IDAPython使用记录

1
2

pip install tornado
pip install debugpy

1
2
3

.
XXX\IDA_Pro\python\3
XXX\IDA_Pro\plugins

1
2
3
4
5

HOST = "127.0.0.1"
PORT = 7065
DEBUG_PORT = 7066
PYTHON = "XXX/IDA_Pro/python311/python.exe"
LOGGING = False

1
2

[IDACode] Plugin version 0.3.0
[IDACode] Plugin loaded, use Edit -> Plugins -> IDACode to start the server

1
2
3
4
5

import idautils
import idaapi
import idc

print("Hello IDAPython")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

import idautils
import idaapi
import idc

print("Hello IDAPython")

n = 5
print("Befor breakpoint")
breakpoint()
print("After breakpoint")

n = 10

1
2
3
4

"python.autoComplete.extraPaths": [
        "XXX/IDA_Pro/python/3",
        "XXX/IDA_Pro/python311/Lib/site-packages",
  ],

1
2

idc.here()
idc.get_screen_ea()

1
2
3
4
5

idaapi.cvar.inf.min_ea
idc.get_inf_attr(idc.INF_MIN_EA)

idaapi.cvar.inf.max_ea
idc.get_inf_attr(idc.INF_MAX_EA)

1

.text:0043375E                 mov     esi, [eax+0Ch]

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

Python> idc.get_segm_name(here())
'.text'
Python> idc.GetDisasm(here())
'mov     esi, [eax+0Ch]'

Python>idc.print_insn_mnem(here())
'mov'
Python>idc.print_operand(here(),0)
'esi'
Python>idc.print_operand(here(),1)
'[eax+0Ch]'

1
2
3
4
5
6

import idc
import idautils
import idaapi

for seg in idautils.Segments():
    print(idc.get_segm_name(seg),hex(idc.get_segm_start(seg)),hex(idc.get_segm_end(seg)))

1
2
3
4
5
6

import idc
import idautils
import idaapi

for func in idautils.Functions():
    print(hex(func),idc.get_func_name(func))

1
2
3
4
5
6

Python>idaapi.get_func(here())
<ida_funcs.func_t; proxy of <Swig Object of type 'func_t *' at 0x0000026DF330AE40> >
Python>idaapi.get_func(here()).start_ea
0x43371b
Python>idaapi.get_func(here()).end_ea
0x4337c4

1
2
3
4

Python>idc.get_func_attr(here(), FUNCATTR_START)
0x43371b
Python>idc.get_func_attr(here(), FUNCATTR_END)
0x4337c4

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

FUNCATTR_START   =  0     # readonly: function start address
FUNCATTR_END     =  4     # readonly: function end address
FUNCATTR_FLAGS   =  8     # function flags
FUNCATTR_FRAME   = 16     # readonly: function frame id
FUNCATTR_FRSIZE  = 20     # readonly: size of local variables
FUNCATTR_FRREGS  = 24     # readonly: size of saved registers area
FUNCATTR_ARGSIZE = 28     # readonly: number of bytes purged from the stack
FUNCATTR_FPD     = 32     # frame pointer delta
FUNCATTR_COLOR   = 36     # function color code
FUNCATTR_OWNER   = 16     # readonly: chunk owner (valid only for tail chunks)
FUNCATTR_REFQTY  = 20     # readonly: number of chunk parents (valid only for tail chunks)

1
2

Python>idc.get_name_ea_simple("sub_43371B")
0x43371b

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

import idc 
import idautils 
import idaapi 

start = idc.get_func_attr(idc.here(),idc.FUNCATTR_START)
end = idc.get_func_attr(idc.here(), idc.FUNCATTR_END)

curr_addr = start 

while curr_addr <= end:
    print(hex(curr_addr),idc.GetDisasm(curr_addr))
    curr_addr = idc.next_head(curr_addr,end)

1
2
3
4
5
6
7
8

import idc 
import idautils 
import idaapi 

items = idautils.FuncItems(idc.here())

for item in items:
    print(hex(item),idc.GetDisasm(item))

1

idc.prev_head(ea)

