IDAPython is a set of powerful Python bindings for IDA. It combines the power of Python with the analysis features of IDA, allowing for more powerful scripting capabilities. IDAPython consists of three modules: idaapi, which provides access to the IDA API; idautils, which provides high-level utility functions for IDA; and idc, an IDC compatibility module. Most of the IDAPython functions accept an address as the parameter, and, while reading the IDAPython documentation, you will find that the address is referred to as ea. Many IDAPython functions return addresses; one common function is idc.get_screen_ea(), which gets the address of the current cursor location:

Python>ea = idc.get_screen_ea()
Python>print hex(ea)
0x40206a

The following code snippet shows how you can pass the address returned by idc.get_screen_ea() to the idc.get_segm_name() function to determine the name of the segment associated with the address:

Python>ea = idc.get_screen_ea()
Python>idc.get_segm_name(ea)
.text

In the following code snippet, the address returned by idc.get_screen_ea() is passed to idc.generate_disasm_line() function to generate the disassembly text:

Python>ea = idc.get_screen_ea()
Python>idc.generate_disasm_line(ea,0)
push ebp

In the following code, the address returned by the idc.get_screen_ea() function is passed to idc.get_func_name() to determine the name of the function associated with the address. For more examples, refer to Alexander Hanel's The Beginner’s Guide to IDAPython book (https://leanpub.com/IDAPython-Book):

Python>ea = idc.get_screen_ea()
Python>idc.get_func_name(ea)
_main

During malware analysis, often, you will want to know if the malware imports a specific function (or functions), such as CreateFile, and where in the code the function is called. You can do that by using the cross-references feature covered previously. To give you a feel for IDAPython, the following examples demonstrate how to use IDAPython to check for the presence of the CreateFile API and to identify cross-references to CreateFile.