Install ipyida
The installation of ipyida can be referenced at: How to install plugins in IDA - lca
How to use ipython
After installation, select the ipyida plugin from the "Edit-Plugins" menu, and the interface will appear as follows:
Press "?" to display the help information, press "esc" to exit the help information interface, and press the tab key to automatically complete the command. For example, typing "imp" and pressing tab will complete "import". After importing, typing a space and pressing tab will list the modules that need to be imported.
After importing the module, you can use "?" after the module to display module information.
idaapi?
idaapi?? # Display more detailed information
Type "%hist" to list the command history, and "%history -n" to display the command history and line numbers.
"%edit" opens the text editor, and "%edit x-y" opens the text editor and writes the commands within the specified range.
Basic usage of IDA Python
IDA Python consists of the following three independent modules:
- idc
- idaapi
- idautils
IDA Python is case-sensitive and uses camel case naming convention.
idc.here()
Get the current instruction address
idc.GetDisasm()
Get the current assembly instruction
idc.SegName()
Get the current segment
idc.MinEA&idc.MaxEx
Get the lowest and highest addresses of the program
ea = idc.here()
next_str = idc.NextHead(ea)
pre_instr = idc.prev_head(ea)
Get the address of the previous (next) assembly instruction
SceenEA
Represents the position of the current cursor in the disassembly view
Need to import the module import idaapi
If the ScreenEa function is used, an error will occur. This may be related to the Python version. The following is an error in Python 3.
To run the script command, first create a script (under the Python 3 environment)
Then use "File-Run File" to load and run the script. The running result is as follows:
The command idc.GetDisasm(start_ea) outputs the instruction at the current cursor position (under the Python 3 environment)
If the cursor is moved to another position, ea will re-find the position and value of the cursor.
The first or second operand of the instruction can be output using the idc.GetOpnd() function.
Get the function name at the current cursor position
import idc
import idaapi
ea = idc.ScreenEA()
func = idaapi.get_func(ea)
funcname = idc.GetFunctionName(func.startEA)
print funcname
Get the current function name
import idc
import idautils
ea = idc.ScreenEA()
start = idc.SegStart(ea)
end = idc.SegEnd(ea)
for funcea in idautils.Functions(start,end):
name = idc.GetFunctionName(funcea)
print name
Get all function names in the block
E = list(idautils.FuncItems(ea))
for e in E:
print "%X"%e,idc.GetDisasm(e)
Output all instructions of the function
Compare with the instructions in the disassembly view
Move the cursor to WndProc to view the references
Move the cursor to the "CARTEL_BUENO" function and press the X key to display that the "wndproc" function calls the "CARTEL_BUENO" function.
Use the coderefs() function to get the function names that call it.
Get the references of CARTEL_BUENO.
References: