IDAPython and IDALib script reference for reverse engineering. Activate when the user needs to write IDAPython scripts in IDA, use IDALib for headless analysis, operate on IDB databases, debug with IDA, manipulate memory/registers, traverse functions/blocks/instructions, work with Hex-Rays decompile

rev idapython IDAPython / IDALib Script Reference IDAPython script snippets for IDA interactive use and IDALib headless analysis. Use as reference when generating IDAPython code. IDAPython : scripts run inside IDA GUI (Script Command, plugin, or IDC console) IDALib : headless mode introduced in IDA 9.0 — run analysis scripts without opening the IDA GUI Common API Register Operations Debug Memory Operations Local Memory Operations (modifies IDB database) Disassembly Address Conversion Function Operations Code Snippets Byte Pattern Search Appcall Call Debuggee Functions Cross References Basic Block Traversal Debug Memory Read/Write Read std::string (64 bit) Read C String (64 bit) Parse GNU C++ std::map Read XMM Register (Debug) Step Over and Wait for Debug Event Iterate Instructions in a Function Get Function Callees (Instruction Based) Double / Complex Number Memory Operations Import Table Enumerate Import Table Check if Address is an Import Function Enumerate Import Addresses Type Information Struct Member Traversal Enumerate All Types List All Struct Types Hex Rays Decompiler API Decompile a Function Print Microcode at Different Maturity Levels Custom Instruction to User Defined Call Hexrays Hooks Obfuscation Helpers OLLVM Set Breakpoints on Real Blocks Set breakpoints on all real block entry addresses. Real blocks are identified by finding predecessors of the OLLVM dispatcher merge point. Note: identifying real blocks by xrefs to the merge point is a heuristic and may not be fully accurate. Use IDA breakpoint groups for batch management. Batch Add Breakpoints Firmware Helpers Search x86 Function Prologues and Create Functions Basic Block Utilities Get Basic Block Size Get Basic Block by Address Instruction Utilities Search Next Instruction by Keyword Undefine a Range (U key equivalent) Search Disassembly Text NOP Function IDALib (Headless IDA, IDA 9.0+) IDALib allows running IDAPython analysis scripts without opening the IDA GUI. Installation Basic Usage Batch Decompile to JSON decompile.py: Multiprocess Batch Decompile

rev-idapython