1
2
3
4
5
6

#可在idc_bc695.py中查看
def GetFrame(ea): return get_func_attr(ea, FUNCATTR_FRAME)
def GetFrameLvarSize(ea): return get_func_attr(ea, FUNCATTR_FRSIZE)
def GetFrameRegsSize(ea): return get_func_attr(ea, FUNCATTR_FRREGS)
def GetFrameArgsSize(ea): return get_func_attr(ea, FUNCATTR_ARGSIZE)
def GetFunctionFlags(ea): return get_func_attr(ea, FUNCATTR_FLAGS)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

import idc 
import idautils 
import idaapi 

for func in idautils.Functions():
    flags = idc.get_func_attr(func, idc.FUNCATTR_FLAGS)
    if flags & idc.FUNC_NORET:
        print(hex(func), "FUNC_NORET")
    if flags & idc.FUNC_FAR:
        print(hex(func), "FUNC_FAR")
    if flags & idc.FUNC_LIB:
        print(hex(func), "FUNC_LIB")
    if flags & idc.FUNC_STATIC:
        print(hex(func), "FUNC_STATIC")
    if flags & idc.FUNC_FRAME:
        print(hex(func), "FUNC_FRAME")
    if flags & idc.FUNC_USERFAR:
        print(hex(func), "FUNC_USERFAR")
    if flags & idc.FUNC_HIDDEN:
        print(hex(func), "FUNC_HIDDEN")
    if flags & idc.FUNC_THUNK:
        print(hex(func), "FUNC_THUNK")
    if flags & idc.FUNC_LIB:
        print(hex(func), "FUNC_BOTTOMBP")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

FUNC_NORET: 这个标志表示某个函数是否有返回值.

FUNC_FAR: 这个标志非常少的出现,标志程序是否使用分段内存.

FUNC_USERFAR: 这个标志也非常少见,也很少有文档,HexRays把它描述为“user has specified far-ness of the function”.

FUNC_LIB: 这个表示用于寻找库函数的代码.识别库函数代码是非常有必要的,因为我们在分析的
时候一般将其跳过.下面的例子展示了如何使用这个标志.

import idc
import idautils

for func in idautils.Functions():
    flags = idc.get_func_attr(func, idc.FUNCATTR_FLAGS)

    if flags & idc.FUNC_LIB:
        print(hex(func), "FUNC_LIB",idc.get_func_name(func))
        
FUNC_STATIC: 这个标志作用在于识别该函数在编译的是否是一个静态函数.在C语言中静态函数被默认为是全局的.如果作者把这个函数定义为静态函数,那么这个函数只能被本文件中的函数访问.利用静态函数的判定我们可以更好的理解源代码的结构.

FUNC_FRAME: 这个标志表示函数是否使用了ebp寄存器(帧指针),使用ebp寄存器的函数通常有如下的语法设定,目的是为了保存栈帧.

.text:00404C90                 push    ebp
.text:00404C91                 mov     ebp, esp
.text:00404C96                 sub     esp, 65Ch

FUNC_BOTTOMBP: 和 FUNC_FRAME 一样,该标志用于跟踪帧指针(ebp).它作用是识别函数中帧指针是否等于堆栈指针(esp).

FUNC_HIDDEN: 带有 FUNC_HIDDEN 标志的函数意味着它们是隐藏的,这个函数需要展开才能查看.如果我们跳转到一个标记为 HIDDEN 的地址的话,它会自动的展开.

FUNC_THUNK: 表示这个函数是否是一个 thunk 函数,thunk 函数表示的是一个简单的跳转函数.

.text:1A710606 Process32Next proc near
.text:1A710606 jmp ds:__imp_Process32Next
.text:1A710606 Process32Next endp

需要注意的是一个函数可能拥有多个标志的组合.

1
2
3
4
5
6
7
8

import idc 
import idautils 
import idaapi 

items = idautils.FuncItems(idc.here())

for item in items:
    print(hex(item),idc.GetDisasm(item))

1
2

#返回一个迭代器
idautils.FuncItems(ea)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

import idc 
import idautils 
import idaapi 

for func in idautils.Functions():
    flags = idc.get_func_attr(func, idc.FUNCATTR_FLAGS)
    if flags & idc.FUNC_LIB or flags & idc.FUNC_THUNK:
        continue
    dism_addr = idautils.FuncItems(func)
    for line in dism_addr:
        m = idc.print_insn_mnem(line)
        if m == "call" or m == "jmp":
            op = idc.get_operand_type(line,0)
            if op == idc.o_reg:
                print(hex(line),idc.GetDisasm(line))

1
2

#n=0表示第一个操作数,n=1表示第二个操作数.
get_operand_type(ea,n)

1
2
3

#这两个函数的功能获取的是下一条指令的地址而不是下一个地址
idc.next_head(idc.here())
idc.prev_head(idc.here())

1
2

idc.next_addr(idc.here())
idc.prev_addr(idc.here())

1
2
3
4
5
6
7

.text:005772A9                 add     esi, 4
.text:005772AC                 cmp     esi, offset unk_5D53BC

Python>idc.next_head(0x005772A9)
0x5772ac
Python>idc.next_addr(0x005772A9)
0x5772aa

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

o_void: 如果指令没有任何操作数,它将返回 0.
o_reg: 如果操作数是寄存器,则返回这种类型,它的值为 1.
o_mem: 如果操作数是直接寻址的内存,那么返回这种类型,它的值是 2,这种类型对寻找DATA的引用非常有帮助.

Python>print(hex(idc.here()), idc.GetDisasm(idc.here()))
0x40f576 cmp     dword_5D0E44, edi
Python>idc.GetOpType(idc.here(),0)
0x2

o_phrase: 如果操作数是利用基址寄存器和变址寄存器的寻址操作的话,那么返回该类型,值为3.

Python>print(hex(idc.here()), idc.GetDisasm(idc.here()))
0x1000b8c2 mov [edi+ecx], eax
Python>idc.GetOpType(idc.here(),0)
0x3

o_displ: 如果操作数是利用寄存器和位移的寻址操作的话,返回该类型,值为4,位移指的是像如下代码中的 0x18,这在获取结构体中的某个数据是非常常见的.

Python>print(hex(idc.here()), idc.GetDisasm(idc.here()))
0x40f6ec mov     ebx, [ebp+0Ch]
Python>idc.GetOpType(idc.here(),1)
0x4

o_imm: 如果操作数是一个确定的数值的话,那么返回类型,值为5.
-------------------------------------------
Python>print(hex(idc.here()), idc.GetDisasm(idc.here()))
0xa05da1 add esp, 0Ch
Python>idc.GetOpType(idc.here(),1)
0x5
-------------------------------------------
o_far: 这种返回类型在x86 和 x86_64的逆向中不常见.它用来判断直接访问远端地址的操作数,值为6.
o_near: 这种返回类型在x86和x86_64的逆向中不常见.它用来判断直接访问近端地址的操作数,值为7.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

import idc 
import idautils 
import idaapi 
from collections import defaultdict

displace = defaultdict(list)

for func in idautils.Functions():
    flags = idc.get_func_attr(func, idc.FUNCATTR_FLAGS)
    if flags & idc.FUNC_LIB or flags & idc.FUNC_THUNK:
        continue
    dism_addr = idautils.FuncItems(func)
    for line in dism_addr:
        op = None
        index = None
        
        # 定义结果结构来解析当前的指令
        tmp = idaapi.insn_t()
        idaapi.decode_insn(tmp,line)
        if tmp.Op1.type == idaapi.o_displ:
            op = 1
        if tmp.Op2.type == idaapi.o_displ:
            op = 2 
        if op == None:
            continue
        if "bp" in  idc.print_operand(line,0) or "bp" in idc.print_operand(line,1):
            if op == 1:
                index = (~(int(tmp.Op1.addr) - 1) & 0xFFFFFFFF)
            else:
                index = (~(int(tmp.Op2.addr) - 1) & 0xFFFFFFFF)
        else:
            if op ==1 :
                index = int(tmp.Op1.addr)
            else:
                index = int(tmp.Op2.addr)

        if index:
            displace[index].append( hex(line) )
            
print(displace)

1
2
3
4

push 0Ch
push 0BC10B8h
push [esp+10h+arg_0]
call ds:_strnicmp

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

import idc 
import idautils 
import idaapi 
from collections import defaultdict

min = idc.get_inf_attr(idc.INF_MIN_EA)
max = idc.get_inf_attr(idc.INF_MAX_EA)
# for each known function
for func in idautils.Functions():
    flags = idc.get_func_attr(func, idc.FUNCATTR_FLAGS)
# skip library & thunk functions
    if flags & idc.FUNC_LIB or flags & idc.FUNC_THUNK:
        continue
    dism_addr = list(idautils.FuncItems(func))

    for curr_addr in dism_addr:
        if idc.get_operand_type(curr_addr, 0) == 5 and \
        (min < idc.get_operand_value(curr_addr,0) < max):
            idc.op_plain_offset(curr_addr, 0, 0)
            # print(hex(curr_addr))
        if idc.get_operand_type(curr_addr, 1) == 5 and (min < idc.get_operand_value(curr_addr,1) < max):
            idc.op_plain_offset(curr_addr, 1, 0)
            # print( hex(curr_addr) )

1

idc.get_operand_value(ea, n)

1
2
3
4

#参数一:ea为地址.
#参数二:n为操作数的索引.
#参数三:是基地址,该例子中只需要设置为0即可.
idc.op_plain_offset(ea, n, base)

1
2
3
4
5
6
7
8

import idc
import idautils

addr = idc.get_name_ea_simple("WriteFile")
print(idc.GetDisasm(addr))

for i in idautils.CodeRefsTo(addr, 0):
    print(hex(i), idc.GetDisasm(i))

1

idc.get_name_ea_simple("WriteFile")

1
2
3

#参数一:ea是我们想要寻找交叉引用的地址.
#参数二:flow是一个bool值,它用于指定是否遵循正常的代码流.
idautils.CodeRefsTo(ea,flow)

1
2
3
4
5
6

import idc
import idautils
import idaapi

ea = idc.here()
idc.MakeName(ea, "RtlCompareMemory")

1
2

#返回一个类型为(ea, str_name)的元组.
idautils.Names()

1

idautisl.CodeRefsFrom(ea,flow)

1
2
3
4
5
6
7
8

import idc
import idautils
import idaapi

addr = idc.here()

for i in idautils.CodeRefsFrom(addr,0):
    print(hex(i),idc.GetDisasm(i))

1
2
3
4
5

#返回该数据地址的所有交叉引用(迭代器)
idautils.DataRefsTo(ea)

#返回该地址所引用的数据地址
idautils.DataRefsFrom(ea)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

import idc 
import idautils 
import idaapi 

addr = idc.here()

print(hex(addr),idc.GetDisasm(addr))

for xref in idautils.XrefsTo(addr,1): 
    print(xref.type,idautils.XrefTypeName(xref.type),hex(xref.frm),hex(xref.to),xref.iscode)

1
2
3
4

#idc.ida_xref.XREF_ALL=0 (default)
#idc.ida_xref.XREF_FAR=1
#idc.ida_xref.XREF_DATA=2
idautils.XrefsTo(ea,flags=0)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

#可在idautils.py文件中查看
_ref_types = {
    ida_xref.fl_U  : 'Data_Unknown',
    ida_xref.dr_O  : 'Data_Offset',
    ida_xref.dr_W  : 'Data_Write',
    ida_xref.dr_R  : 'Data_Read',
    ida_xref.dr_T  : 'Data_Text',
    ida_xref.dr_I  : 'Data_Informational',
    ida_xref.fl_CF : 'Code_Far_Call',
    ida_xref.fl_CN : 'Code_Near_Call',
    ida_xref.fl_JF : 'Code_Far_Jump',
    ida_xref.fl_JN : 'Code_Near_Jump',
    20             : 'Code_User',
    ida_xref.fl_F  : 'Ordinary_Flow'
}

1
2
3
4
5
6
7
8

#可在idc.py中查看
SEARCH_UP = 0
SEARCH_DOWN = 1
SEARCH_NEXT = 2
SEARCH_CASE = 4
SEARCH_REGEX = 8
SEARCH_NOBRK = 16
SEARCH_NOSHOW = 32

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

#这是一个错误示例 地址并没有增加
import idc 
import idautils 
import idaapi 

pattern = "55 8B EC"

addr = idc.get_inf_attr(idc.INF_MIN_EA)

for x in range(0,5):
    addr = idc.find_binary(addr,idc.SEARCH_DOWN,pattern)
    if addr!= idc.BADADDR:
        print(hex(addr),idc.GetDisasm(addr))

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

import idc 
import idautils 
import idaapi 

pattern = "55 8B EC"

addr = idc.get_inf_attr(idc.INF_MIN_EA)

for x in range(0,5):
    addr = idc.find_binary(addr,idc.SEARCH_DOWN | idc.SEARCH_NEXT,pattern)
    if addr!= idc.BADADDR:
        print(hex(addr),idc.GetDisasm(addr))

1
2
3
4
5
6

#参数一:ea是地址.
#参数二:flag是搜索方向和搜索类型.
#参数三:y是从ea开始搜索的行数,通常置0.
#参数四:x是行中的坐标,通常置0.
#参数五:searchstr是要搜索的字符串.
idc.find_text(ea, flag, y, x, searchstr, from_bc695=False)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

import idc
import idautils
import idaapi

addr = idc.get_inf_attr(idc.INF_MIN_EA)
end = idc.get_inf_attr(idc.INF_MAX_EA)

while addr < end:
    addr = idc.find_text(addr, idc.SEARCH_DOWN, 0, 0, "NoRun")
    if addr == idc.BADADDR:
        break
    else:
        print(hex(addr), idc.GetDisasm(addr))
        addr = idc.next_head(addr)

1
2
3
4
5
6

#下述这些api返回bool值,true或者false.
idc.is_code(f)    # 判断是否是代码.
idc.is_data(f)    # 判断是否是数据.
idc.is_tail(f)    # 判断 IDA 是否将其判定为尾部.
idc.is_unknown(f) # 判断 IDA 是否将其判定为未知,即既不是数据,也不是代码.
idc.is_head(f)    # 判断 IDA 是否将其判定为头部.

1
2
3
4
5

import idc

ea = idc.here()
f = idc.get_full_flags(ea)
print(idc.is_code(f))

1

idc.find_code(ea,flag)

1
2
3
4
5

.text:00577821                 push    0
.text:00577823                 mov     eax, offset loc_56B690

Python>idc.find_code(0x00577821, idc.SEARCH_DOWN | idc.SEARCH_NEXT)
0x577823

1
2

idc.read_selection_start()
idc.read_selection_end()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

import idaapi

p0 = idaapi.twinpos_t()
p1 = idaapi.twinpos_t()
view = idaapi.get_current_viewer()
idaapi.read_selection(view, p0, p1)

print("start:", hex(p0.place(view).ea))
print("end:", hex(p1.place(view).ea))
#注意此处,hex(p1.place(view).ea)是选中部分的最后一条指令的地址

1

idc.set_cmt(ea, cmt, 0)

1

idc.set_cmt(ea, cmt, 1)

1

idc.get_cmt(ea, 0)

1

idc.get_cmt(ea, 1)

1
2
3
4
5
6
7

#参数一:ea可以是函数中的任何地址
#参数二:cmt就是我们要添加的注释
#参数三:repeatable是否为重复性注释
#将函数的注释标记为可重复性的话,那么它会在任何调用该函数的地方添加注释
idc.set_func_cmt(ea, cmt, repeatable)

idc.get_func_cmt(ea, repeatable)

1

idaapi.set_name(ea, name)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

#获取1字节
idc.get_wide_byte(ea)
#获取2字节
idc.get_wide_word(ea)  
#获取4字节
idc.get_wide_dword(ea)
#获取8字节
idc.get_qword(ea)  

idc.GetFloat(ea) 
idc.GetDouble(ea)

1
2

#返回bytes类型
idc.get_bytes(ea, size, use_dbg = False)

1
2
3
4

patch_byte(ea, value)
patch_word(ea, value)
patch_dword(ea, value)
patch_qword(ea, value)

1
2
3
4

#参数一:forsave 0,打开一个文件对话框;1,打开一个文件保存对话框.
#参数二:mask用来指定文件后缀或者模式,如:"*.dll".
#参数三:prompt 窗口的名字.
ida_kernwin.ask_file(for_saving, mask, prompt)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

import idc
import idaapi

from PyQt5 import QtCore, QtGui, QtWidgets
class MyPluginFormClass(idaapi.PluginForm):
    def OnCreate(self, form):
        # Get parent widget
        self.parent = self.FormToPyQtWidget(form) # IDAPython
        self.PopulateForm()
    def PopulateForm(self):
        # Create layout
        layout = QtWidgets.QVBoxLayout()
        # Create Table Widget
        self.example_row = QtWidgets.QTableWidget()
        column_names = ["Address", "Mnemonic"]
        self.example_row.setColumnCount(len(column_names))
        self.example_row.setRowCount(0)
        self.example_row.setHorizontalHeaderLabels(column_names)
        self.example_row.doubleClicked.connect(self.JumpSearch)
        layout.addWidget(self.example_row)
        # Create Button
        self.addbtn = QtWidgets.QPushButton("Add Address")
        self.addbtn.clicked.connect(self.AddAddress)
        layout.addWidget(self.addbtn)
        # make our created layout the dialogs layout
        self.parent.setLayout(layout)

