def add_func(self, addy, attrs={}):
#get some function info
func = self.provider.funcStart(addy)
if attrs == {}:
props = analysis.properties(addy)
attrs = props.funcProps()
addy_info = {'attr': attrs, 'parents': [], 'children': []}
if (not func):
# probably an import
#print "[I] Dealing with a likely import (0x%08x) in RefTree.py" % addy
pass
else:
addy = func
for p in self.xrefs_to(addy):
#print "xrefs_to includes 0x%08x" % p
#Only add parent if parent already in dict
if p in self.function_data:
if (not p in addy_info['parents']):
addy_info['parents'].append(p)
if (not addy in self.function_data[p]['children']):
self.function_data[p]['children'].append(addy)
#else:
#print "p is NOT in our self.function_data"
for c in self.xrefs_from(addy):
#Check to see if child is in function_data
if c in self.function_data:
#update child info
if (not addy in self.function_data[c]['parents']):
self.function_data[c]['parents'].append(addy)
if (not c in addy_info['children']):
addy_info['children'].append(c)
if not self.function_data.has_key(addy):
self.function_data[addy] = addy_info
def add_func(self, addy, attrs={}):
#get some function info
func = self.provider.funcStart(addy)
if attrs == {}:
props = analysis.properties(addy)
attrs = props.funcProps()
addy_info = {'attr' : attrs, 'parents' : [], 'children' : []}
if(not func):
# probably an import
#print "[I] Dealing with a likely import (0x%08x) in RefTree.py" % addy
pass
else:
addy = func
for p in self.xrefs_to(addy):
#print "xrefs_to includes 0x%08x" % p
#Only add parent if parent already in dict
if p in self.function_data:
if(not p in addy_info['parents']):
addy_info['parents'].append(p)
if(not addy in self.function_data[p]['children']):
self.function_data[p]['children'].append(addy)
#else:
#print "p is NOT in our self.function_data"
for c in self.xrefs_from(addy):
#Check to see if child is in function_data
if c in self.function_data:
#update child info
if(not addy in self.function_data[c]['parents']):
self.function_data[c]['parents'].append(addy)
if(not c in addy_info['children']):
addy_info['children'].append(c)
if not self.function_data.has_key(addy):
self.function_data[addy] = addy_info
def __init__(self, options):
self.options = options
self.provider = ida.IDA()
self.function_data = {}
self.proc = self.provider.getArch()
self.jmp_mnem = ""
if self.proc == "pc":
self.call_mnem = "call"
self.jmp_mnem = "jmp"
elif self.proc == "arm" or self.proc == "ppc":
self.call_mnem = "bl"
elif self.proc == "mips":
self.call_mnem = "jalr"
all_funcs = database.functions()
if self.proc == "pc":
# XXX: hackish way to fix a crap ton of stuff...
start = self.provider.segByBase(self.provider.segByName(".text"))
end = self.provider.segEnd(
self.provider.segByBase(self.provider.segByName(".text")))
succeeded = 0
for instr in self.provider.iterInstructions(start, end):
disasm = self.provider.getDisasm(instr)
tokens = disasm.split(" ")
res = []
for t in tokens:
if len(t) != 0:
res.append(t)
prologues = [['mov', 'edi,', 'edi'], ['push', 'ebp'],
['push', 'rbp']]
if res in prologues and instr not in all_funcs:
try:
prev_ea = self.provider.prevItem(instr, instr - 0x20)
if prev_ea not in all_funcs:
if options['verbosity'] > 2:
print "[!] Attempting to create a function at 0x%08x" % instr
ret = self.provider.makeFunc(instr)
else:
continue
if ret:
if options['verbosity'] > 2:
print "[*] Successfully made new function at 0x%08x" % instr
succeeded += 1
except Exception as detail:
pass
elif "dup(90h)" in disasm:
if options['verbosity'] > 2:
print "Found dup at 0x%08x" % instr
try:
next_ea = self.provider.nextItem(instr, instr + 0x20)
if next_ea not in all_funcs:
ret = self.provider.nextItem(next_ea, 0xFFFFFFFF)
else:
continue
if not ret and (next_ea in database.functions()):
if options['verbosity'] > 2:
print "[*] Successfully made new function at 0x%08x" % next_ea
succeeded += 1
except:
pass
if succeeded != 0:
