def import_to_structures(self, ask=False): """ Imports virtual tables and returns tid_t of new structure :return: idaapi.tid_t """ cdecl_typedef = idaapi.print_tinfo( None, 4, 5, idaapi.PRTYPE_MULTI | idaapi.PRTYPE_TYPE | idaapi.PRTYPE_SEMI, self.create_tinfo(), self.vtable_name, None) if ask: cdecl_typedef = idaapi.ask_text( 0x10000, cdecl_typedef, "The following new type will be created") if not cdecl_typedef: return previous_ordinal = idaapi.get_type_ordinal(idaapi.cvar.idati, self.vtable_name) if previous_ordinal: idaapi.del_numbered_type(idaapi.cvar.idati, previous_ordinal) ordinal = idaapi.idc_set_local_type(previous_ordinal, cdecl_typedef, idaapi.PT_TYP) else: ordinal = idaapi.idc_set_local_type(-1, cdecl_typedef, idaapi.PT_TYP) if ordinal: print("[Info] Virtual table " + self.vtable_name + " added to Local Types") return idaapi.import_type(idaapi.cvar.idati, -1, self.vtable_name) else: print("[Error] Failed to create virtual table " + self.vtable_name) print("*" * 100) print(cdecl_typedef) print("*" * 100)
def import_struct(self): if self.has_name_collisions(): self.resolve_name_collisions() cdecl_typedef = '#pragma pack(push, 1)\n' + idaapi.print_tinfo( None, 4, 5, idaapi.PRTYPE_MULTI | idaapi.PRTYPE_TYPE | idaapi.PRTYPE_SEMI, self.tinfo, self.name, None) previous_ordinal = idaapi.get_type_ordinal(idaapi.cvar.idati, self.name) if previous_ordinal: idaapi.del_numbered_type(idaapi.cvar.idati, previous_ordinal) ordinal = idaapi.idc_set_local_type(previous_ordinal, cdecl_typedef, idaapi.PT_TYP) else: ordinal = idaapi.idc_set_local_type(-1, cdecl_typedef, idaapi.PT_TYP) if ordinal: self.ordinal = ordinal print 'Imported struct \'%s\', ordinal %#x' % (self.name, self.ordinal) return idaapi.import_type(idaapi.cvar.idati, -1, self.name) else: print 'Error due importing struct \'%s\', ordinal %#x' % ( self.name, ordinal) return idaapi.BADNODE
def build_structure_in_ida(udt_data, structure_name): # 结构体的创建 final_tinfo = idaapi.tinfo_t() final_tinfo.create_udt(udt_data, idaapi.BTF_STRUCT) cdecl = idaapi.print_tinfo( None, 4, 5, idaapi.PRTYPE_MULTI | idaapi.PRTYPE_TYPE | idaapi.PRTYPE_SEMI, final_tinfo, structure_name, None) print cdecl # cdecl = "struct Test_Python_Type{int filed_1;};" # structure_name = idaapi.idc_parse_decl(idaapi.cvar.idati, cdecl, idaapi.PT_TYP)[0] # 先删除 # tid = idaapi.del_numbered_type(idaapi.cvar.idati, struct_ordinal) # print tid # struct_ordinal = 21 previous_ordinal = idaapi.get_type_ordinal(idaapi.cvar.idati, structure_name) if previous_ordinal: struct_ordinal = previous_ordinal # 如果之前的编号存在,则删除编号,重新创建 idaapi.del_numbered_type(idaapi.cvar.idati, previous_ordinal) # 创建type tid = idaapi.idc_set_local_type(struct_ordinal, cdecl, idaapi.PT_TYP) # print tid else: tid = idaapi.idc_set_local_type(-1, cdecl, idaapi.PT_TYP)
def pack(self, start=0, stop=None): if self.collisions[start:stop].count(True): print "[Warning] Collisions detected" return final_tinfo = idaapi.tinfo_t() udt_data = idaapi.udt_type_data_t() origin = self.items[start].offset if start else 0 offset = origin for item in filter(lambda x: x.enabled, self.items[start:stop]): # Filter disabled members gap_size = item.offset - offset if gap_size: udt_data.push_back(TemporaryStructureModel.get_padding_member(offset - origin, gap_size)) if item.is_array: array_size = self.calculate_array_size(bisect.bisect_left(self.items, item)) if array_size: udt_data.push_back(item.get_udt_member(array_size, offset=origin)) offset = item.offset + item.size * array_size continue udt_data.push_back(item.get_udt_member(offset=origin)) offset = item.offset + item.size final_tinfo.create_udt(udt_data, idaapi.BTF_STRUCT) cdecl = idaapi.print_tinfo(None, 4, 5, idaapi.PRTYPE_MULTI | idaapi.PRTYPE_TYPE | idaapi.PRTYPE_SEMI, final_tinfo, self.structure_name, None) cdecl = idaapi.asktext(0x10000, '#pragma pack(push, 1)\n' + cdecl, "The following new type will be created") if cdecl: structure_name = idaapi.idc_parse_decl(idaapi.cvar.idati, cdecl, idaapi.PT_TYP)[0] previous_ordinal = idaapi.get_type_ordinal(idaapi.cvar.idati, structure_name) if previous_ordinal: reply = QtGui.QMessageBox.question( None, "HexRaysPyTools", "Structure already exist. Do you want to overwrite it?", QtGui.QMessageBox.Yes | QtGui.QMessageBox.No ) if reply == QtGui.QMessageBox.Yes: idaapi.del_numbered_type(idaapi.cvar.idati, previous_ordinal) ordinal = idaapi.idc_set_local_type(previous_ordinal, cdecl, idaapi.PT_TYP) else: return else: ordinal = idaapi.idc_set_local_type(-1, cdecl, idaapi.PT_TYP) if ordinal: print "[Info] New type {0} was added to Local Types".format(structure_name) tid = idaapi.import_type(idaapi.cvar.idati, -1, structure_name) if tid: tinfo = idaapi.create_typedef(structure_name) ptr_tinfo = idaapi.tinfo_t() ptr_tinfo.create_ptr(tinfo) for scanned_var in self.get_unique_scanned_variables(origin): scanned_var.apply_type(ptr_tinfo) return tinfo else: print "[ERROR] Structure {0} probably already exist".format(structure_name)
def import_structure(name, tinfo): cdecl_typedef = idaapi.print_tinfo(None, 4, 5, idaapi.PRTYPE_MULTI | idaapi.PRTYPE_TYPE | idaapi.PRTYPE_SEMI, tinfo, name, None) if idc.parse_decl(cdecl_typedef, idaapi.PT_TYP) is None: return 0 previous_ordinal = idaapi.get_type_ordinal(idaapi.cvar.idati, name) if previous_ordinal: idaapi.del_numbered_type(idaapi.cvar.idati, previous_ordinal) ordinal = idaapi.idc_set_local_type(previous_ordinal, cdecl_typedef, idaapi.PT_TYP) else: ordinal = idaapi.idc_set_local_type(-1, cdecl_typedef, idaapi.PT_TYP) return ordinal