I have the following IDA python script. It sets and removes breakpoints on all calls to library functions:
import idc
import idaapi
import idautils
def set_breakpoints():
ea = idc.ScreenEA()
for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
for ref in idautils.CodeRefsTo(function_ea, 0):
idc.AddBpt(ref)
def rem_breakpoints():
ea = idc.ScreenEA()
for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
for ref in idautils.CodeRefsTo(function_ea, 0):
idc.DelBpt(ref)
idaapi.add_hotkey("Alt-Z", set_breakpoints)
idaapi.add_hotkey("Alt-X", rem_breakpoints)
Now I want to have the same functionality for imported win api functions (from "Import" tab), but I cannot find any flags that will indicate that function is imported. Maybe someone can point me into right direction to do this. Thanks.
.idatasection are usually pointers to the target functons, not functions themselves, so they'll need to be dereferenced before setting breakpoints. – Igor Skochinsky Oct 01 '16 at 18:13