print "[*] Successfully created %d new functions" % succeeded
print "[*] There are %d functions to process" % len(all_funcs)
failed = 0
succeeded = 0
for i in xrange(0, len(all_funcs)):
i_actual = i + 1
ea = all_funcs[i]
if ((i_actual % 250 == 0) or (i == len(all_funcs) - 1)):
print "[*] RefTree.py: Processing 0x%08x (%d of %d)" % (
ea, i_actual, len(all_funcs))
props = analysis.properties(ea)
func_props = props.funcProps()
try:
self.add_func(ea, func_props)
succeeded += 1
except Exception as detail:
raise
except ValueError as detail:
failed += 1
if options['verbosity'] > 2:
print "0x%08x - failed to process node, %s" % (ea, detail)
print "[*] Failed to process %d functions" % failed
print "[*] Successfully processed %d functions" % succeeded
# now loop imports
segs = list(self.provider.getSegments())
if self.proc in ["arm", "ppc", "mips"]:
idata = "extern"
elif self.proc == "pc":
idata = ".idata"
for s in segs:
if self.provider.segName(s) == idata:
start = s
end = self.provider.segEnd(s)
for head in self.provider.iterData(start, end):
try:
self.add_func(head)
except Exception:
raise
def __init__(self, options):
self.options = options
self.provider = ida.IDA()
self.function_data = {}
self.proc = self.provider.getArch()
self.jmp_mnem = ""
if self.proc == "pc":
self.call_mnem = "call"
self.jmp_mnem = "jmp"
elif self.proc == "arm" or self.proc == "ppc":
self.call_mnem = "bl"
elif self.proc == "mips":
self.call_mnem = "jalr"
all_funcs = database.functions()
if self.proc == "pc":
# XXX: hackish way to fix a crap ton of stuff...
start = self.provider.segByBase(self.provider.segByName(".text"))
end = self.provider.segEnd(self.provider.segByBase(self.provider.segByName(".text")))
succeeded = 0
for instr in self.provider.iterInstructions(start, end):
disasm = self.provider.getDisasm(instr)
tokens = disasm.split(" ")
res = []
for t in tokens:
if len(t) != 0:
res.append(t)
prologues = [['mov', 'edi,', 'edi'], ['push', 'ebp'], ['push', 'rbp']]
if res in prologues and instr not in all_funcs:
try:
prev_ea = self.provider.prevItem(instr, instr-0x20)
if prev_ea not in all_funcs:
if options['verbosity'] > 2:
print "[!] Attempting to create a function at 0x%08x" % instr
ret = self.provider.makeFunc(instr)
else:
continue
if ret:
if options['verbosity'] > 2:
print "[*] Successfully made new function at 0x%08x" % instr
succeeded += 1
except Exception as detail:
pass
elif "dup(90h)" in disasm:
if options['verbosity'] > 2:
print "Found dup at 0x%08x" % instr
try:
next_ea = self.provider.nextItem(instr, instr+0x20)
if next_ea not in all_funcs:
ret = self.provider.nextItem(next_ea, 0xFFFFFFFF)
else:
continue
if not ret and (next_ea in database.functions()) :
if options['verbosity'] > 2:
print "[*] Successfully made new function at 0x%08x" % next_ea
succeeded += 1
except:
pass
if succeeded != 0:
print "[*] Successfully created %d new functions" % succeeded
print "[*] There are %d functions to process" % len(all_funcs)
failed = 0
succeeded = 0
for i in xrange(0, len(all_funcs)):
i_actual = i+1
ea = all_funcs[i]
if ((i_actual % 250 == 0) or (i == len(all_funcs)-1)):
print "[*] RefTree.py: Processing 0x%08x (%d of %d)" % (ea, i_actual, len(all_funcs))
props = analysis.properties(ea)
func_props = props.funcProps()
try:
self.add_func(ea, func_props)
succeeded += 1
except Exception as detail:
raise
except ValueError as detail:
failed += 1
if options['verbosity'] > 2:
print "0x%08x - failed to process node, %s" % (ea, detail)
print "[*] Failed to process %d functions" % failed
print "[*] Successfully processed %d functions" % succeeded
# now loop imports
segs = list(self.provider.getSegments())
if self.proc in ["arm", "ppc", "mips"]:
idata = "extern"
elif self.proc == "pc":
idata = ".idata"
for s in segs:
if self.provider.segName(s) == idata:
start = s
end = self.provider.segEnd(s)
for head in self.provider.iterData(start, end):
try:
self.add_func(head)
except Exception:
raise