2011-10-14 16:24:38 +02:00
|
|
|
------------------------------------------------------
|
|
|
|
IDAPython - Python plugin for Interactive Disassembler
|
|
|
|
------------------------------------------------------
|
2010-06-28 14:36:40 +02:00
|
|
|
|
2011-10-14 16:24:38 +02:00
|
|
|
What is IDAPython?
|
2010-06-28 14:36:40 +02:00
|
|
|
------------------
|
|
|
|
|
|
|
|
IDAPython is an IDA plugin which makes it possible to write scripts
|
|
|
|
for IDA in the Python programming language. IDAPython provides full
|
|
|
|
access to both the IDA API and any installed Python module.
|
|
|
|
|
|
|
|
Check the scripts in the examples directory to get an quick glimpse.
|
|
|
|
|
|
|
|
|
2011-10-14 16:24:38 +02:00
|
|
|
Availability
|
2010-06-28 14:36:40 +02:00
|
|
|
------------
|
|
|
|
|
|
|
|
Latest stable versions of IDAPython are available from
|
2010-11-10 14:58:08 +01:00
|
|
|
http://code.google.com/p/idapython/downloads/list
|
2010-06-28 14:36:40 +02:00
|
|
|
|
|
|
|
Development builds are available from
|
|
|
|
http://code.google.com/p/idapython/
|
|
|
|
|
|
|
|
|
2011-10-14 16:24:38 +02:00
|
|
|
Resources
|
2010-06-28 14:36:40 +02:00
|
|
|
---------
|
|
|
|
|
|
|
|
The full function cross-reference is readable online at
|
2010-11-10 14:58:08 +01:00
|
|
|
http://www.hex-rays.com/idapro/idapython_docs/
|
2010-06-28 14:36:40 +02:00
|
|
|
|
|
|
|
Bugs and enhancement requests should be submitted to
|
|
|
|
http://code.google.com/p/idapython/issues/list
|
|
|
|
|
|
|
|
Mailing list for the project is hosted by Google Groups at
|
|
|
|
http://groups.google.com/group/idapython
|
|
|
|
|
|
|
|
|
2011-10-14 16:24:38 +02:00
|
|
|
Installation from binaries
|
2010-06-28 14:36:40 +02:00
|
|
|
--------------------------
|
|
|
|
|
2011-04-18 18:07:00 +02:00
|
|
|
1. Install 2.6 or 2.7 from http://www.python.org/
|
2011-10-14 16:24:38 +02:00
|
|
|
2. Copy the whole "python" directory to %IDADIR%
|
|
|
|
3. Copy the contents of the "plugins" directory to the %IDADIR%\plugins\
|
2011-04-18 18:07:00 +02:00
|
|
|
4. Copy "python.cfg" to %IDADIR%\cfg
|
2010-06-28 14:36:40 +02:00
|
|
|
|
2011-10-14 16:24:38 +02:00
|
|
|
Usage
|
2010-06-28 14:36:40 +02:00
|
|
|
-----
|
|
|
|
|
2010-11-10 14:58:08 +01:00
|
|
|
- Run script: File / Script file (Alt-F7)
|
|
|
|
- Execute Python statement(s) (Ctrl-F3)
|
|
|
|
- Run previously executed script again: View / Recent Scripts (Alt+F9)
|
2010-06-28 14:36:40 +02:00
|
|
|
|
2011-10-14 16:24:38 +02:00
|
|
|
|
|
|
|
* Batch mode execution:
|
2010-06-28 14:36:40 +02:00
|
|
|
|
|
|
|
Start IDA with the following command line options:
|
|
|
|
|
|
|
|
-A -OIDAPython:yourscript.py file_to_work_on
|
2010-11-10 14:58:08 +01:00
|
|
|
or
|
|
|
|
-Syourscript.py
|
|
|
|
or
|
|
|
|
-S"yourscript.py arg1 arg2 arg3"
|
|
|
|
|
|
|
|
(Please see http://www.hexblog.com/?p=128)
|
2010-06-28 14:36:40 +02:00
|
|
|
|
|
|
|
If you want fully unattended execution mode, make sure your script
|
|
|
|
exits with a qexit() call.
|
|
|
|
|
|
|
|
By default scripts run after the database is opened. Extended option
|
|
|
|
format is:
|
|
|
|
|
|
|
|
-OIDAPython:[N;]script.py
|
|
|
|
|
|
|
|
Where N can be:
|
|
|
|
0: run script after opening database (default)
|
|
|
|
1: run script when UI is ready
|
|
|
|
2: run script immediately on plugin load (shortly after IDA starts and before processor modules and loaders)
|
|
|
|
|
2011-10-14 16:24:38 +02:00
|
|
|
* User init file
|
2010-06-28 14:36:40 +02:00
|
|
|
|
|
|
|
You can place your custom settings to a file called 'idapythonrc.py'
|
2010-11-10 14:58:08 +01:00
|
|
|
that should be placed to
|
2010-06-28 14:36:40 +02:00
|
|
|
|
|
|
|
${HOME}/.idapro/
|
|
|
|
|
2010-11-10 14:58:08 +01:00
|
|
|
or
|
2010-06-28 14:36:40 +02:00
|
|
|
|
|
|
|
%AppData%\Hex-Rays\IDA Pro
|
|
|
|
|
|
|
|
The user init file is read and executed at the end of the init process.
|
|
|
|
|
2011-04-18 18:07:00 +02:00
|
|
|
Please note that IDAPython can be configured with "python.cfg" file.
|
2011-10-14 16:24:38 +02:00
|
|
|
|
|
|
|
* Invoking Python from IDC
|
|
|
|
|
|
|
|
The IDAPython plugin exposes a new IDC function "RunPythonStatement(string idc_code)" that allows execution
|
|
|
|
of Python code from IDC
|
|
|
|
|
|
|
|
* Invoking IDC from Python
|
|
|
|
|
|
|
|
It is possible to use the idc.Eval() to evaluate IDC expressions from Python
|
|
|
|
|
|
|
|
* Making Python the default language
|
|
|
|
|
|
|
|
By default, IDA will use IDC to evaluate expressions. It is possible to change the default language to use
|
|
|
|
Python instead of IDC.
|
|
|
|
|
|
|
|
In order to do that, please use the following IDC code:
|
|
|
|
|
|
|
|
RunPlugin("python", 3)
|
|
|
|
|
|
|
|
To disable Python language and revert back to IDC:
|
|
|
|
RunPlugin("python", 4)
|
|
|
|
|