93 lines
2.8 KiB
Markdown
93 lines
2.8 KiB
Markdown
---
|
|
name: scripting-ida-with-idapython
|
|
description: 'Automates IDA Pro analysis with IDAPython by generating scripts that enumerate
|
|
functions, decode strings, rename by signature, and export analysis results, and by documenting
|
|
the headless idat batch invocation. Activates for requests to script IDA Pro, write IDAPython
|
|
automation, or run IDA in batch/headless mode.'
|
|
domain: cybersecurity
|
|
subdomain: reverse-engineering
|
|
tags:
|
|
- reverse-engineering
|
|
- ida-pro
|
|
- idapython
|
|
- automation
|
|
- batch-analysis
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1027
|
|
- T1059
|
|
- T1620
|
|
d3fend:
|
|
- D3-DA
|
|
- D3-SDA
|
|
references:
|
|
- 'Hex-Rays IDAPython API documentation — https://hex-rays.com/products/ida/support/idapython_docs/'
|
|
- 'IDA batch/headless (idat -A -S) usage — https://hex-rays.com/products/ida/'
|
|
---
|
|
|
|
# Scripting IDA Pro With IDAPython
|
|
|
|
## When to Use
|
|
|
|
- You use IDA Pro and want to automate repetitive analysis — enumerate functions, decode strings,
|
|
apply signature-based renames, and export results — via IDAPython.
|
|
- You need a headless `idat` batch invocation to process many samples.
|
|
|
|
**Do not use** IDA's debugger (`-r`) on untrusted samples on your host — these scripts drive
|
|
*static* analysis. Work in an isolated environment.
|
|
|
|
## Prerequisites
|
|
|
|
- IDA Pro with IDAPython, and the samples to analyze.
|
|
|
|
## Safety & Handling
|
|
|
|
- IDA static analysis does not execute the sample; keep the input directory isolated.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Generate an analysis script
|
|
|
|
```bash
|
|
python scripts/analyst.py script --emit functions,strings --out ida_export.py
|
|
```
|
|
|
|
Emits an IDAPython script using the real API (`idautils.Functions`, `idc.get_func_name`,
|
|
`idautils.Strings`) that writes results to JSON next to the IDB.
|
|
|
|
### Step 2: Generate the headless batch command
|
|
|
|
```bash
|
|
python scripts/analyst.py batch --script ida_export.py --input sample.exe
|
|
```
|
|
|
|
Builds the `idat -A -S"script" input` invocation (auto-mode, run script, no UI) for batch runs.
|
|
|
|
### Step 3: Run and collect
|
|
|
|
Execute the batch command per sample and aggregate the JSON exports.
|
|
|
|
### Step 4: Iterate
|
|
|
|
Extend the generated script with signature renames (FLIRT) and decompiler (`ida_hexrays`) output
|
|
as needed.
|
|
|
|
## Validation
|
|
|
|
- The generated script uses real IDAPython API calls.
|
|
- The batch command uses `-A` (auto) and `-S` (script) correctly.
|
|
- JSON output is produced per processed IDB.
|
|
|
|
## Pitfalls
|
|
|
|
- IDAPython API drift between IDA 7.x and 9.x — target your version.
|
|
- Forgetting `-A` leaves IDA waiting for interactive input in batch.
|
|
- Decompiler calls require a licensed Hex-Rays decompiler.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the generator.
|
|
- IDAPython and idat batch references (linked in frontmatter).
|