def realloc(ea, size, name=".newseg"):
'''Deletes the segment for which 'ea' is a part of. Re-creates it with the given size and returns its base address'''
# XXX: so, this is ghetto, but I'm going to leverage segment.alloc to create a
# new segment, steal its address, delete it, and move this segment there with a new size
new_seg = alloc(size, name)
idc.SegDelete(new_seg, True)
# move our existing segment
idc.MoveSegm(ea, new_seg, True)
# change its bounds
idc.SetSegBounds(new_seg, new_seg, new_seg + size, True)
return new_seg
def expand_segment(ea):
""" Expand last segment so it can hold more MSDN argument information.
Argument:
ea -- effective address within last segment
"""
start = idc.SegStart(ea)
end = idc.SegEnd(ea)
if end != get_end_of_last_segment():
raise FailedToExpandSegmentException('Can only expand last segment.')
if start == idaapi.BADADDR or end == idaapi.BADADDR:
raise FailedToExpandSegmentException('Invalid start or end address.')
new_end = end + NEW_SEGMENT_SIZE / 2
if not idc.SetSegBounds(ea, start, new_end, idaapi.SEGMOD_KEEP):
raise FailedToExpandSegmentException('Setting segment bounds failed.')
def set_bound(self, startea=None, endea=None, flags=idc.SEGMOD_KEEP):
"""
Change segment boundaries
@param ea: any address in the segment
@param startea: new start address of the segment
@param endea: new end address of the segment
@param flags: combination of SEGMOD_... flags
@return: boolean success
"""
if startea is None:
startea = self.start
if endea is None:
endea = self.end
return idc.SetSegBounds(self.start, startea, endea, flags)
def MbrLoader():
"""
This small routine loads the MBR into IDA
It acts as a custom file loader (written with a script)
"""
import idaapi;
import idc;
global SECTOR_SIZE, BOOT_START, BOOT_SIZE, BOOT_END, SECTOR2, MBRNAME
# wait till end of analysis
idc.Wait()
# adjust segment
idc.SetSegBounds(BOOT_START, BOOT_START, BOOT_START + BOOT_SIZE, idaapi.SEGMOD_KEEP)
# load the rest of the MBR
idc.loadfile(MBRNAME, SECTOR_SIZE, SECTOR2, SECTOR_SIZE)
# Make code
idc.AnalyzeArea(BOOT_START, BOOT_END)