Install ipyida
Installation reference for ipyida: How to Install Plugins in IDA - lca
How to use ipython
After installation, select the ipyida plugin from the "Edit-Plugins" menu, and the interface will open as follows:
Press "?" to display the help information. Press "esc" to exit the help information interface. Press the tab key to automatically complete the command. For example, if you enter "imp" and press tab, it will complete "import". After "import", enter a space and press tab to list the modules to be imported.
After importing the module, you can append "?" after the module to display the module information.
idaapi?
idaapi?? # Display more detailed information
Enter "%hist" to list the command history, and "%history -n" to display the command history and line numbers.
"%edit" opens the text editor, and "%edit x-y" opens the text editor and writes the commands within the specified range.
Basic usage of IDA Python
IDA Python consists of the following three independent modules:
- idc
- idaapi
- idautils
IDA Python is case-sensitive and uses camel case naming convention.
idc.here()
Get the current instruction address
idc.GetDisasm()
Get the current assembly instruction
idc.SegName()
Get the current segment
idc.MinEA&idc.MaxEx
Get the lowest and highest addresses of the program
ea = idc.here()
next_str = idc.NextHead(ea)
pre_instr = idc.prev_head(ea)
Get the address of the previous (next) assembly instruction
SceenEA
Represents the position of the current cursor in the disassembly view
Need to import the module import idaapi
If you use the ScreenEa function, an error will occur. This may be related to the Python version. The following is an error in Python 3.
To run the script command, first create a script (under the Python 3 environment)
Then use "File-Run File" to load and run the script. The running result is as follows:
The command idc.GetDisasm(start_ea) outputs the instruction at the current cursor position (under the Python 3 environment)
If you move the cursor to another position, ea will re-find the position and value of the cursor.
The first or second operand of the instruction can be output using the idc.GetOpnd() function.
Get the function name at the current cursor position
import idc
import idaapi
ea = idc.ScreenEA()
func = idaapi.get_func(ea)
funcname = idc.GetFunctionName(func.startEA)
print funcname
Get the current function name
import idc
import idautils
ea = idc.ScreenEA()
start = idc.SegStart(ea)
end = idc.SegEnd(ea)
for funcea in idautils.Functions(start,end):
name = idc.GetFunctionName(funcea)
print name
Get all function names in the block
E = list(idautils.FuncItems(ea))
for e in E:
print "%X"%e,idc.GetDisasm(e)
Output all instructions of the function
Compare with the instructions in the disassembly view
Move the cursor to WndProc to view the references
Move the cursor to the "CARTEL_BUENO" function and press the X key to display that the "wndproc" function calls the "CARTEL_BUENO" function.
Use the coderefs() function to get the function names that call it.
Get references to CARTEL_BUENO.
References: