|
|
<li>ida_typeinf.tinfo_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds3">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds3.py">vds3</a>: <i>Invert if/else blocks</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds3">
|
|
|
|
<pre>
|
|
Registers an action that can be used to invert the `if`
|
|
and `else` blocks of a `ida_hexrays.cif_t`.
|
|
|
|
For example, a statement like
|
|
|
|
if ( cond )
|
|
{
|
|
statements1;
|
|
}
|
|
else
|
|
{
|
|
statements2;
|
|
}
|
|
|
|
will be displayed as
|
|
|
|
if ( !cond )
|
|
{
|
|
statements2;
|
|
}
|
|
else
|
|
{
|
|
statements1;
|
|
}
|
|
|
|
The modifications are persistent: the user can quit & restart
|
|
IDA, and the changes will be present.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Invert if/else blocks</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds3.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
ctxmenu
|
|
Hexrays_Hooks
|
|
IDP_Hooks
|
|
plugin
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
I
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.CMAT_FINAL</li>
|
|
<li>ida_hexrays.CV_FAST</li>
|
|
<li>ida_hexrays.CV_INSNS</li>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_hexrays.ITP_ELSE</li>
|
|
<li>ida_hexrays.USE_KEYBOARD</li>
|
|
<li>ida_hexrays.VDI_TAIL</li>
|
|
<li>ida_hexrays.cexpr_t</li>
|
|
<li>ida_hexrays.cit_if</li>
|
|
<li>ida_hexrays.ctree_visitor_t</li>
|
|
<li>ida_hexrays.get_widget_vdui</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.lnot</li>
|
|
<li>ida_hexrays.qswap</li>
|
|
<li>ida_idaapi.PLUGIN_HIDE</li>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_idp.IDP_Hooks</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_PSEUDOCODE</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_netnode.netnode</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
<li>Author: EiNSTeiN_ (einstein@g3nius.org)</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds4">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds4.py">vds4</a>: <i>Dump user-defined information</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds4">
|
|
|
|
<pre>
|
|
Prints user-defined information to the "Output" window.
|
|
Namely:
|
|
|
|
* user defined label names
|
|
* user defined indented comments
|
|
* user defined number formats
|
|
* user defined local variable names, types, comments
|
|
|
|
This script loads information from the database without decompiling anything.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Dump user-defined information</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds4.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.get_radix</li>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_hexrays.CIT_COLLAPSED</li>
|
|
<li>ida_hexrays.NF_NEGATE</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.lvar_uservec_t</li>
|
|
<li>ida_hexrays.restore_user_cmts</li>
|
|
<li>ida_hexrays.restore_user_iflags</li>
|
|
<li>ida_hexrays.restore_user_labels</li>
|
|
<li>ida_hexrays.restore_user_lvar_settings</li>
|
|
<li>ida_hexrays.restore_user_numforms</li>
|
|
<li>ida_hexrays.user_cmts_free</li>
|
|
<li>ida_hexrays.user_iflags_free</li>
|
|
<li>ida_hexrays.user_labels_free</li>
|
|
<li>ida_hexrays.user_numforms_free</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
<li>Author: EiNSTeiN_ (einstein@g3nius.org)</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds5">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds5.py">vds5</a>: <i>Show ctree graph</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds5">
|
|
|
|
<pre>
|
|
Registers an action that can be used to show the graph of the ctree.
|
|
The current item will be highlighted in the graph.
|
|
|
|
The command shortcut is `Ctrl+Shift+G`, and is also added
|
|
to the context menu.
|
|
|
|
To display the graph, we produce a .gdl file, and
|
|
request that ida displays that using `ida_gdl.display_gdl`.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Show ctree graph</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds5.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
ctxmenu
|
|
Hexrays_Hooks
|
|
plugin
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
Ctrl+Shift+G
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_gdl.display_gdl</li>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_hexrays.USE_KEYBOARD</li>
|
|
<li>ida_hexrays.cit_asm</li>
|
|
<li>ida_hexrays.cit_goto</li>
|
|
<li>ida_hexrays.cot_helper</li>
|
|
<li>ida_hexrays.cot_memptr</li>
|
|
<li>ida_hexrays.cot_memref</li>
|
|
<li>ida_hexrays.cot_num</li>
|
|
<li>ida_hexrays.cot_obj</li>
|
|
<li>ida_hexrays.cot_ptr</li>
|
|
<li>ida_hexrays.cot_str</li>
|
|
<li>ida_hexrays.cot_var</li>
|
|
<li>ida_hexrays.ctree_parentee_t</li>
|
|
<li>ida_hexrays.get_ctype_name</li>
|
|
<li>ida_hexrays.get_widget_vdui</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_idaapi.PLUGIN_HIDE</li>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_PSEUDOCODE</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.warning</li>
|
|
<li>ida_lines.tag_remove</li>
|
|
<li>ida_pro.str2user</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds6">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds6.py">vds6</a>: <i>Superficially modify the decompilation output</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds6">
|
|
|
|
<pre>
|
|
Modifies the decompilation output in a superficial manner,
|
|
by removing some white spaces
|
|
|
|
Note: this is rather crude, not quite "pythonic" code.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Superficially modify the decompilation output</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds6.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
Hexrays_Hooks
|
|
plugin
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_idaapi.PLUGIN_HIDE</li>
|
|
<li>ida_idaapi.PLUGIN_KEEP</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_lines.tag_advance</li>
|
|
<li>ida_lines.tag_skipcodes</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds7">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds7.py">vds7</a>: <i>Iterate a cblock_t object</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds7">
|
|
|
|
<pre>
|
|
Using a `ida_hexrays.ctree_visitor_t`, search for
|
|
`ida_hexrays.cit_block` instances and dump them.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Iterate a cblock_t object</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds7.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
Hexrays_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.CMAT_BUILT</li>
|
|
<li>ida_hexrays.CV_FAST</li>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_hexrays.cit_block</li>
|
|
<li>ida_hexrays.ctree_visitor_t</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
<li>Author: EiNSTeiN_ (einstein@g3nius.org)</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds8">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds8.py">vds8</a>: <i>Using `ida_hexrays.udc_filter_t`</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds8">
|
|
|
|
<pre>
|
|
Registers an action that uses a `ida_hexrays.udc_filter_t` to decompile
|
|
`svc 0x900001` and `svc 0x9000F8` as function calls to
|
|
`svc_exit()` and `svc_exit_group()` respectively.
|
|
|
|
You will need to have an ARM + Linux IDB for this script to be usable
|
|
|
|
In addition to having a shortcut, the action will be present
|
|
in the context menu.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Using `ida_hexrays.udc_filter_t`</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds8.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
ctxmenu
|
|
UI_Hooks
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
Ctrl+Shift+U
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_allins.ARM_svc</li>
|
|
<li>ida_hexrays.get_widget_vdui</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.install_microcode_filter</li>
|
|
<li>ida_hexrays.udc_filter_t</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_PSEUDOCODE</li>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.get_widget_type</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds_create_hint">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds_create_hint.py">vds_create_hint</a>: <i>Decompiler hints</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds_create_hint">
|
|
|
|
<pre>
|
|
Handle `ida_hexrays.hxe_create_hint` notification using hooks,
|
|
to return our own.
|
|
|
|
If the object under the cursor is:
|
|
|
|
* a function call, prefix the original decompiler hint with `==> `
|
|
* a local variable declaration, replace the hint with our own in
|
|
the form of `!{varname}` (where `{varname}` is replaced with the
|
|
variable name)
|
|
* an `if` statement, replace the hint with our own, saying "condition"
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Decompiler hints</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds_create_hint.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
Hexrays_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_hexrays.USE_MOUSE</li>
|
|
<li>ida_hexrays.VDI_EXPR</li>
|
|
<li>ida_hexrays.VDI_LVAR</li>
|
|
<li>ida_hexrays.cit_if</li>
|
|
<li>ida_hexrays.cot_call</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds_hooks">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds_hooks.py">vds_hooks</a>: <i>Various decompiler hooks</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds_hooks">
|
|
|
|
<pre>
|
|
Shows how to hook to many notifications sent by the decompiler.
|
|
|
|
This plugin doesn't really accomplish anything: it just prints
|
|
the parameters.
|
|
|
|
The list of notifications handled below should be exhaustive,
|
|
and is there to hint at what is possible to accomplish by
|
|
subclassing `ida_hexrays.Hexrays_Hooks`
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Various decompiler hooks</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds_hooks.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
Hexrays_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_hexrays.cfunc_t</li>
|
|
<li>ida_hexrays.lvar_t</li>
|
|
<li>ida_hexrays.vdui_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#curpos_details">curpos_details</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds_modify_user_lvars">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds_modify_user_lvars.py">vds_modify_user_lvars</a>: <i>Modifying local variables</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds_modify_user_lvars">
|
|
|
|
<pre>
|
|
Use a `ida_hexrays.user_lvar_modifier_t` to modify names,
|
|
comments and/or types of local variables.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Modifying local variables</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds_modify_user_lvars.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.modify_user_lvars</li>
|
|
<li>ida_hexrays.user_lvar_modifier_t</li>
|
|
<li>ida_typeinf.parse_decl</li>
|
|
<li>ida_typeinf.tinfo_t</li>
|
|
<li>idc.here</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="vds_xrefs">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="hexrays/vds_xrefs.py">vds_xrefs</a>: <i>Show decompiler xrefs</i>
|
|
</div>
|
|
<div class="details" id="DIV_vds_xrefs">
|
|
|
|
<pre>
|
|
Show decompiler-style Xref when the `Ctrl+X` key is
|
|
pressed in the Decompiler window.
|
|
|
|
* supports any global name: functions, strings, integers, ...
|
|
* supports structure member.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: hexrays</li>
|
|
<li>Summary: Show decompiler xrefs</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/hexrays/vds_xrefs.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
ctxmenu
|
|
Hexrays_Hooks
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
Ctrl+X
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func_name</li>
|
|
<li>ida_hexrays.Hexrays_Hooks</li>
|
|
<li>ida_hexrays.USE_KEYBOARD</li>
|
|
<li>ida_hexrays.VDI_EXPR</li>
|
|
<li>ida_hexrays.VDI_FUNC</li>
|
|
<li>ida_hexrays.cexpr_t</li>
|
|
<li>ida_hexrays.cfunc_t</li>
|
|
<li>ida_hexrays.cinsn_t</li>
|
|
<li>ida_hexrays.decompile</li>
|
|
<li>ida_hexrays.get_widget_vdui</li>
|
|
<li>ida_hexrays.init_hexrays_plugin</li>
|
|
<li>ida_hexrays.open_pseudocode</li>
|
|
<li>ida_hexrays.qstring_printer_t</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_kernwin.AST_DISABLE</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE</li>
|
|
<li>ida_kernwin.BWN_PSEUDOCODE</li>
|
|
<li>ida_kernwin.PluginForm</li>
|
|
<li>ida_kernwin.PluginForm.Show</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_struct.get_member</li>
|
|
<li>ida_struct.get_struc</li>
|
|
<li>ida_struct.get_struc_id</li>
|
|
<li>ida_typeinf.PRTYPE_1LINE</li>
|
|
<li>ida_typeinf.print_tinfo</li>
|
|
<li>idautils.Functions</li>
|
|
<li>idautils.XrefsTo</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
<li>Author: EiNSTeiN_ (einstein@g3nius.org)</li>
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: idbhooks</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="log_idb_events">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="idbhooks/log_idb_events.py">log_idb_events</a>: <i>Logging IDB events</i>
|
|
</div>
|
|
<div class="details" id="DIV_log_idb_events">
|
|
|
|
<pre>
|
|
These hooks will be notified about IDB events, and
|
|
dump their information to the "Output" window
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: idbhooks</li>
|
|
<li>Summary: Logging IDB events</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/idbhooks/log_idb_events.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
IDB_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_idp.IDB_Hooks</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="operand_changed">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="idbhooks/operand_changed.py">operand_changed</a>: <i>Notify the user when an instruction operand changes</i>
|
|
</div>
|
|
<div class="details" id="DIV_operand_changed">
|
|
|
|
<pre>
|
|
Show notifications whenever the user changes
|
|
an instruction's operand, or a data item.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: idbhooks</li>
|
|
<li>Summary: Notify the user when an instruction operand changes</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/idbhooks/operand_changed.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
IDB_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.ALOPT_IGNCLT</li>
|
|
<li>ida_bytes.ALOPT_IGNHEADS</li>
|
|
<li>ida_bytes.get_flags</li>
|
|
<li>ida_bytes.get_max_strlit_length</li>
|
|
<li>ida_bytes.get_opinfo</li>
|
|
<li>ida_bytes.get_strlit_contents</li>
|
|
<li>ida_bytes.is_custfmt</li>
|
|
<li>ida_bytes.is_custom</li>
|
|
<li>ida_bytes.is_enum</li>
|
|
<li>ida_bytes.is_off</li>
|
|
<li>ida_bytes.is_strlit</li>
|
|
<li>ida_bytes.is_stroff</li>
|
|
<li>ida_bytes.is_struct</li>
|
|
<li>ida_enum.get_enum_name</li>
|
|
<li>ida_idp.IDB_Hooks</li>
|
|
<li>ida_nalt.STRENC_DEFAULT</li>
|
|
<li>ida_nalt.get_default_encoding_idx</li>
|
|
<li>ida_nalt.get_encoding_name</li>
|
|
<li>ida_nalt.get_str_encoding_idx</li>
|
|
<li>ida_nalt.get_strtype_bpu</li>
|
|
<li>ida_nalt.opinfo_t</li>
|
|
<li>ida_struct.get_struc_name</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="replay_prototypes_changes">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="idbhooks/replay_prototypes_changes.py">replay_prototypes_changes</a>: <i>Record and replay changes in function prototypes</i>
|
|
</div>
|
|
<div class="details" id="DIV_replay_prototypes_changes">
|
|
|
|
<pre>
|
|
This is a sample script, that will record (in memory) all changes in
|
|
functions prototypes, in order to re-apply them later.
