IDA7.5pro IDAPython脚本整理

取数值

#起始地址
addrStart=0x6020c0
#终止地址
addrEnd=0x60213c
list1=[]
#>>2是除以4取整数
for i in range((addrEnd-addr)>>2):
    list1.append(idc.get_wide_dword(addr+4*i))
print(list1)

dump内存

import idc_bc695 as idc

def main():
    begin = 0x140003040; # 起始地址
    size = 0x34166  # 大小
    list = []
    for i in range(size):
        byte_tmp = idc.Byte(begin + i)
        list.append(byte_tmp)
        if (i + 1) % 0x1000 == 0:
            print("All count:{}, collect current:{}, has finish {}".format(hex(size), hex(i + 1), float(i + 1) / size))
    print('collect over')
    file = "LOADER2.exe" #输出文件地址+名
    buf = bytearray(list)
    with open(file, 'wb') as fw:
        fw.write(buf)
    print('write over')

if __name__=='__main__':
    main()

去除jmp花指令

#idapy去除花指令，特征值查看按键为D
import idc_bc695 as idc
addrStart=0x80487C4#请修改此处起始特征值
addrEnd=0x80488DF#请修改此处起始特征值
for i in range(addrStart,addrEnd):
    if idc.Dword(i)==0x05ebb866:#请修改此处特征值
        if idc.Dword(i+4)==0xfa74c031:#请修改此处花指令特征值
            for j in range(9):
                idc.PatchByte(i+j,0x90)
print("Done")