Tool

IDAPython Embedded Toolkit

Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017. Triage scripts define code and functions from per-architecture prologue and epilogue patterns, mark address ranges as bytes, words or double words and turn unexplored bytes into strings; analysis scripts resolve memory accesses made at offsets from a known base value and add cross-references and value comments, and annotation scripts list CPU port (GPIO) use, tag functions without cross-references as possible dead code and trace where an operand is used. An Android folder adds a script that comments JNIEnv function calls in native libraries and one that decrypts the strings of ARM32 libraries packed with the WeddingCake anti-analysis wrapper.

Targets: App · Firmware
Category: Firmware tools
Relationship: Foundation tool
Sources reviewed: 2026-10-20

Requirements & limits

Ten Python scripts and the slides of the two 2017 talks as PDFs, with no releases or tags; the reviewed master commit, from 2019-08-14, is the latest. The README says the scripts have only been tested on IDA Pro 6.95, with IDA 7.0 testing in progress, and runs each one separately through File > Script file in an open IDA database with IDAPython. Most use Python 2 print statements and pre-7.0 IDC calls such as MakeCode, MakeComm, MakeStr and AskAddr; jni_translate.py, added in 2019, uses Python 3-compatible print calls but still calls idc.MakeComm.
The user supplies the firmware image or Android native library and its IDA database, and enters address ranges, regular expressions or base values at prompts or in each script's user-defined section. Processor-specific syntax is chosen from IDA's processor name: define_code_functions.py covers 8051, PIC18, Mitsubishi M32R, TI TMS320C28x and AVR, and find_mem_accesses.py only 8051, while identify_port_use_locations.py ships one active PIC18 pattern with commented 8051 alternatives. Unsupported processors stop with an error until the analyst adds patterns, and find_mem_accesses.py cannot create references into segments that do not yet exist.
Several scripts rewrite the database: define_data_as_types.py first undefines the range, overwriting code or strings there, and WeddingCake_decrypt.py overwrites encrypted strings with their decrypted contents and needs JNI_OnLoad defined and exported. The WeddingCake files accompany Maddie Stone's Black Hat USA 2018 talk on that packer.
MIT, copyright 2017 Maddie Stone, in LICENSE; the README's copyright notice instead names The Johns Hopkins University Applied Physics Laboratory, and the Android README and WeddingCake script carry a Google LLC 2018 copyright line without separate license terms.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Primary sources

README.md GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
Android/README.md GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
define_code_functions.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
find_mem_accesses.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
identify_port_use_locations.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
define_data_as_types.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
Android/jni_translate.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
Android/WeddingCake_decrypt.py GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
presentations GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346
LICENSE GitHub · maddiestone/IDAPythonEmbeddedToolkit · Revision 3cf0346

More in Firmware and hardware

All 89 entries in Firmware and hardware