|
|
|
|
To use this script:
|
|
- open an IDB (say, "test.idb")
|
|
- modify some functions prototypes (e.g., by triggering the 'Y'
|
|
shortcut when the cursor is placed on the first address of a
|
|
function)
|
|
- reload that IDB, *without saving it first*
|
|
- call rpc.replay(), to re-apply the modifications.
|
|
|
|
Note: 'ti_changed' is also called for changes to the function
|
|
frames, but we'll only record function prototypes changes.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: idbhooks</li>
|
|
<li>Summary: Record and replay changes in function prototypes</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/idbhooks/replay_prototypes_changes.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
IDB_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_idp.IDB_Hooks</li>
|
|
<li>ida_typeinf.PRTYPE_1LINE</li>
|
|
<li>ida_typeinf.TINFO_DEFINITE</li>
|
|
<li>ida_typeinf.apply_tinfo</li>
|
|
<li>ida_typeinf.get_idati</li>
|
|
<li>ida_typeinf.tinfo_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: idphooks</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="ana_emu_out">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="idphooks/ana_emu_out.py">ana_emu_out</a>: <i>Override some parts of the processor module</i>
|
|
</div>
|
|
<div class="details" id="DIV_ana_emu_out">
|
|
|
|
<pre>
|
|
Implements disassembly of BUG_INSTR used in Linux kernel
|
|
BUG() macro, which is architecturally undefined and is not
|
|
disassembled by IDA's ARM module
|
|
|
|
See Linux/arch/arm/include/asm/bug.h for more info
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: idphooks</li>
|
|
<li>Summary: Override some parts of the processor module</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/idphooks/ana_emu_out.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
IDP_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.get_wide_dword</li>
|
|
<li>ida_bytes.get_wide_word</li>
|
|
<li>ida_idp.CUSTOM_INSN_ITYPE</li>
|
|
<li>ida_idp.IDP_Hooks</li>
|
|
<li>ida_idp.PLFM_ARM</li>
|
|
<li>ida_idp.ph.id</li>
|
|
<li>ida_idp.str2reg</li>
|
|
<li>ida_segregs.get_sreg</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="assemble">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="idphooks/assemble.py">assemble</a>: <i>An `ida_idp.IDP_Hooks.assembly` implementation</i>
|
|
</div>
|
|
<div class="details" id="DIV_assemble">
|
|
|
|
<pre>
|
|
We add support for assembling the following pseudo instructions:
|
|
|
|
* "zero eax" -> xor eax, eax
|
|
* "nothing" -> nop
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: idphooks</li>
|
|
<li>Summary: An `ida_idp.IDP_Hooks.assembly` implementation</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/idphooks/assemble.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
IDP_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_idp.IDP_Hooks</li>
|
|
<li>idautils.DecodeInstruction</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: merge</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="py_mex1">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="merge/py_mex1.py">py_mex1</a>: <i>Add merge functionality to a simple plugin, example 1</i>
|
|
</div>
|
|
<div class="details" id="DIV_py_mex1">
|
|
|
|
<pre>
|
|
This is a primitive plugin which asks user for some info and saves it for
|
|
some addresses.
|
|
|
|
We will add a merge functionality to plugin.
|
|
|
|
An IDA plugin may have two kinds of data with permanent storage:
|
|
1. Data common for entire database (e.g. the options).
|
|
To describe them we will use the idbattr_info_t type.
|
|
2. Data specific to a particular address.
|
|
To describe them we will use the merge_node_info_t type.
|
|
|
|
Also, see SDK/plugins/mex1 example
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: merge</li>
|
|
<li>Summary: Add merge functionality to a simple plugin, example 1</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/merge/py_mex1.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
IDP_Hooks
|
|
plugin
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_ida.IDI_ALTVAL</li>
|
|
<li>ida_ida.IDI_CSTR</li>
|
|
<li>ida_ida.IDI_SCALAR</li>
|
|
<li>ida_ida.IDI_SUPVAL</li>
|
|
<li>ida_ida.idbattr_info_t</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_idaapi.PLUGIN_MOD</li>
|
|
<li>ida_idaapi.PLUGIN_MULTI</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_idaapi.plugmod_t</li>
|
|
<li>ida_idp.IDP_Hooks</li>
|
|
<li>ida_kernwin.Form</li>
|
|
<li>ida_kernwin.Form.ChkGroupControl</li>
|
|
<li>ida_kernwin.Form.StringInput</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_merge.MERGE_KIND_END</li>
|
|
<li>ida_merge.MERGE_KIND_NONE</li>
|
|
<li>ida_merge.NDS_IS_STR</li>
|
|
<li>ida_merge.NDS_MAP_IDX</li>
|
|
<li>ida_merge.merge_handler_params_t</li>
|
|
<li>ida_merge.merge_node_info_t</li>
|
|
<li>ida_merge.moddata_diff_helper_t</li>
|
|
<li>ida_mergemod.create_std_modmerge_handlers</li>
|
|
<li>ida_netnode.BADNODE</li>
|
|
<li>ida_netnode.SIZEOF_nodeidx_t</li>
|
|
<li>ida_netnode.atag</li>
|
|
<li>ida_netnode.netnode</li>
|
|
<li>ida_netnode.stag</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="py_mex3">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="merge/py_mex3.py">py_mex3</a>: <i>This example uses the mex1 example and improves the user-interface for it.</i>
|
|
</div>
|
|
<div class="details" id="DIV_py_mex3">
|
|
|
|
<pre>
|
|
IDA Teams uses a chooser to display the merge conflicts.
