2021-1-19(idapython学习 主要是)

主要学习了下idapython,理解夜影师傅的去花指令脚本(正则nb)
idapython脚本学习:
https://gitee.com/it-ebooks/it-ebooks-2018-04to07/raw/master/IDAPython%20%E5%88%9D%E5%AD%A6%E8%80%85%E6%8C%87%E5%8D%97.pdf

for segs in idautils.Segments():
    print idc.SegName(seg),idc.SegStart(seg),idc.SegEnd(seg)

遍历每个段的地址 和初始地址

for func in idautils.Functions():
   print hex(func),idc.GetFunctionName(func)

遍历函数

ea = here()
start = idc.GetFunctionAttr(ea,FUNCATTER_START)
end = idc.GetFunctionAttr(ea,FUNCATTER_END)
cur_addr = start
while cur_addr <=end:
  print hex(cur_addr),idc.GetDiasm(cur_addr)
  cur_addr = idc.NextHead(cur_addr,end)
 

打印函数
idautils.FuncItems(here())
一个函数的所有指令的地址

import idautils
import idaapi
displace = {}
# for each known function
for func in idautils.Functions():
flags = idc.GetFunctionFlags(func)
# skip library & thunk functions
 if flags & FUNC_LIB or flags & FUNC_THUNK:
  continue
 dism_addr = list(idautils.FuncItems(func))
 for curr_addr in dism_addr:
  op = None
  index = None
# same as idc.GetOptype, just a different way of accessing the types
 idaapi.decode_insn(curr_addr)
if idaapi.cmd.Op1.type == idaapi.o_displ:
 op = 1
if idaapi.cmd.Op2.type == idaapi.o_displ:
 op = 2
if op == None:
 continue
if "bp" in idaapi.tag_remove(idaapi.ua_outop2(curr_addr,0)) or \
"bp" in idaapi.tag_remove(idaapi.ua_outop2(curr_addr, 1)):
# ebp will return a negative number
 if op == 1:
  index = (~(int(idaapi.cmd.Op1.addr) - 1) &0xFFFFFFFF)
 else:
  index = (~(int(idaapi.cmd.Op2.addr) - 1) &0xFFFFFFFF)
else:
if op == 1:
index = int(idaapi.cmd.Op1.addr)
else:
index = int(idaapi.cmd.Op2.addr)
# create key for each unique displacement value
if index:
if displace.has_key(index) == False:
displace[index] = []
displace[index].append(curr_addr)

获得对应偏移(某种结构)的地址

第二脚本就非常有用了
它可以将内存的偏移化成偏移处的字符串

-2-

min = MinEA()
max = MaxEA()
for func in idautils.Functions():
     flags = idc.GetFunctionFlags(func)
     if flags & FUNC_LIB or flags & FUNC_THUNK:
        continue
     disasm_addr = list(idautils.FuncItems(func))
     for cur_addr in disasm_addr:
        if idc.GetOpType(cur_addr,0) == 5 and (min < idc.GetOperandValue(cur_addr,0) < max ):
           idc.OpOff(cur_addr,0,0)
        if idc.GetOpType(cur_addr,1) == 5 and (min < idc.GetOperandValue(cur_addr,1) < max ):
           idc.OpOff(cur_addr,1,0)

后面感觉没什么用，都没写了，其他ida都可以手动点
idc.Byte(ea)
idc.Word(ea)
idc.Dword(ea)
idc.Qword(ea) 获得原始数据
idc.PatchByte(ea,value)
idc.PatchWord(ea,value)
idc,PatchDord(ea,value)
android逆向
把dalivk的指令看完了，，，感觉还行
明日计划：
看第4章(之后 没有比赛得全学安卓,tcl,进度太慢了)