使用场景:
IDA Python做指令统计时,如果对应的函数比较大,这个时候不好查看汇编代码,这个时候就可以借助IDA python脚本来辅助分析了;
代码演示:
def get_func_info():
global ea
ea = idc.ScreenEA()
print idc.GetFunctionName(ea)
func = idaapi.get_func(ea) #get function proc near and endp
print type(func)
print "Start: 0x%x, End: 0x%x" % (func.startEA,func.endEA)
print "the prev function is :%x" % idc.PrevFunction(ea)
print "the next function is :%x" % idc.NextFunction(ea)
start = idc.GetFunctionAttr(ea, FUNCATTR_START)
end = idc.GetFunctionAttr(ea, FUNCATTR_END)
cur_addr = start
while cur_addr <= end:
print hex(cur_addr), idc.GetDisasm(cur_addr), idc.GetOpType(cur_addr,0)
cur_addr = idc.NextHead(cur_addr, end) #get next instruction addr
def main():
get_func_info()
if __name__ == "__main__":
main()
利用 idc .ScreenEA() 函数或者 here()来获取当前地址,func.startEA,func.endEAidaapi.get_func(ea) 返回一个 idaapi.func_t 的类给我们,然后获取此函数的前一个函数和后一个函数,start 和 end拿到函数的起始地址和结束地址,然后从函数起始地址开始反汇编并获取opttype;
效果展示:
sub_FFFFFFFF8150D090
<class 'ida_funcs.func_t'>
Start: 0xffffffff8150d090, End: 0xffffffff8150d0d3
the prev function is :ffffffff8150cf21
the next function is :ffffffff8150d0d8
0xffffffff8150d090L push rbp 1
0xffffffff8150d091L mov rbp, rsp 1
0xffffffff8150d094L sub rsp, 50h 1
0xffffffff8150d098L call nullsub_1 7
0xffffffff8150d09dL lea rax, [rbp+arg_0] 1
0xffffffff8150d0a1L mov [rbp+var_28], rsi 4
0xffffffff8150d0a5L lea rsi, [rbp+var_50] 1
0xffffffff8150d0a9L mov [rbp+var_20], rdx 4
0xffffffff8150d0adL mov [rbp+var_18], rcx 4
0xffffffff8150d0b1L mov [rbp+var_48], rax 4
0xffffffff8150d0b5L lea rax, [rbp+var_30] 1
0xffffffff8150d0b9L mov [rbp+var_10], r8 4
0xffffffff8150d0bdL mov [rbp+var_8], r9 4
0xffffffff8150d0c1L mov [rbp+var_50], 8 4
0xffffffff8150d0c8L mov [rbp+var_40], rax 4
0xffffffff8150d0ccL call sub_FFFFFFFF8106EFF0 7
0xffffffff8150d0d1L leave 0
0xffffffff8150d0d2L retn 0