|
|
To fill the chooser columns IDA Teams uses the following methods from diff_source_t type:
|
|
* print_diffpos_name()
|
|
* print_diffpos_details()
|
|
and UI hints from merge_handler_params_t type:
|
|
* ui_has_details()
|
|
* ui_complex_details()
|
|
* ui_complex_name()
|
|
|
|
In general, chooser columns are filled as following:
|
|
columns.clear()
|
|
NAME = print_diffpos_name()
|
|
if ui_complex_name()
|
|
then
|
|
columns.add(split NAME by ui_split_char())
|
|
else
|
|
columns[0] = NAME
|
|
if not ui_complex_details()
|
|
then
|
|
columns.add(print_diffpos_details())
|
|
|
|
Also, see SDK/plugins/mex3 example
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: merge</li>
|
|
<li>Summary: This example uses the mex1 example and improves the user-interface for it.</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/merge/py_mex3.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
IDP_Hooks
|
|
plugin
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_ida.IDI_ALTVAL</li>
|
|
<li>ida_ida.IDI_CSTR</li>
|
|
<li>ida_ida.IDI_SCALAR</li>
|
|
<li>ida_ida.IDI_SUPVAL</li>
|
|
<li>ida_ida.idbattr_info_t</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_idaapi.PLUGIN_MOD</li>
|
|
<li>ida_idaapi.PLUGIN_MULTI</li>
|
|
<li>ida_idaapi.plugin_t</li>
|
|
<li>ida_idaapi.plugmod_t</li>
|
|
<li>ida_idp.IDP_Hooks</li>
|
|
<li>ida_kernwin.Form</li>
|
|
<li>ida_kernwin.Form.ChkGroupControl</li>
|
|
<li>ida_kernwin.Form.StringInput</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_merge.MERGE_KIND_END</li>
|
|
<li>ida_merge.MERGE_KIND_NONE</li>
|
|
<li>ida_merge.MH_UI_COLONNAME</li>
|
|
<li>ida_merge.MH_UI_COMMANAME</li>
|
|
<li>ida_merge.MH_UI_NODETAILS</li>
|
|
<li>ida_merge.NDS_IS_STR</li>
|
|
<li>ida_merge.NDS_MAP_IDX</li>
|
|
<li>ida_merge.create_nodeval_merge_handlers</li>
|
|
<li>ida_merge.get_ea_diffpos_name</li>
|
|
<li>ida_merge.merge_handler_params_t</li>
|
|
<li>ida_merge.merge_node_helper_t</li>
|
|
<li>ida_merge.merge_node_info_t</li>
|
|
<li>ida_merge.moddata_diff_helper_t</li>
|
|
<li>ida_mergemod.create_std_modmerge_handlers</li>
|
|
<li>ida_nalt.node2ea</li>
|
|
<li>ida_netnode.BADNODE</li>
|
|
<li>ida_netnode.SIZEOF_nodeidx_t</li>
|
|
<li>ida_netnode.atag</li>
|
|
<li>ida_netnode.netnode</li>
|
|
<li>ida_netnode.stag</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: pyqt</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="inject_command">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="pyqt/inject_command.py">inject_command</a>: <i>Injecting commands in the "Output" window</i>
|
|
</div>
|
|
<div class="details" id="DIV_inject_command">
|
|
|
|
<pre>
|
|
This example illustrates how one can execute commands in the
|
|
"Output" window, from their own widgets.
|
|
|
|
A few notes:
|
|
|
|
* the original, underlying `cli:Execute` action, that has to be
|
|
triggered for the code present in the input field to execute
|
|
and be placed in the history, requires that the input field
|
|
has focus (otherwise it simply won't do anything.)
|
|
* this, in turn, forces us to do "delayed" execution of that action,
|
|
hence the need for a `QTimer`
|
|
* the IDA/SWiG 'TWidget' type that we retrieve through
|
|
`ida_kernwin.find_widget`, is not the same type as a
|
|
`QtWidgets.QWidget`. We therefore need to convert it using
|
|
`ida_kernwin.PluginForm.TWidgetToPyQtWidget`
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: pyqt</li>
|
|
<li>Summary: Injecting commands in the "Output" window</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/pyqt/inject_command.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.PluginForm.TWidgetToPyQtWidget</li>
|
|
<li>ida_kernwin.disabled_script_timeout_t</li>
|
|
<li>ida_kernwin.find_widget</li>
|
|
<li>ida_kernwin.process_ui_action</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="paint_over_navbar">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="pyqt/paint_over_navbar.py">paint_over_navbar</a>: <i>Custom painting on top of the navigation band</i>
|
|
</div>
|
|
<div class="details" id="DIV_paint_over_navbar">
|
|
|
|
<pre>
|
|
Using an "event filter", we'll intercept paint events
|
|
targeted at the navigation band widget, let it paint itself,
|
|
and then add our own markers on top.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: pyqt</li>
|
|
<li>Summary: Custom painting on top of the navigation band</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/pyqt/paint_over_navbar.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.PluginForm.FormToPyQtWidget</li>
|
|
<li>ida_kernwin.get_navband_pixel</li>
|
|
<li>ida_kernwin.open_navband_window</li>
|
|
<li>ida_segment.get_segm_qty</li>
|
|
<li>ida_segment.getnseg</li>
|
|
<li>idc.here</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="populate_pluginform_with_pyqt_widgets">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="pyqt/populate_pluginform_with_pyqt_widgets.py">populate_pluginform_with_pyqt_widgets</a>: <i>Adding PyQt5 widgets into an `ida_kernwin.PluginForm`</i>
|
|
</div>
|
|
<div class="details" id="DIV_populate_pluginform_with_pyqt_widgets">
|
|
|
|
<pre>
|
|
Using `ida_kernwin.PluginForm.FormToPyQtWidget`, this script
|
|
converts IDA's own dockable widget into a type that is
|
|
recognized by PyQt5, which then enables populating it with
|
|
regular Qt widgets.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: pyqt</li>
|
|
<li>Summary: Adding PyQt5 widgets into an `ida_kernwin.PluginForm`</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/pyqt/populate_pluginform_with_pyqt_widgets.py">GitHub</a></li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.PluginForm</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: uihooks</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="func_chooser_coloring">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="uihooks/func_chooser_coloring.py">func_chooser_coloring</a>: <i>Using `ida_kernwin.UI_Hooks.get_chooser_item_attrs` to override some defaults</i>
|
|
</div>
|
|
<div class="details" id="DIV_func_chooser_coloring">
|
|
|
|
<pre>
|
|
Color the function in the Function window according to its size.
