Table of Contents for
The IDA Pro Book, 2nd Edition

Version ebook / Retour

Cover image for bash Cookbook, 2nd Edition The IDA Pro Book, 2nd Edition by Chris Eagle Published by No Starch Press, 2011
  1. Cover
  2. The IDA Pro Book
  3. PRAISE FOR THE FIRST EDITION OF THE IDA PRO BOOK
  4. Acknowledgments
  5. Introduction
  6. I. Introduction to IDA
  7. 1. Introduction to Disassembly
  8. The What of Disassembly
  9. The Why of Disassembly
  10. The How of Disassembly
  11. Summary
  12. 2. Reversing and Disassembly Tools
  13. Summary Tools
  14. Deep Inspection Tools
  15. Summary
  16. 3. IDA Pro Background
  17. Obtaining IDA Pro
  18. IDA Support Resources
  19. Your IDA Installation
  20. Thoughts on IDA’s User Interface
  21. Summary
  22. II. Basic IDA Usage
  23. 4. Getting Started with IDA
  24. IDA Database Files
  25. Introduction to the IDA Desktop
  26. Desktop Behavior During Initial Analysis
  27. IDA Desktop Tips and Tricks
  28. Reporting Bugs
  29. Summary
  30. 5. IDA Data Displays
  31. Secondary IDA Displays
  32. Tertiary IDA Displays
  33. Summary
  34. 6. Disassembly Navigation
  35. Stack Frames
  36. Searching the Database
  37. Summary
  38. 7. Disassembly Manipulation
  39. Commenting in IDA
  40. Basic Code Transformations
  41. Basic Data Transformations
  42. Summary
  43. 8. Datatypes and Data Structures
  44. Creating IDA Structures
  45. Using Structure Templates
  46. Importing New Structures
  47. Using Standard Structures
  48. IDA TIL Files
  49. C++ Reversing Primer
  50. Summary
  51. 9. Cross-References and Graphing
  52. IDA Graphing
  53. Summary
  54. 10. The Many Faces of IDA
  55. Using IDA’s Batch Mode
  56. Summary
  57. III. Advanced IDA Usage
  58. 11. Customizing IDA
  59. Additional IDA Configuration Options
  60. Summary
  61. 12. Library Recognition Using FLIRT Signatures
  62. Applying FLIRT Signatures
  63. Creating FLIRT Signature Files
  64. Summary
  65. 13. Extending IDA’s Knowledge
  66. Augmenting Predefined Comments with loadint
  67. Summary
  68. 14. Patching Binaries and Other IDA Limitations
  69. IDA Output Files and Patch Generation
  70. Summary
  71. IV. Extending IDA’s Capabilities
  72. 15. IDA Scripting
  73. The IDC Language
  74. Associating IDC Scripts with Hotkeys
  75. Useful IDC Functions
  76. IDC Scripting Examples
  77. IDAPython
  78. IDAPython Scripting Examples
  79. Summary
  80. 16. The IDA Software Development Kit
  81. The IDA Application Programming Interface
  82. Summary
  83. 17. The IDA Plug-in Architecture
  84. Building Your Plug-ins
  85. Installing Plug-ins
  86. Configuring Plug-ins
  87. Extending IDC
  88. Plug-in User Interface Options
  89. Scripted Plug-ins
  90. Summary
  91. 18. Binary Files and IDA Loader Modules
  92. Manually Loading a Windows PE File
  93. IDA Loader Modules
  94. Writing an IDA Loader Using the SDK
  95. Alternative Loader Strategies
  96. Writing a Scripted Loader
  97. Summary
  98. 19. IDA Processor Modules
  99. The Python Interpreter
  100. Writing a Processor Module Using the SDK
  101. Building Processor Modules
  102. Customizing Existing Processors
  103. Processor Module Architecture
  104. Scripting a Processor Module
  105. Summary
  106. V. Real-World Applications
  107. 20. Compiler Personalities
  108. RTTI Implementations
  109. Locating main
  110. Debug vs. Release Binaries
  111. Alternative Calling Conventions
  112. Summary
  113. 21. Obfuscated Code Analysis
  114. Anti–Dynamic Analysis Techniques
  115. Static De-obfuscation of Binaries Using IDA
  116. Virtual Machine-Based Obfuscation
  117. Summary
  118. 22. Vulnerability Analysis
  119. After-the-Fact Vulnerability Discovery with IDA
  120. IDA and the Exploit-Development Process
  121. Analyzing Shellcode
  122. Summary
  123. 23. Real-World IDA Plug-ins
  124. IDAPython
  125. collabREate
  126. ida-x86emu
  127. Class Informer
  128. MyNav
  129. IdaPdf
  130. Summary
  131. VI. The IDA Debugger
  132. 24. The IDA Debugger
  133. Basic Debugger Displays
  134. Process Control
  135. Automating Debugger Tasks
  136. Summary
  137. 25. Disassembler/Debugger Integration
  138. IDA Databases and the IDA Debugger
  139. Debugging Obfuscated Code
  140. IdaStealth
  141. Dealing with Exceptions
  142. Summary
  143. 26. Additional Debugger Features
  144. Debugging with Bochs
  145. Appcall
  146. Summary
  147. A. Using IDA Freeware 5.0
  148. Using IDA Freeware
  149. B. IDC/SDK Cross-Reference
  150. Index
  151. About the Author

Chapter 15. IDA Scripting

image with no caption

It is a simple fact that no application can meet every need of every user. It is just not possible to anticipate every potential use case that may arise. Application developers are faced with the choice of responding to an endless stream of feature requests or offering users a means to solve their own problems. IDA takes the latter approach by integrating scripting features that allow users to exercise a tremendous amount of programmatic control over IDA’s actions.

Potential uses for scripts are infinite and can range from simple one-liners to full-blown programs that automate common tasks or perform complex analysis functions. From an automation standpoint, IDA scripts can be viewed as macros,[95] while from an analysis point of view, IDA’s scripting languages serve as the query languages that provide programmatic access to the contents of an IDA database. IDA supports scripting using two different languages. IDA’s original, embedded scripting language is named IDC, perhaps because its syntax bears a close resemblance to C. Since the release of IDA 5.4,[96] integrated scripting with Python has also been supported through the integration of the IDAPython plug-in by Gergely Erdelyi.[97] For the remainder of this chapter we will cover the basics of writing and executing both IDC and Python scripts as well as some of the more useful functions available to script authors.

Basic Script Execution

Before diving into the details of either scripting language, it is useful to understand the most common ways that scripts can be executed. Three menu options, File ▸ Script File, File ▸ IDC Command, and File ▸ Python Command[98] are available to access IDA’s scripting engine. Selecting File ▸ Script File indicates that you wish to run a standalone script, at which point you are presented with a file-selection dialog that lets you choose the script to run. Each time you run a new script, the program is added to a list of recent scripts to provide easy access to edit or rerun the script. Figure 15-1 shows the Recent Scripts window accessible via the View ▸ Recent Scripts menu option.

The Recent Scripts window

Figure 15-1. The Recent Scripts window

Double-clicking a listed script causes the script to be executed. A pop-up, context-sensitive menu offers options to remove a script from the list or to open a script for editing using the editor specified under Options ▸ General on the Misc tab.

As an alternative to executing a standalone script file, you may elect to open a script entry dialog using File ▸ IDC Command or File ▸ Python Command. Figure 15-2 shows the resulting script entry dialog (for an IDC script in this case), which is useful in situations where you wish to execute only a few statements but don’t want to go to the trouble of creating a standalone script file.

The script entry dialog

Figure 15-2. The script entry dialog

Some restrictions apply to the types of statements that you can enter in the script dialog, but the dialog is very useful in cases where creating a full-blown script file is overkill.

The last way to easily execute script commands is to use IDA’s command line. The command line is available only in GUI versions of IDA, and its presence is controlled by the value of the DISPLAY_COMMAND_LINE option in <IDADIR>/cfg/idagui.cfg. The command line has been enabled by default since IDA 5.4. Figure 15-3 shows the command line as it appears in the lower-left corner of the IDA workspace, beneath the output window.

The IDA command line

Figure 15-3. The IDA command line

The interpreter that will be used to execute the command line is labeled to the left of the command-line entry box. In Figure 15-3, the command line is configured to execute IDC statements. Clicking this label opens the pop-up menu shown in Figure 15-3, allowing either interpreter (IDC or Python) to be associated with the command line.

Although the command line contains only a single line of text, you can enter multiple statements by separating each statement with a semicolon. As a convenience, the history of recent commands is accessible with the up arrow key. If you find yourself frequently needing to execute very short scripts, you will find the command line very useful.

With a basic ability to execute scripts under our belts, it is time to focus on the specifics of IDA’s two available scripting languages, IDC and Python. We begin with a description of IDA’s native scripting language, IDC, and conclude with a discussion of IDA’s Python integration, which will rely heavily on the foundation built by the IDC sections that follow.


[95] Many applications offer facilities that allow users to record sequences of actions into a single complex action called a macro. Replaying or triggering a macro causes the entire sequence of recorded steps to be executed. Macros provided an easy means to automate a complex series of actions.

[96] For a comprehensive list of features introduced with each new version of IDA, visit http://www.hex-rays.com/idapro/idanew48.htm.

[97] See http://code.google.com/p/idapython/

[98] This option is only available if Python is properly installed. Refer to Chapter 3 for details.