Skip to main content

Pure Python parser for IDA Pro databases (.idb files)

Project description

Python IDB

python-idb

python-idb is a library for accessing the contents of IDA Pro databases (.idb files). It provides read-only access to internal structures such as the B-tree (ID0 section), name address index (NAM section), flags index (ID2 section), and types (TIL section). The library also provides analysis of B-tree entries to expose logical structures like functions, cross references, bytes, and disassembly (via Capstone). An example use for python-idb might be to run IDA scripts in a pure-Python environment.

Willem Hengeveld (mailto:itsme@xs4all.nl) provided the initial research into the low-level structures in his projects pyidbutil and idbutil. Willem deserves substantial credit for reversing the .idb file format and publishing his results online. This project heavily borrows from his knowledge, though there is little code overlap.

example use:

example: list function names

In this example, we list the effective addresses and names of functions:

In [4]: import idb
   ...: with idb.from_file('./data/kernel32/kernel32.idb') as db:
   ...:     api = idb.IDAPython(db)
   ...:     for ea in api.idautils.Functions():
   ...:         print('%x: %s' % (ea, api.idc.GetFunctionName(ea)))

Out [4]: 68901010: GetStartupInfoA
   ....: 689011df: Sleep
   ....: 68901200: MulDiv
   ....: 68901320: SwitchToFiber
   ....: 6890142c: GetTickCount
   ....: 6890143a: ReleaseMutex
   ....: 68901445: WaitForSingleObject
   ....: 68901450: GetCurrentThreadId
        ...

Note that we create an emulated instance of the IDAPython scripting interface, and use this to invoke idc and idautils routines to fetch data.

example: run an existing IDAPython script

In this example, we run the yara_fn.py IDAPython script to generate a YARA rule for the function at effective address 0x68901695 in kernel32.idb:

asciicast

The target script yara_fn.py has only been slightly modified:

  • to make it Python 3.x compatible, and
  • to use the modern IDAPython modules, such as ida_bytes.GetManyBytes rather than idc.GetManyBytes.

what works

  • ~1600 unit tests that demonstrate functionality including file format, B-tree, analysis, and idaapi features.
  • read-only parsing of .idb and .i64 files from IDA Pro v5.0 to v7.5
    • extraction of file sections
    • B-tree lookups and queries (ID0 section)
    • flag enumeration (ID1 section)
    • named address listing (NAM section)
    • types parsing (TIL section)
  • analysis of artifacts that reconstructs logical elements, including:
    • root metadata
    • loader metadata
    • entry points
    • functions
    • structures
    • cross references
    • fixups
    • segments
  • partial implementation of the IDAPython API, including:
    • Names
    • Heads
    • Segs
    • GetMnem (via Capstone)
    • Functions
    • FlowChart (basic blocks)
    • lots and lots of flags
  • zlib-packed idb/i64 files

what will never work

  • write access

getting started

python-idb is a pure-Python library, with the exception of Capstone (required only when calling disassembly APIs). You can install it via pip:

 $ pip install python-idb
 $ cd ~/Downloads/python-idb/
 $ python scripts/run_ida_script.py  ~/tools/yara_fn.py  ~/Downloads/kernel32.idb
   ... profit! ...

While most python-idb function have meaningful docstrings, there is not yet a comprehensive documentation website. However, the unit tests demonstrate functionality that you'll probably find useful.

Someone interested in learning the file format and contributing to the project should review the idb.fileformat module & tests. Those that are looking to extract meaningful information from existing .idb files probably should look at the idb.analysis and idb.idapython modules & tests.

Please report issues or feature requests through Github's bug tracker associated with the project.

license

python-idb is licensed under the Apache License, Version 2.0. This means it is freely available for use and modification in a personal and professional capacity.

Project details


Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

python_idb-0.8.0.tar.gz (83.8 kB view details)

Uploaded Source

Built Distribution

python_idb-0.8.0-py3-none-any.whl (65.4 kB view details)

Uploaded Python 3

File details

Details for the file python_idb-0.8.0.tar.gz.

File metadata

  • Download URL: python_idb-0.8.0.tar.gz
  • Upload date:
  • Size: 83.8 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for python_idb-0.8.0.tar.gz
Algorithm Hash digest
SHA256 e8143252ebe6c4ebce9d0ecd78417fa576772e70bb5f519a08fcee2231a5ba74
MD5 9a1627f70b97ce2bcf49b795e35ca60b
BLAKE2b-256 f9e76e02363b320ad794b43213fb70985374f5a60fa2b1a04484dc05ad1a86bc

See more details on using hashes here.

Provenance

The following attestation bundles were made for python_idb-0.8.0.tar.gz:

Publisher: python-publish.yml on williballenthin/python-idb

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file python_idb-0.8.0-py3-none-any.whl.

File metadata

  • Download URL: python_idb-0.8.0-py3-none-any.whl
  • Upload date:
  • Size: 65.4 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for python_idb-0.8.0-py3-none-any.whl
Algorithm Hash digest
SHA256 8336e18862cb530c230f349a9dd2c5e6fee7d5924c97b209499bf262e0a32350
MD5 ff794c31cded62e851f885dd807c3f47
BLAKE2b-256 8c0ca344b93a51dea2e937dd57b0bfbcca12077f81ed439b706fe931923809a6

See more details on using hashes here.

Provenance

The following attestation bundles were made for python_idb-0.8.0-py3-none-any.whl:

Publisher: python-publish.yml on williballenthin/python-idb

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page