|
|
The larger the function, the darker the color.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: uihooks</li>
|
|
<li>Summary: Using `ida_kernwin.UI_Hooks.get_chooser_item_attrs` to override some defaults</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/uihooks/func_chooser_coloring.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
UI_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
<li>ida_kernwin.enable_chooser_item_attrs</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="lines_rendering">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="uihooks/lines_rendering.py">lines_rendering</a>: <i>Dynamically colorize lines backgrounds (or parts of them)</i>
|
|
</div>
|
|
<div class="details" id="DIV_lines_rendering">
|
|
|
|
<pre>
|
|
Shows how one can dynamically alter the lines background
|
|
rendering (as opposed to, say, using ida_nalt.set_item_color()),
|
|
and also shows how that rendering can be limited to just a few
|
|
glyphs, not the whole line.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: uihooks</li>
|
|
<li>Summary: Dynamically colorize lines backgrounds (or parts of them)</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/uihooks/lines_rendering.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
UI_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.next_head</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_kernwin.CK_EXTRA1</li>
|
|
<li>ida_kernwin.CK_EXTRA10</li>
|
|
<li>ida_kernwin.CK_EXTRA11</li>
|
|
<li>ida_kernwin.CK_EXTRA12</li>
|
|
<li>ida_kernwin.CK_EXTRA13</li>
|
|
<li>ida_kernwin.CK_EXTRA14</li>
|
|
<li>ida_kernwin.CK_EXTRA15</li>
|
|
<li>ida_kernwin.CK_EXTRA16</li>
|
|
<li>ida_kernwin.CK_EXTRA2</li>
|
|
<li>ida_kernwin.CK_EXTRA3</li>
|
|
<li>ida_kernwin.CK_EXTRA4</li>
|
|
<li>ida_kernwin.CK_EXTRA5</li>
|
|
<li>ida_kernwin.CK_EXTRA6</li>
|
|
<li>ida_kernwin.CK_EXTRA7</li>
|
|
<li>ida_kernwin.CK_EXTRA8</li>
|
|
<li>ida_kernwin.CK_EXTRA9</li>
|
|
<li>ida_kernwin.CK_TRACE</li>
|
|
<li>ida_kernwin.CK_TRACE_OVL</li>
|
|
<li>ida_kernwin.LROEF_CPS_RANGE</li>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_kernwin.line_rendering_output_entry_t</li>
|
|
<li>ida_kernwin.refresh_idaview_anyway</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="log_misc_events">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="uihooks/log_misc_events.py">log_misc_events</a>: <i>Being notified, and logging a few UI events</i>
|
|
</div>
|
|
<div class="details" id="DIV_log_misc_events">
|
|
|
|
<pre>
|
|
Hooks to be notified about certain UI events, and
|
|
dump their information to the "Output" window
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: uihooks</li>
|
|
<li>Summary: Being notified, and logging a few UI events</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/uihooks/log_misc_events.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
UI_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="prevent_jump">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="uihooks/prevent_jump.py">prevent_jump</a>: <i>Taking precedence over actions</i>
|
|
</div>
|
|
<div class="details" id="DIV_prevent_jump">
|
|
|
|
<pre>
|
|
Using `ida_kernwin.UI_Hooks.preprocess_action`, it is possible
|
|
to respond to a command instead of the action that would
|
|
otherwise do it.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: uihooks</li>
|
|
<li>Summary: Taking precedence over actions</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/uihooks/prevent_jump.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
UI_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.UI_Hooks</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
<h2>Category: widgets</h2>
|
|
<div class="c_list" onclick="handle_click()">
|
|
<div class="example-entry collapsed-entry" name="add_menus">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/misc/add_menus.py">add_menus</a>: <i>Adding custom menus to IDA</i>
|
|
</div>
|
|
<div class="details" id="DIV_add_menus">
|
|
|
|
<pre>
|
|
It is possible to add custom menus to IDA, either at the
|
|
toplevel (i.e., into the menubar), or as submenus of existing
|
|
menus.
|
|
|
|
Notes:
|
|
|
|
* the same action can be present in more than 1 menu
|
|
* this example does not deal with context menus
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Adding custom menus to IDA</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/misc/add_menus.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.AST_ENABLE_ALWAYS</li>
|
|
<li>ida_kernwin.SETMENU_INS</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_menu</li>
|
|
<li>ida_kernwin.create_menu</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="askusingform">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/forms/askusingform.py">askusingform</a>: <i>Non-trivial uses of the `ida_kernwin.Form` helper class</i>
|
|
</div>
|
|
<div class="details" id="DIV_askusingform">
|
|
|
|
<pre>
|
|
How to query for complex user input, using IDA's built-in forms.
|
|
|
|
Note: while this example produces full-fledged forms for complex input,
|
|
simpler types of inputs might can be retrieved by using
|
|
`ida_kernwin.ask_str` and similar functions.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Non-trivial uses of the `ida_kernwin.Form` helper class</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/forms/askusingform.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
forms
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.Choose</li>
|
|
<li>ida_kernwin.Choose.CH_MULTI</li>
|
|
<li>ida_kernwin.Form</li>
|
|
<li>ida_kernwin.PluginForm.FORM_TAB</li>
|
|
<li>ida_kernwin.ask_str</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="choose">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/tabular_views/custom/choose.py">choose</a>: <i>A widget showing data in a tabular fashion</i>
|
|
</div>
|
|
<div class="details" id="DIV_choose">
|
|
|
|
<pre>
|
|
Shows how to subclass the ida_kernwin.Choose class to
|
|
show data organized in a simple table.