    def AddAddress(self):
        ea = idc.here() # IDAPython
        index = self.example_row.rowCount()
        self.example_row.setRowCount(index + 1)
        h = "0x%x" % ea
        item = QtWidgets.QTableWidgetItem(h)
        item.setFlags(item.flags() ^ QtCore.Qt.ItemIsEditable)

        self.example_row.setItem(index, 0, item)
        self.example_row.setItem(index, 1,
        QtWidgets.QTableWidgetItem(idc.print_insn_mnem(ea))) # IDAPython
        self.example_row.update()
    def JumpSearch(self, item):
        tt = self.example_row.item(item.row(), 0)
        ea = int(tt.text(), 16)
        idaapi.jumpto(ea) # IDAPython

plg = MyPluginFormClass()
plg.Show("Jump Around")

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

import os
import subprocess

idat_path = "XXX/IDA_Pro/idat.exe"
file_path = 'XXX'

for root, dirs, files in os.walk(file_path):
    for file in files:
        file_path = os.path.join(root, file)
        if(file_path.endswith(".exe")):
            subprocess.call([idat_path, "-B", file_path])

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

import idc 
import idautils 
import idaapi

idaapi.auto_wait()

count = 0 

for func in idautils.Functions():
    flags = idc.get_func_attr(func, idc.FUNCATTR_FLAGS)
    if flags & idc.FUNC_LIB:
        continue
    for instru in idautils.FuncItems(func):
        count += 1

f = open("instru_count.t",'w') 

writeContent = "Instruction count is {}".format(count)

print(writeContent)

f.write(writeContent)
f.close()
idc.qexit(0)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

import idc 
import idautils 
import idaapi 

def cls_main(p=True):
    f = idaapi.FlowChart(idaapi.get_func(idc.here()))
    for block in f:
        if p:
            print("%x - %x [%d]:" % (block.start_ea, block.end_ea, block.id))
        for succ_block in block.succs(): # 获取后继节点
            if p:
                print("  succs: %x - %x [%d]:" % (succ_block.start_ea, succ_block.end_ea, succ_block.id))
                
        for pred_block in block.preds(): # 获取前驱节点
            if p:
                print("  preds:%x - %x [%d]:" % (pred_block.start_ea, pred_block.end_ea, pred_block.id))
        
cls_main()

1
2
3
4
5
6
7
8

.text:005680D7 ; int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
.text:005680D7 _WinMain@16     proc near               ; CODE XREF: __scrt_common_main_seh(void)+F3↑p
.text:005680D7
.text:005680D7 var_4           = dword ptr -4
.text:005680D7 hInstance       = dword ptr  8
.text:005680D7 hPrevInstance   = dword ptr  0Ch
.text:005680D7 lpCmdLine       = dword ptr  10h
.text:005680D7 nShowCmd        = dword ptr  14h

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30

// allins.hpp
// x86/x64 itypes
enum
{
NN_null = 0,            // Unknown Operation
NN_aaa,                 // ASCII Adjust after Addition
NN_aad,                 // ASCII Adjust AX before Division
NN_aam,                 // ASCII Adjust AX after Multiply
NN_aas,                 // ASCII Adjust AL after Subtraction
.
.
.
NN_jz,                  // Jump if Zero (ZF=1)
NN_jmp,                 // Jump
NN_jmpfi,               // Indirect Far Jump
NN_jmpni,               // Indirect Near Jump
NN_jmpshort,            // Jump Short (not used)
NN_lahf,                // Load Flags into AH Register
.
.
.
// Pentium III Pseudo instructions
NN_cmpeqps,             // Packed Single-FP Compare EQ
NN_cmpltps,             // Packed Single-FP Compare LT
NN_cmpleps,             // Packed Single-FP Compare LE
NN_cmpunordps,          // Packed Single-FP Compare UNORD
.
.
.
}

1
2
3

# .text:00568113 jz short loc_56812E
inst = idautils.DecodeInstruction(0x00568113)
print("YES" if inst.itype == idaapi.NN_jz else "NO")

1
2
3
4
5
6
7
8
9

o_void：没有该操作数.
o_reg：该操作数是寄存器(ax,al,es,ds等等).
o_mem：直接寻址(数据).
o_phrase：[基址+变址]寻址.
o_displ：[基址+变址+偏移]寻址.
o_imm：立即数.
o_far：直接远地址(far address,代码).
o_near：直接近地址(near address,代码).
o_dispspec0...o_dispspec5：处理器相关标志.

