Learning Malware Analysis

5.2 IDAPython

IDAPython is a set of powerful Python bindings for IDA. It combines the power of Python with the analysis features of IDA, allowing for more powerful scripting capabilities. IDAPython consists of three modules: idaapi, which provides access to the IDA API; idautils, which provides high-level utility functions for IDA; and idc, an IDC compatibility module. Most of the IDAPython functions accept an address as the parameter, and, while reading the IDAPython documentation, you will find that the address is referred to as ea. Many IDAPython functions return addresses; one common function is idc.get_screen_ea(), which gets the address of the current cursor location:

Python>ea = idc.get_screen_ea()Python>print hex(ea)0x40206a

The following ...