|
|
In addition, registers a couple actions that can be applied to it.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: A widget showing data in a tabular fashion</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/tabular_views/custom/choose.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
chooser
|
|
ctxmenu
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>Choose</li>
|
|
<li>Choose.ALL_CHANGED</li>
|
|
<li>Choose.CH_CAN_DEL</li>
|
|
<li>Choose.CH_CAN_EDIT</li>
|
|
<li>Choose.CH_CAN_INS</li>
|
|
<li>Choose.CH_CAN_REFRESH</li>
|
|
<li>Choose.CH_RESTORE</li>
|
|
<li>Choose.NOTHING_CHANGED</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.is_chooser_widget</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.unregister_action</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#choose_multi">choose_multi</a></li>
|
|
<li><a class="ex_link" href="#chooser_with_folders">chooser_with_folders</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="choose_multi">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/tabular_views/custom/choose_multi.py">choose_multi</a>: <i>A widget showing data in a tabular fashion, providing multiple selection</i>
|
|
</div>
|
|
<div class="details" id="DIV_choose_multi">
|
|
|
|
<pre>
|
|
Similar to <a class="ex_link" href="#choose">choose</a>, but with multiple selection
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: A widget showing data in a tabular fashion, providing multiple selection</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/tabular_views/custom/choose_multi.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
chooser
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>Choose</li>
|
|
<li>Choose.ALL_CHANGED</li>
|
|
<li>Choose.CHCOL_HEX</li>
|
|
<li>Choose.CH_MULTI</li>
|
|
<li>Choose.NOTHING_CHANGED</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#choose">choose</a></li>
|
|
<li><a class="ex_link" href="#chooser_with_folders">chooser_with_folders</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="chooser_with_folders">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/tabular_views/custom/chooser_with_folders.py">chooser_with_folders</a>: <i>A widget that can show tabular data either as a simple table, or with a tree-like structure.</i>
|
|
</div>
|
|
<div class="details" id="DIV_chooser_with_folders">
|
|
|
|
<pre>
|
|
By adding the necessary bits to a ida_kernwin.Choose subclass,
|
|
IDA can show the otherwise tabular data, in a tree-like fashion.
|
|
|
|
The important bits to enable this are:
|
|
|
|
* ida_dirtree.dirspec_t (and my_dirspec_t)
|
|
* ida_kernwin.CH_HAS_DIRTREE
|
|
* ida_kernwin.Choose.OnGetDirTree
|
|
* ida_kernwin.Choose.OnIndexToInode
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: A widget that can show tabular data either as a simple table, or with a tree-like structure.</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/tabular_views/custom/chooser_with_folders.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
chooser
|
|
folders
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_dirtree.DTE_OK</li>
|
|
<li>ida_dirtree.direntry_t</li>
|
|
<li>ida_dirtree.direntry_t.BADIDX</li>
|
|
<li>ida_dirtree.dirspec_t</li>
|
|
<li>ida_dirtree.dirtree_t</li>
|
|
<li>ida_dirtree.dirtree_t.isdir</li>
|
|
<li>ida_kernwin.CH_CAN_DEL</li>
|
|
<li>ida_kernwin.CH_CAN_EDIT</li>
|
|
<li>ida_kernwin.CH_CAN_INS</li>
|
|
<li>ida_kernwin.CH_HAS_DIRTREE</li>
|
|
<li>ida_kernwin.CH_MULTI</li>
|
|
<li>ida_kernwin.CH_NOIDB</li>
|
|
<li>ida_kernwin.Choose</li>
|
|
<li>ida_kernwin.Choose.ALL_CHANGED</li>
|
|
<li>ida_kernwin.Choose.CHCOL_DRAGHINT</li>
|
|
<li>ida_kernwin.Choose.CHCOL_INODENAME</li>
|
|
<li>ida_kernwin.Choose.CHCOL_PLAIN</li>
|
|
<li>ida_kernwin.ask_str</li>
|
|
<li>ida_netnode.BADNODE</li>
|
|
<li>ida_netnode.netnode</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#choose">choose</a></li>
|
|
<li><a class="ex_link" href="#choose_multi">choose_multi</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="custom_graph_with_actions">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/graphs/custom_graph_with_actions.py">custom_graph_with_actions</a>: <i>Drawing custom graphs</i>
|
|
</div>
|
|
<div class="details" id="DIV_custom_graph_with_actions">
|
|
|
|
<pre>
|
|
Showing custom graphs, using `ida_graph.GraphViewer`. In addition,
|
|
show how to write actions that can be performed on those.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Drawing custom graphs</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/graphs/custom_graph_with_actions.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
graph
|
|
View_Hooks
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func</li>
|
|
<li>ida_funcs.get_func_name</li>
|
|
<li>ida_graph.GraphViewer</li>
|
|
<li>ida_graph.get_graph_viewer</li>
|
|
<li>ida_graph.screen_graph_selection_t</li>
|
|
<li>ida_graph.viewer_get_selection</li>
|
|
<li>ida_idp.is_call_insn</li>
|
|
<li>ida_kernwin.AST_ENABLE_ALWAYS</li>
|
|
<li>ida_kernwin.View_Hooks</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_dynamic_action_to_popup</li>
|
|
<li>ida_kernwin.get_screen_ea</li>
|
|
<li>ida_ua.decode_insn</li>
|
|
<li>ida_ua.insn_t</li>
|
|
<li>ida_xref.XREF_FAR</li>
|
|
<li>ida_xref.xrefblk_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="custom_viewer">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/listings/custom_viewer.py">custom_viewer</a>: <i>Create custom listings in IDA</i>
|
|
</div>
|
|
<div class="details" id="DIV_custom_viewer">
|
|
|
|
<pre>
|
|
How to create simple listings, that will share many of the features
|
|
as the built-in IDA widgets (highlighting, copy & paste,
|
|
notifications, ...)