1
2
3
4

op_reg：寄存器编号(o_reg).
op_phrase：内存访问中的索引寄存器(o_phrase).
op_value：立即数（o_imm）或偏移(o_displ).
op_addr：操作数使用的内存地址(o_mem,o_far,o_displ,o_near).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

enum RegNo
{
  R_ax = 0,
  R_cx,
  R_dx,
  R_bx,
  R_sp,
  R_bp,
  R_si,
  R_di
}

1
2
3
4
5
6
7

REG_EAX = 0
REG_EDX = 2
REG_EBP = 5
.
.
.
REG_NAMES = { REG_EAX: 'eax', REG_EDX: 'edx', REG_EBP: 'ebp' ...}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

import idc
import idautils
import idaapi

addr = idc.here()

func = idaapi.get_func(addr)
frame = idaapi.get_frame(func)
print(frame)
x = 0
dictMem = {}
while (x < frame.memqty):
    name = idc.get_member_name(frame.id, frame.get_member(x).soff)
    dictMem[name] = hex(idc.get_member_offset(frame.id, name))
    x = x + 1
print(dictMem)

1
2
3
4
5
6
7
8
9

{
'var_4': '0x0', 
' s': '0x4', 
' r': '0x8', 
'hInstance': '0xc', 
'hPrevInstance': '0x10', 
'lpCmdLine': '0x14', 
'nShowCmd': '0x18'
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

import idc
import idautils
import idaapi

addr = idc.here()

func = idaapi.get_func(addr)
frame = idaapi.get_frame(func)

ret_off = idc.get_member_offset(frame.id, " r")
first_arg_off = ret_off + 4
args_size = idc.get_struc_size(frame.id) - first_arg_off

print(args_size)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# 0x00404C90 is the function address
# 0x00404CA4 is an instruction address referencing
# a stack variable. It looks like:
# .text:00404CA4  mov     [esp+668h+StackCookie], eax
# .text:00404CBF  mov     ecx, [esp+668h+StackCookie] ; StackCookie

pFunc = idaapi.get_func(0x00404C90)
pFrame = idaapi.get_frame(pFunc)
inst = idautils.DecodeInstruction(0x00404CA4)
op = inst[0] #获取第一个操作数,注意此操作数必须有栈帧变量的引用,否则下条指令会报错
pMember.val = idaapi.get_stkvar(inst,op, op.addr) # pMember 是frame结构体中的成员,val是在frame中的偏移量

xrefs = idaapi.xreflist_t()
idaapi.build_stkvar_xrefs(xrefs, pFunc, pMember)
for xref in xrefs:
    print(hex(xref.ea)) #print xref address

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

import idc
import idautils
import idaapi

addr = idc.here()

pFunc = idaapi.get_func(addr)
pFrame = idaapi.get_frame(pFunc)

dictMem = dict()
x = 0
while (x < pFrame.memqty):
    dictMem[idc.get_member_name(
        pFrame.id,
        pFrame.get_member(x).soff)] = pFrame.get_member(x)
    x = x + 1
# given var name you can now use the
# dictionary to grab the member_t to pass
# to build_stkvar_xrefs
pMem = dictMem["hInstance"]
xrefs = idaapi.xreflist_t()
idaapi.build_stkvar_xrefs(xrefs, pFunc, pMem)
for xref in xrefs:
    print(hex(xref.ea))  #print xrefs to var_4

1
2
3
4
5
6

# 获取入口点个数
idc.get_entry_qty()
# 获取入口点地址
idc.get_entry_ordinal(index)
# 入口名
idc.get_entry_name(ordinal)

1
2

debugger = idaapi.DBG_Hooks()
debugger.hook()

1
2
3
4
5
6
7
8

# 在指定的地点设置软件断点
idc.add_bpt( long Address )
# 返回当前设置的断点数量
idc.get_bpt_qty() 
# 获取寄存器的值,dbg必须处于运行状态
idc.get_reg_value(string Register)
# 通过寄存器名获得寄存器值
idc.set_reg_Value(long Value, string Register)