Exemple #1
0
def define_functions():
    ea = 0x10000000
    unknown = idc.FindUnexplored(ea, idc.SEARCH_DOWN)
    while unknown != idc.BADADDR and unknown < 0x11000000:
        insn = idc.Dword(unknown)
        if insn & 0xF0000000 == 0xE0000000 and unknown & 3 == 0 and idc.MakeCode(
                unknown) == 4:
            print "Trying %x" % unknown
            if idc.MakeFunction(unknown):
                print "Success"
            else:
                unknown += 4
            unknown = idc.FindUnexplored(unknown, idc.SEARCH_DOWN)
        else:
            unknown += 4
            unknown = idc.FindUnexplored(unknown, idc.SEARCH_DOWN)
Exemple #2
0
def map_shared_bridges(dsc_file, adrfind):
    """ finds branch islands in a given dyld_shared_cache file,
        maps them to IDA's db and extract its addresses """
    dsc_file.seek(0, 2)
    filesize = dsc_file.tell()
    dsc_file.seek(0)
    ACCESS_READ = 1
    a = mmap.mmap(dsc_file.fileno(), length=filesize, access=ACCESS_READ)
    reexp = re.compile(
        "\xcf\xfa\xed\xfe.{340,360}dyld_shared_cache_branch_islands")
    print "[+] scanning dsc for BRANCH ISLANDS"
    # this list will hold all our branch_islands segments
    branch_islands_segments = []
    jmp_to_code = collections.defaultdict(list)
    for ma in reexp.finditer(a):
        print "[+] WRITING BRANCH ISLAND: 0x%08X" % (ma.start())
        fif = FileInFile(dsc_file, ma.start())
        m = MachO_patched(fif)
        if _IN_IDA:
            for seg in m.segments:
                for sec in seg.sections:
                    idc.AddSegEx(sec.addr, sec.addr + sec.size, 0, 0,
                                 idaapi.saRelPara, idaapi.scPub,
                                 idc.ADDSEG_FILLGAP)
                    name = "branch_islands_%X%s%s" % (ma.start(), seg.segname,
                                                      sec.sectname)
                    idc.RenameSeg(sec.addr, name)
                    idc.SetSegClass(sec.addr, "CODE")
                    idc.SetSegAddressing(sec.addr, 2)
                    dsc_file.seek(sec.offset)
                    memcpy(sec.addr, dsc_file.read(sec.size))
                    branch_islands_segments.append(sec.addr)
                    # make code
                    codeea = sec.addr
                    print "Going through the code!"
                    while codeea < (sec.addr + sec.size):
                        res = idc.MakeCode(codeea)
                        if not res:
                            print "[!] EA:0x%X ERR while making code" % codeea
                            codeea += 4
                            continue

                        d = idc.GetDisasm(codeea)
                        # if it's a "B     0x4dd13550"
                        if d.startswith("B "):
                            addr = d.split()[1]
                            if addr.startswith("0x"):
                                branchaddr = int(addr, 16)
                                jmp_to_code[branchaddr].append(codeea)
                                #   idc.MakeRptCmt(codeea, "0x%X was taken!" % branchaddr)

                        codeea = idc.FindUnexplored(codeea, idc.SEARCH_DOWN)
    label_and_fix_branch_islands(dsc_file, adrfind, jmp_to_code)
Exemple #3
0
import idautils
import idc

for ea in idautils.Segments():

    segend = idc.GetSegmentAttr(ea, idc.SEGATTR_END)
    start = ea
    while start < segend:
        idc.MakeCode(start)
        start = idc.FindUnexplored(start + 1, idc.SEARCH_DOWN)

idc.GenerateFile(idc.OFILE_ASM, idc.GetInputFile() + ".asm", 0, idc.BADADDR, 0)

idc.Exit(0)

# Here it is. Run it with idal -c -A -S./script.py ./test.bin
Exemple #4
0
print hex(ea), idc.GetDisasm(ea)
addr = idc.FindCode(ea, SEARCH_DOWN | SEARCH_NEXT)
print hex(addr), idc.GetDisasm(addr)

# idc.FindData(ea, flag) 该函数用于寻找被标记为数据的下一个地址.
# 0x1000020b6L movzx   eax, word ptr [r12+2]
# 0x100001cccL db 8 dup(0CCh)
ea = here()
print hex(ea), idc.GetDisasm(ea)
addr = idc.FindData(ea, SEARCH_UP | SEARCH_NEXT)
print hex(addr), idc.GetDisasm(addr)

# idc.FindUnexplored(ea, flag) 该函数用于查找IDA未识别为代码或者数据的字节地址. 未知类型需要通过观察或者脚本进一步分析
ea = here()
print hex(ea), idc.GetDisasm(ea)
addr = idc.FindUnexplored(ea, SEARCH_DOWN)
print hex(addr), idc.GetDisasm(addr)

# idc.FindExplored(ea, flag) 用于查找IDA标识为代码或者数据的地址
ea = here()
addr = idc.FindExplored(ea, SEARCH_UP)
print hex(addr), idc.GetDisasm(addr)

for xref in idautils.XrefsTo(addr, 1):
    print hex(xref.frm), idc.GetDisasm(xref.frm)

# idc.FindImmediate(ea, flag, value) 用于寻找确定的数值  例如rand()函数使用的随机种子
addr = idc.FindImmediate(MinEA(), SEARCH_DOWN, 0x343FD)
print "0x%x %s %x" % (addr[0], idc.GetDisasm(addr[0]), addr[1])

# 查找所有的指定立即数
Exemple #5
0
def find_a():
    ea = ida_ida.inf_get_min_ea()
    while ea < max_addr:
        ea = idc.FindUnexplored(ea, idc.SEARCH_DOWN)
        ida_funcs.add_func(ea)