|
|
|
|
In addition, creates actions that will be bound to the
|
|
freshly-created widget (using `ida_kernwin.attach_action_to_popup`.)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Create custom listings in IDA</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/listings/custom_viewer.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
ctxmenu
|
|
listing
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.AST_ENABLE_ALWAYS</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.ask_long</li>
|
|
<li>ida_kernwin.ask_str</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.simplecustviewer_t</li>
|
|
<li>ida_kernwin.simplecustviewer_t.Create</li>
|
|
<li>ida_kernwin.simplecustviewer_t.Show</li>
|
|
<li>ida_kernwin.unregister_action</li>
|
|
<li>ida_lines.COLOR_DEFAULT</li>
|
|
<li>ida_lines.COLOR_DNAME</li>
|
|
<li>ida_lines.COLSTR</li>
|
|
<li>ida_lines.SCOLOR_PREFIX</li>
|
|
<li>ida_lines.SCOLOR_VOIDOP</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="func_chooser">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/tabular_views/custom/func_chooser.py">func_chooser</a>: <i>An alternative view over the list of functions</i>
|
|
</div>
|
|
<div class="details" id="DIV_func_chooser">
|
|
|
|
<pre>
|
|
Partially re-implements the "Functions" widget present in
|
|
IDA, with a custom widget.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: An alternative view over the list of functions</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/tabular_views/custom/func_chooser.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
chooser
|
|
functions
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_funcs.get_func_name</li>
|
|
<li>ida_kernwin.Choose</li>
|
|
<li>ida_kernwin.Choose.ALL_CHANGED</li>
|
|
<li>ida_kernwin.Choose.CHCOL_FNAME</li>
|
|
<li>ida_kernwin.Choose.CHCOL_HEX</li>
|
|
<li>ida_kernwin.Choose.CHCOL_PLAIN</li>
|
|
<li>idautils.Functions</li>
|
|
<li>idc.del_func</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#choose">choose</a></li>
|
|
<li><a class="ex_link" href="#choose_multi">choose_multi</a></li>
|
|
<li><a class="ex_link" href="#chooser_with_folders">chooser_with_folders</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="jump_next_comment">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/listings/jump_next_comment.py">jump_next_comment</a>: <i>Implement a "jump to next comment" action within IDA's disassembly view.</i>
|
|
</div>
|
|
<div class="details" id="DIV_jump_next_comment">
|
|
|
|
<pre>
|
|
We want our action not only to find the next line containing a comment,
|
|
but to also place the cursor at the right horizontal position.
|
|
|
|
To find that position, we will have to inspect the text that IDA
|
|
generates, looking for the start of a comment.
|
|
However, we won't be looking for a comment "prefix" (e.g., "; "),
|
|
as that would be too fragile.
|
|
|
|
Instead, we will look for special "tags" that IDA injects into textual
|
|
lines, and that bear semantic information.
|
|
|
|
Those tags are primarily used for rendering (i.e., switching colors),
|
|
but can also be very handy for spotting tokens of interest (registers,
|
|
addresses, comments, prefixes, instruction mnemonics, ...)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Implement a "jump to next comment" action within IDA's disassembly view.</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/listings/jump_next_comment.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
idaview
|
|
</li>
|
|
|
|
<li>Shortcut:
|
|
Ctrl+Alt+C
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.next_head</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_DISASM</li>
|
|
<li>ida_kernwin.CVNF_LAZY</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.custom_viewer_jump</li>
|
|
<li>ida_kernwin.get_custom_viewer_location</li>
|
|
<li>ida_kernwin.place_t_as_idaplace_t</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.unregister_action</li>
|
|
<li>ida_lines.SCOLOR_AUTOCMT</li>
|
|
<li>ida_lines.SCOLOR_ON</li>
|
|
<li>ida_lines.SCOLOR_REGCMT</li>
|
|
<li>ida_lines.SCOLOR_RPTCMT</li>
|
|
<li>ida_lines.generate_disassembly</li>
|
|
<li>ida_lines.tag_strlen</li>
|
|
<li>ida_moves.lochist_entry_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#save_and_restore_listing_pos">save_and_restore_listing_pos</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="lazy_loaded_chooser">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/tabular_views/custom/lazy_loaded_chooser.py">lazy_loaded_chooser</a>: <i></i>
|
|
</div>
|
|
<div class="details" id="DIV_lazy_loaded_chooser">
|
|
|
|
<pre>
|
|
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: </li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/tabular_views/custom/lazy_loaded_chooser.py">GitHub</a></li>
|
|
|
|
|
|
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="save_and_restore_listing_pos">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/listings/save_and_restore_listing_pos.py">save_and_restore_listing_pos</a>: <i>Save, and then restore, positions in a listing</i>
|
|
</div>
|
|
<div class="details" id="DIV_save_and_restore_listing_pos">
|
|
|
|
<pre>
|
|
Shows how it is possible re-implement IDA's bookmark capability,
|
|
using 2 custom actions: one action saves the current location,
|
|
and the other restores it.
|
|
|
|
Note that, contrary to actual bookmarks, this example:
|
|
|
|
* remembers only 1 saved position
|
|
* doesn't save that position in the IDB (and therefore cannot
|
|
be restored if IDA is closed & reopened.)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Save, and then restore, positions in a listing</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/listings/save_and_restore_listing_pos.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
listing
|
|
</li>
|
|
|
|
<li>Shortcuts:
|
|
Ctrl+Shift+O
|
|
Ctrl+Shift+S
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_CUSTVIEW</li>
|
|
<li>ida_kernwin.BWN_DISASM</li>
|
|
<li>ida_kernwin.BWN_ENUMS</li>
|
|
<li>ida_kernwin.BWN_PSEUDOCODE</li>
|
|
<li>ida_kernwin.BWN_STRUCTS</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.custom_viewer_jump</li>
|
|
<li>ida_kernwin.find_widget</li>
|
|
<li>ida_kernwin.get_custom_viewer_location</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.unregister_action</li>
|
|
<li>ida_moves.lochist_entry_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#jump_next_comment">jump_next_comment</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="show_and_hide_waitbox">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/waitbox/show_and_hide_waitbox.py">show_and_hide_waitbox</a>: <i>Showing, updating & hiding the progress dialog</i>
|
|
</div>
|
|
<div class="details" id="DIV_show_and_hide_waitbox">
|
|
|
|
<pre>
|
|
Using the progress dialog (aka 'wait box') primitives.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Showing, updating & hiding the progress dialog</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/waitbox/show_and_hide_waitbox.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_hexrays.decompile</li>
|
|
<li>ida_kernwin.hide_wait_box</li>
|
|
<li>ida_kernwin.replace_wait_box</li>
|
|
<li>ida_kernwin.show_wait_box</li>
|
|
<li>ida_kernwin.user_cancelled</li>
|
|
<li>idautils.Functions</li>
|
|
</ul>
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="show_selected_strings">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/tabular_views/string_window/show_selected_strings.py">show_selected_strings</a>: <i>Retrieve the strings that are selected in the "Strings" window.</i>
|
|
</div>
|
|
<div class="details" id="DIV_show_selected_strings">
|
|
|
|
<pre>
|
|
In IDA it's possible to write actions that can be applied even to
|
|
core (i.e., "standard") widgets. The actions in this example use the
|
|
action "context" to know what the current selection is.
