Idatips

IDAPython >= 7.4

Clear output window

    form = ida_kernwin.find_widget("Output window")
    ida_kernwin.activate_widget(form, True)
    idaapi.process_ui_action("msglist:Clear")

Compute function length

def compute_function_length(ea):
    return idc.get_func_attr(ea, idc.FUNCATTR_END) - ea

C++ Name demangling

func_name = idc.get_func_name(f)
demangled_name = idc.demangle_name(func_name, idc.get_inf_attr(idc.INF_SHORT_DN))

Jump to from QModelIndex

# where 1 is the column with the address
idaapi.jumpto(int(item.sibling(item.row(), 1).data(), 16))

Get all subcalls from a function

def get_function_called(ea):
    funcs = []
    for h in idautils.FuncItems(ea):
        for r in idautils.XrefsFrom(h, 0):
            if r.type == idautils.ida_xref.fl_CF or r.type == idautils.ida_xref.fl_CN:
                funcs.append(r.to)
    return funcs

Search for pattern across whole binary

sequence = "83 F8 01"
found_ea = ida_ida.inf_get_min_ea()-1
end_ea = ida_ida.inf_get_max_ea()
print(f"Looking for pattern in {hex(found_ea+1)}-{hex(end_ea)}")
while True:
    found_ea = idaapi.find_binary(found_ea+1, end_ea, needle, 16, idaapi.SEARCH_DOWN)
    if found_ea == idaapi.BADADDR: break
    print(f"Found at {hex(found_ea)}")

Verify if address is mapped/valid

addr = 0xdeadbeef
if addr >= ida_ida.inf_get_min_ea() and addr <= ida_ida.inf_get_max_ea():
    print("Valid address!")

Start

from ida_dbg import start_process
start_process()

Debugging

Attach to a process

target = "Process.exe"
pis = ida_idd.procinfo_vec_t()
count = ida_dbg.get_processes(pis)
print(f"Found {count}")
for p in pis:
    print(f"{p.pid}: {p.name}")
    if target in p.name:
        print(f"Attaching to process {p.name}")
        ida_dbg.attach_process(p.pid)

Add breakpoint

from ida_dbg import add_bpt
add_bpt(address)

Refresh memory of debugger

from ida_dbg import refresh_debugger_memory
refresh_debugger_memory()

Read memory

from ida_bytes import *
get_byte(ea, size)
get_dword(ea)
get_qword(ea)

Read register

from ida_dbg import get_reg_val
rcx = get_reg_val("rcx")

PyQt5 related

Add QIcon without including a file (base64 encoded)

toolbar = QtWidgets.QToolBar()
saveImg = QtGui.QPixmap()
saveImg.loadFromData(base64.b64decode("BASE64ENCODEDICON))
saveAction = QtWidgets.QAction(QtGui.QIcon(saveImg), "Save", parent)
toolbar.addAction(saveAction)