- Pure Python
This is a plugin to embed an IPython kernel in IDA Pro. The Python ecosystem has amazing libraries (and communities) for scientific computing. IPython itself is great for exploratory data analysis. Using tools such as the IPython notebook make it easy to share code and explanations with rich media. IPython makes using IDAPython and interacting with IDA programmatically really fun and easy.
You can just use IPython qtconsole for a better interactive python shell for IDA.
You can also use the QT console to graph things. This is an example creating a bar chart for the occurrences of each instruction mnemonic in a function (in notepad.exe).
Another useful case is using IPython notebooks.
- Function Entropy - Here is an example where we compute the entropy (using scipy stats module) of each function in notepad.exe and graph the result.
- Cython and IDA - Here is an example where we use the cython cell magic to call IDA Api's that are not exposed via IDAPython.
- Sark Snapshots - Example of screen snapshots using Sark.
More examples..soon...
IDA is predominantly single threaded application, so we cannot safely run the kernel in a separate thread.
So instead of using another thread, a timer is registered via IDAPython and the do_one_iteration
method of the ipython kernel is executed each frame.
I suggest using the Anaconda distribution of Python as it comes with all the required python libraries pre-built and installed. To get IDA to use Anaconda, simply set the PYTHONHOME enviroment variable. Alternatively you can install IPython and the dependencies separately.
This plugin should work on all 6.X x86 QT versions of IDA on Windows, Linux, and OSX (only tested on Windows).
- Download and extract the release
- Copy
ida_ipython.py
into IDA'splugins
directory - Launch IDA
- Under the
View
menu, clickIDAIPython QtConsole
or - At the command line, start an IPython qtconsole with the kernel instance (outputted in the IDA console) e.g
jupyter qtconsole --existing kernel-4264.json
- Change the paths to the
idaq.exe
andidaq64.exe
executables in thekernel.json
under thenotebook-kernels\ida32
andnotebook-kernels\ida64
directories respectively (the default is IDA 7.1 on Windows) - Install the kernels using
jupyter-kernelspec install
(e.g.jupyter-kernelspec install --user notebook-kernels\ida64
) - When starting a notebook, choose the
IDA32
orIDA64
kernels, depending on your desired IDA version.