5

I have the following IDA python script. It sets and removes breakpoints on all calls to library functions:

import idc
import idaapi
import idautils

def set_breakpoints():
    ea = idc.ScreenEA()
    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
        if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
            for ref in idautils.CodeRefsTo(function_ea, 0):
                    idc.AddBpt(ref)

def rem_breakpoints():
    ea = idc.ScreenEA()
    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
        if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
            for ref in idautils.CodeRefsTo(function_ea, 0):
                    idc.DelBpt(ref)

idaapi.add_hotkey("Alt-Z", set_breakpoints)
idaapi.add_hotkey("Alt-X", rem_breakpoints)

Now I want to have the same functionality for imported win api functions (from "Import" tab), but I cannot find any flags that will indicate that function is imported. Maybe someone can point me into right direction to do this. Thanks.

igntec
  • 51
  • 1
  • 2

1 Answers1

6

This code snippet was copied from

https://github.com/idapython/src/blob/master/examples/core/list_imports.py

"""
summary: enumerate file imports

description: Using the API to enumerate file imports. """

import ida_nalt

nimps = ida_nalt.get_import_module_qty()

print("Found %d import(s)..." % nimps)

for i in range(nimps): name = ida_nalt.get_import_module_name(i) if not name: print("Failed to get import module name for #%d" % i) name = "<unnamed>"

print(&quot;Walking imports for module %s&quot; % name)
def imp_cb(ea, name, ordinal):
    if not name:
        print(&quot;%08x: ordinal #%d&quot; % (ea, ordinal))
    else:
        print(&quot;%08x: %s (ordinal #%d)&quot; % (ea, name, ordinal))
    # True -&gt; Continue enumeration
    # False -&gt; Stop enumeration
    return True
ida_nalt.enum_import_names(i, imp_cb)

print("All done...")

The remaining steps from enumerating imports to setting breakpoints are trivial.

crifan
  • 137
  • 6
w s
  • 8,458
  • 1
  • 24
  • 40
  • 1
    One note: the entries in the .idata section are usually pointers to the target functons, not functions themselves, so they'll need to be dereferenced before setting breakpoints. – Igor Skochinsky Oct 01 '16 at 18:13