You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository was archived by the owner on Jul 8, 2025. It is now read-only.
Copy file name to clipboardExpand all lines: readme.md
+3-11Lines changed: 3 additions & 11 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -3,7 +3,7 @@
3
3
# python-idb
4
4
5
5
python-idb is a library for accessing the contents of [IDA Pro](https://www.hex-rays.com/products/ida/) databases (.idb files).
6
-
It provides read-only access to internal structures such as the B-tree (ID0 section), name address index (NAM section), and flags index (ID2 section).
6
+
It provides read-only access to internal structures such as the B-tree (ID0 section), name address index (NAM section), flags index (ID2 section), and types (TIL section).
7
7
The library also provides analysis of B-tree entries to expose logical structures like functions, cross references, bytes, and disassembly (via [Capstone](http://www.capstone-engine.org/)).
8
8
An example use for python-idb might be to run IDA scripts in a pure-Python environment.
9
9
@@ -54,11 +54,12 @@ The target script `yara_fn.py` has only been slightly modified:
54
54
## what works
55
55
56
56
-~250 unit tests that demonstrate functionality including file format, B-tree, analysis, and idaapi features.
57
-
- read-only parsing of .idb and .i64 files from IDA Pro v6.95 and v7.0
57
+
- read-only parsing of .idb and .i64 files from IDA Pro v5.0 to v7.5
58
58
- extraction of file sections
59
59
- B-tree lookups and queries (ID0 section)
60
60
- flag enumeration (ID1 section)
61
61
- named address listing (NAM section)
62
+
- types parsing (TIL section)
62
63
- analysis of artifacts that reconstructs logical elements, including:
63
64
- root metadata
64
65
- loader metadata
@@ -79,15 +80,6 @@ The target script `yara_fn.py` has only been slightly modified:
79
80
- Python 2.7 & 3.x compatibility
80
81
- zlib-packed idb/i64 files
81
82
82
-
83
-
## what doesn't quite work
84
-
85
-
support for the following features are feasible and planned, but not yet implemented:
86
-
87
-
- databases from versions other than v6.95 and v7.0b
0 commit comments