Note
This repository is no longer maintained. Please refer to the IDA SDK official repository for up-to-date examples and the latest version of IDAPython.
IDAPython is an IDA plugin which makes it possible to write scripts for IDA in the Python programming language. IDAPython provides full access to both the IDA API and any installed Python module.
Check the scripts in the examples directory to get an quick glimpse.
Latest stable versions of IDAPython are available from https://github.com/idapython/src
The full function cross-reference is readable online at https://www.hex-rays.com/products/ida/support/idapython_docs/
Mailing list for the project is hosted by Google Groups at https://groups.google.com/g/idapython
- Install latest Python 3.x version from https://www.python.org/
- Copy the whole "python" directory to
%IDADIR% - Copy "idapython.cfg" to
%IDADIR%\cfg
- Run script: File / Script file (
Alt+F7) - Execute Python statement(s) (
Shift+F2) - Run previously executed script again: View / Recent Scripts (
Alt+F9)
Start IDA with the following command line options:
-A -OIDAPython:yourscript.py file_to_work_on
or
-Syourscript.py
or
-S"yourscript.py arg1 arg2 arg3"
(Please see https://hex-rays.com/blog/running-scripts-from-the-command-line-with-idascript/)
If you want fully unattended execution mode, make sure your script
exits with a qexit() call.
By default scripts run after the database is opened. Extended option format is:
-OIDAPython:[N;]script.py
Where N can be: 0: run script after opening database (default) 1: run script when UI is ready 2: run script immediately on plugin load (shortly after IDA starts and before processor modules and loaders)
You can place your custom settings to a file called idapythonrc.py
that should be placed to
${HOME}/.idapro/or
%AppData%\Hex-Rays\IDA ProThe user init file is read and executed at the end of the init process.
Please note that IDAPython can be configured with idapython.cfg file.
The IDAPython plugin exposes a new IDC function exec_python(string python_code) that allows execution
of Python code from IDC.
It is possible to use the idc.eval_idc() to evaluate IDC expressions from Python.
By default, IDA will use IDC to evaluate expressions in dialog boxes and in eval_expr().
It is possible to change the default language to Python.
In order to do that, use the following (IDC/Python) code:
load_and_run_plugin("idapython", 3)To go back to IDC, use the following code:
load_and_run_plugin("idapython", 4)