|
|
|
|
This example shows how you can either retrieve string literals data
|
|
directly from the chooser (`ida_kernwin.get_chooser_data`), or
|
|
by querying the IDB (`ida_bytes.get_strlit_contents`)
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Retrieve the strings that are selected in the "Strings" window.</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/tabular_views/string_window/show_selected_strings.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
actions
|
|
ctxmenu
|
|
</li>
|
|
|
|
<li>Shortcuts:
|
|
Ctrl+Shift+K
|
|
Ctrl+Shift+S
|
|
</li>
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_bytes.get_strlit_contents</li>
|
|
<li>ida_idaapi.BADADDR</li>
|
|
<li>ida_kernwin.AST_DISABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.AST_ENABLE_FOR_WIDGET</li>
|
|
<li>ida_kernwin.BWN_STRINGS</li>
|
|
<li>ida_kernwin.action_desc_t</li>
|
|
<li>ida_kernwin.action_handler_t</li>
|
|
<li>ida_kernwin.attach_action_to_popup</li>
|
|
<li>ida_kernwin.find_widget</li>
|
|
<li>ida_kernwin.get_chooser_data</li>
|
|
<li>ida_kernwin.open_strings_window</li>
|
|
<li>ida_kernwin.register_action</li>
|
|
<li>ida_kernwin.unregister_action</li>
|
|
<li>ida_strlist.get_strlist_item</li>
|
|
<li>ida_strlist.string_info_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#list_strings">list_strings</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="sync_two_graphs">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/graphs/sync_two_graphs.py">sync_two_graphs</a>: <i>Follow the movements of a disassembly graph, in another.</i>
|
|
</div>
|
|
<div class="details" id="DIV_sync_two_graphs">
|
|
|
|
<pre>
|
|
Since it is possible to be notified of movements that happen
|
|
take place in a widget, it's possible to "replay" those
|
|
movements in another.
|
|
|
|
In this case, "IDA View-B" (will be opened if necessary) will
|
|
show the same contents as "IDA View-A", slightly zoomed out.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Follow the movements of a disassembly graph, in another.</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/graphs/sync_two_graphs.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
graph
|
|
idaview
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_graph.GLICTL_CENTER</li>
|
|
<li>ida_graph.viewer_fit_window</li>
|
|
<li>ida_graph.viewer_get_gli</li>
|
|
<li>ida_graph.viewer_set_gli</li>
|
|
<li>ida_kernwin.DP_RIGHT</li>
|
|
<li>ida_kernwin.IDAViewWrapper</li>
|
|
<li>ida_kernwin.MFF_FAST</li>
|
|
<li>ida_kernwin.TCCRT_GRAPH</li>
|
|
<li>ida_kernwin.execute_sync</li>
|
|
<li>ida_kernwin.find_widget</li>
|
|
<li>ida_kernwin.get_custom_viewer_place</li>
|
|
<li>ida_kernwin.jumpto</li>
|
|
<li>ida_kernwin.open_disasm_window</li>
|
|
<li>ida_kernwin.set_dock_pos</li>
|
|
<li>ida_kernwin.set_view_renderer_type</li>
|
|
<li>ida_moves.graph_location_info_t</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#wrap_idaview">wrap_idaview</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
<div class="example-entry collapsed-entry" name="wrap_idaview">
|
|
<div>
|
|
<span class="exp-col expander">▹</span>
|
|
<span class="exp-col collapser" style="display:none">▿</span>
|
|
<a href="widgets/idaview/wrap_idaview.py">wrap_idaview</a>: <i>Manipulate IDAView and graph</i>
|
|
</div>
|
|
<div class="details" id="DIV_wrap_idaview">
|
|
|
|
<pre>
|
|
This is an example illustrating how to manipulate an existing IDA-provided
|
|
view (and thus possibly its graph), in Python.
|
|
</pre>
|
|
|
|
<ul>
|
|
<li>Category: widgets</li>
|
|
<li>Summary: Manipulate IDAView and graph</li>
|
|
<li>View on <a href="https://github.com/idapython/src/blob/master/examples/widgets/idaview/wrap_idaview.py">GitHub</a></li>
|
|
<li>Keywords:
|
|
graph
|
|
idaview
|
|
</li>
|
|
|
|
|
|
|
|
<li>APIs used
|
|
<ul>
|
|
<li>ida_graph.NIF_BG_COLOR</li>
|
|
<li>ida_graph.NIF_FRAME_COLOR</li>
|
|
<li>ida_graph.node_info_t</li>
|
|
<li>ida_kernwin.IDAViewWrapper</li>
|
|
<li>ida_kernwin.MFF_FAST</li>
|
|
<li>ida_kernwin.TCCRT_FLAT</li>
|
|
<li>ida_kernwin.TCCRT_GRAPH</li>
|
|
<li>ida_kernwin.execute_sync</li>
|
|
</ul>
|
|
</li>
|
|
|
|
<li>See also:
|
|
<ul>
|
|
<li><a class="ex_link" href="#custom_graph_with_actions">custom_graph_with_actions</a></li>
|
|
<li><a class="ex_link" href="#sync_two_graphs">sync_two_graphs</a></li>
|
|
</ul>
|
|
</li>
|
|
|
|
</ul>
|
|
</div>
|
|
</div>
|
|
|
|
</div>
|
|
</body>
|
|
</html>
|