Package: idascript
IdascriptIdascript is a python library allowing to launch idapython script on binary files in a transparent manner.InstallationInstalling the library can be done with:pip install idascriptAfter installationidascriptshould be ready for import and the scriptidascriptershould be in the path to use the library as a program.IDA pathidascript looks for theidat64in the $PATH environment variable but if it is not present the IDA installation path
should be given via theIDA_PATHenvironment variable.Command lineexportIDA_PATH=[youridapath]idascripter...orIDA_PATH=[youridapath]idascripter...Dependencies: Theidascripterscript requires libmagic to identify
executable binaries. It should be available on the system. It can be installed
with:sudo apt install libmagic1Python libraryIfIDA_PATHprovided to the interpreter, it can be set manually withos.environ["IDA_PATH"] = [your path].The easiest way is to export the environment variable in you bashrcidascripterAfter installation the scriptidascripteris available in the path. It helps
executing idapython scripts on one or multiple binary files in an easy manner.Single fileidascriptermy_binary_file[-smy_script.py][-ttimeout][myscriptparams|IDAoptions]idascripter returns the exit code of the IDA process, which can be itself the exit code of your
script given byida_pro.qexit(num).As a recall an idapython script should be architectured like this:importida_autoimportida_proida_auto.auto_wait()# wait for the pre-analysis of IDA to be terminated# Your script contentida_pro.qexit(0)#exit IDA with the given return code (otherwise remains opened)Disclaimer: You should make sure that the import of your script are satisfied (in python2) before
luanching it against binariesMultiple filesIf idascripter is given a directory instead of a file, it will recursively iterate all the directory and
subdirectories for executable files. The file type detection is based onmagiclibrary and analyse files
which ave the following mime type:application/x-dosexec(PE, MS-DOS),application/x-sharedlib(ELF),application/x-mach-binary(Mach-O),application/x-executable(ELF).When running idascripter shows a progessbar and keeps track of files having a return code other than 0 to
(help post-analysis debug).Note: An optional parameters (-l/--log) can be precised to have a log file with all the results.Library usageThe python library intents to be as simple as possible.Single file analysisA single file analysis can performed as follow:os.environ["IDA_PATH"]="/path/to/ida"# If not given to the interpreter directlyfromidascriptimportIDAida=IDA("/path/binary","/path/script",[])ida.start()retcode=ida.wait()Note start is not blocking so you can come to pick up the result whenever you want.Multiple file analysisThis works almost similarly to single file analysis except that a file
iterator should be given. A simple usage is:fromidascriptimportMultiIDA,iter_binary_filesgenerator=iter_binary_files('/path/to/bins')for(retcode,file)inMultiIDA.map(generator,"/path/script",[]):# Do what you want with analysed files yieldedThe generator should is not necessarily a generator, thus it can be a list of files to analyseCustom file generatorWe might be led to write our own file iterator depending on our needs. Let's consider we want
to analyse only files that have never been analysed namely the ones not having a.i64associated.
Thus, we can derive our own generator fromiter_binary_fileslike this:importos.pathfrompathlibimportPathfromidascriptimportMultiIDA,iter_binary_filesdefmy_custom_generator(path):forfileiniter_binary_files(path):i64_file=os.path.splitext(file)[0]+".i64"ifnotPath(i64_file).exists():yieldfilegenerator=my_custom_generator('/path/to/bins')for(retcode,file)inMultiIDA.map(generator,"/path/script",[]):# Do something with filesAPI.. automodule:: idascript.ida
    :members:
    :show-inheritance:
    :undoc-members:
    :exclude-members: IDAMode