idalink arose of the need to easily use IDA's API for analysis without wanting
to be stuck in the IDA interface. It's rather hackish still and and we provide
no warranty of any kind (express or implied), but we are doing our best to fix
any issues you find. Pull requests are -of course- also encouraged!
idalink works by spawning an IDA CLI session in the background (in a detached
screen session), and connects to it using RPyC.
## Requirements
idalink requires the following:
- Python 2 (ida does not support python 3)
- IDA Pro >= 7.0
- libssl0.9.8:i386 (for IDA's Python version)
idalink uses:
- rpyc in your Python environment outside of IDA
- rpyc in your IDA Python environment.
## Usage
To use idalink, put it in a place where you can import it and do, in any python
session (ie, outside of IDA):
```python
#!/usr/bin/env python
# -*- coding: utf-8 -*-
from idalink import IDALink
# We want debug messages for now
import logging
logging.basicConfig()
logging.getLogger('idalink').setLevel('DEBUG')
# Let's do some testing with idalink!
with IDALink("idat64", "./tests/bash") as ida:
# use idc
s = ida.idc.ScreenEA()
print("Default ScreenEA is {:x}".format(s))
# use idautils
print("All segments")
for s in ida.idautils.Segments():
print(" - Segment at {:x} is named {}".format(s, ida.idc.SegName(s)))
# use idaapi
print("First byte for each function")
for i, s in enumerate(ida.idautils.Functions()):
print(" - Byte at {:x} is {:02x}".format(s, ida.idaapi.get_byte(s)))
# access IDA memory in a dict way
print("Accessing memory directly")
functions = next(ida.idautils.Functions())
print(" - Byte at {:x} is {}".format(s, ida.memory[s]))
```
And that's that. Basically, you get access to the IDA API from outside of IDA.
Good stuff.
## Issues
- A random port between 40000 and 49999 is chosen for communication, with no
error-checking for failed IDA startups or if the port is already in use.
- IDA-backed memory is not really tested, and uses Heads for getting the
"mapped" list, which is slow and incomplete
Metadata
Release files for idalink 0.12
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| idalink-0.12.tar.gz | 8.1 kB | Without provenance | Details |
Release files / idalink-0.12.tar.gz
| Download URL | idalink-0.12.tar.gz |
|---|---|
| Size | 8.1 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
1422b19b6581861c9935742598c0731d7cb4edb7288d5f8de8e1843e282ee6cf
|
|
BLAKE2b-256 checksum How to use checksums |
e7e56bb8d736fdc29e7d10b40c5992fae4bfe8db30476ff527d38a87eb12446e
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/1.12.1 pkginfo/1.4.2 requests/2.18.4 setuptools/39.0.1 requests-toolbelt/0.8.0 tqdm/4.26.0 CPython/2.7.15rc1
|
Security for idalink 0.12
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.