The purpose of this example is to showcase how you can use the python scientifc computing tools with IDA Pro. In order to complete this demo you will need to have numpy, pandas, scipy and matplotlib installed. Once installed launch IDA with a notepad.exe database loaded (actually doesn't have to be notepad.exe but it's the one used in this example).
In [1]:
%matplotlib inline
import scipy.stats
import idc
import idaapi
import idautils
import numpy as np
import pandas as pd
import pylab
#Better looking Graphs..
pd.options.display.mpl_style = 'default'
pylab.rcParams['figure.figsize'] = 12.0, 8.0
#Binary Info
print "MD5: {} Binary: {}".format(idc.GetInputMD5(), idc.GetInputFile())
In [2]:
def entropy(in_bytes):
bytes = np.array(np.fromstring(in_bytes,dtype='uint8'), dtype='int32')
return scipy.stats.entropy(bytes[np.nonzero(bytes)])
In [3]:
def get_func_bytes(func_ea):
bytes = ""
for start, end in idautils.Chunks(func_ea):
bytes += idaapi.get_many_bytes(start, end - start)
return bytes
func_start = idc.GetFunctionAttr(idc.ScreenEA(), idc.FUNCATTR_START)
In [4]:
data = ((func_ea, entropy(get_func_bytes(func_ea))) for func_ea in idautils.Functions())
func_df = pd.DataFrame(data, columns=["EA", "Entropy"])
In [5]:
func_df['Formatted_EA'] = func_df['EA'].map(lambda ea: "{:X}".format(ea))
In [6]:
df_plt = func_df
ax = df_plt.plot(kind='scatter', x='EA', y='Entropy')
ax.set_xticklabels(['{:X}'.format(int(ea)) for ea in ax.get_xticks()])
ax
Out[6]:
In [7]:
func_df.sort(['Entropy'], ascending=False)
Out[7]:
In [8]:
idc.Message(str(func_df.sort(['Entropy'], ascending=False)))