Learning Malware Analysis

5. IDA Scripting and Plugins

IDA offers scripting capabilities that give you access to the contents of an IDA database. Using the scripting functionality, you can automate some of the common tasks and complex analysis operations. IDA supports two scripting languages: IDC, which is a native, built-in language (with syntax similar to C), and Python scripting through IDAPython. In September 2017, Hex-Rays released a new version of IDAPython API that is compatible with IDA 7.0 and later versions. This section will give you a feel of the scripting capabilities using IDAPython; the IDAPython scripts demonstrated in this section makes use of the new IDAPython API, which means that if you are using older versions of IDA (lower than IDA 7.0), these ...