Python idautils.Functions方法代码示例

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def main():
    print 'Start'
    ans = ida_kernwin.ask_yn(0, 'define only selected function?')
    if ans:
        va = ScreenEA()
        fva = get_function(va)
        print('-' * 80)
        rule = create_yara_rule_for_function(fva)
        if rule:
            print(rule)
            if test_yara_rule(rule):
                logging.info('success: validated the generated rule')
            else:
                logging.error('error: failed to validate generated rule')
    else:
        for fva in idautils.Functions():
            print('-' * 80)
            rule = create_yara_rule_for_function(fva)
            if rule:
                print(rule)
    print 'Done' 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def find_dispatch_by_struct_index():
    """Attempts to locate the dispatch function based off it being loaded in a structure
    at offset 70h, based off of https://github.com/kbandla/ImmunityDebugger/blob/master/1.73/Libs/driverlib.py """
    
    out = set()
    for function_ea in idautils.Functions():
        flags = idc.get_func_flags(function_ea)
        # skip library functions
        if flags & idc.FUNC_LIB:
            continue
        func = idaapi.get_func(function_ea)
        addr = func.startEA
        while addr < func.endEA:
            if idc.GetMnem(addr) == 'mov':
                if '+70h' in idc.GetOpnd(addr, 0) and idc.GetOpType(addr, 1) == 5:
                    out.add(idc.GetOpnd(addr, 1))
            addr = idc.NextHead(addr)
    return out 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def get_boot_services(self):
        """found boot services in idb"""
        code = list(idautils.Functions())[0]
        start = idc.get_segm_start(code)
        end = idc.get_segm_end(code)
        ea = start
        while (ea <= end):
            if idc.print_insn_mnem(ea) != 'call':
                ea = idc.next_head(ea)
                continue
            for service_name in self.BOOT_SERVICES_OFFSET:
                # yapf: disable
                if (idc.get_operand_value(ea, 0) == self.BOOT_SERVICES_OFFSET[service_name]):
                    if not self.gBServices[service_name].count(ea):
                        self.gBServices[service_name].append(ea)
            ea = idc.next_head(ea) 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def _rename_functions(self):
        '''Rename functions.'''

        print "IPL: Started to rename functions..."

        failed = 0
        total = 0
        for function in idautils.Functions():
            total += 1
            pdb_mangled_name = self.PDBLookup.lookup(function, True)
            if not pdb_mangled_name:
                failed += 1
                print "IPL: Failed to find symbol for function: 0x{:08x}".format(function)
                continue
            _, mangled_function_name = pdb_mangled_name.split('!')
            # https://www.hex-rays.com/products/ida/support/idadoc/203.shtml
            idc.MakeNameEx(function, mangled_function_name,
                           idc.SN_AUTO | idc.SN_NOCHECK)
        print "IPL: Total {} functions, {} failed to rename.".format(total, failed) 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def calc_file_version_hash():
    version_obj = []
    version_obj.append(('functions', [(offset, list(idautils.Chunks(offset)))
                                        for offset in idautils.Functions()]))
    # TODO: This is a little hackish way of getting the version of all vectors
    # of an instance. cannot make version a classmethod because vector sets are
    # only built by __init__ methods
    func_vector_versions = FunctionInstance(None, None).version()
    version_obj.append(('function_vector_versions', func_vector_versions))
    # TODO: Add function annotations as part of the version, because they're
    # also changing.
    # TODO: Add universal instance related versions

    version_str = repr(version_obj)
    version_hash = hashlib.md5(version_str).hexdigest()

    log('upload_action').info("file version string: %s", version_str)
    log('upload_action').info("file version hash: %s", version_hash)
    return version_hash 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def generate_graph():
	callees = dict()

	# Loop through all the functions in the binary
	for function_ea in idautils.Functions():

		f_name = GetFunctionName(function_ea)
		# For each of the incoming references
		for ref_ea in CodeRefsTo(function_ea, 0):
		
			# Get the name of the referring function
			caller_name = GetFunctionName(ref_ea)
			
			# Add the current function to the list of functions
			# called by the referring function
			callees[caller_name] = callees.get(caller_name, Set())

			callees[caller_name].add(f_name)
	return callees

#Visit functions called by our starting point recursively 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def getFuncRanges(ea, doAllFuncs):
    if using_ida7api:
        return getFuncRanges_ida7(ea, doAllFuncs)
    if doAllFuncs:
        funcs = []
        funcGen = idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea))
        for i in funcGen:
            funcs.append(i)
        funcRanges = []
        for i in range(len(funcs) - 1):
            funcRanges.append( (funcs[i], funcs[i+1]) )
        funcRanges.append( (funcs[-1], idc.SegEnd(ea)) )
        return funcRanges
    else:
        #just get the range of the current function
        fakeRanges = [( idc.GetFunctionAttr(idc.here(), idc.FUNCATTR_START), idc.GetFunctionAttr(idc.here(), idc.FUNCATTR_END)), ]
        return fakeRanges 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def set_start_stop(self, ftype):
        assert_ida_available()
        import idc
        import idaapi
        import idautils
        fun_mapping = {idc.GetFunctionName(x): (idaapi.get_func(x).startEA, idaapi.get_func(x).endEA-1)
                       for x in idautils.Functions()}
        start = idc.BeginEA()
        stop = 0
        if ftype == PE:
            start, stop = fun_mapping["start"]
        else:
            if not idc.isCode(idc.GetFlags(start)):
                if idc.MakeCode(start) == 0:
                    print "Fail to decode instr !"
                idaapi.autoWait()
            if idc.GetFunctionName(start) == "":
                if idc.MakeFunction(start) == 0:
                    print "Fail to create function !"
                idaapi.autoWait()
                fun_mapping = {idc.GetFunctionName(x): (idaapi.get_func(x).startEA, idaapi.get_func(x).endEA-1)
                               for x in idautils.Functions()}

            if "main" in fun_mapping:
                start, stop = fun_mapping["main"]
            elif "start" in fun_mapping:
                if "__libc_start_main" in fun_mapping:
                    instrs = list(idautils.FuncItems(fun_mapping["start"][0]))
                    instrs.reverse()
                    for inst in instrs:
                        arg1 = idc.GetOperandValue(inst, 0)
                        if idc.GetMnem(inst) == "push":
                            start, stop = arg1, fun_mapping["start"][1]
                            break
                else:
                    start, stop = fun_mapping["start"]
        self.config.start, self.config.stop = start, stop 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def process_program(self):
        funs = list(idautils.Functions())
        nb = len(funs)
        for i, fun in zip(xrange(nb), funs):
            self.process_routine(fun, rtn_i=i+1, total_rtn=nb)
            if self.STOP:
                return 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def update_mapping(self):
        pass
        self.fun_mapping = {idc.GetFunctionName(x): (idaapi.get_func(x).startEA, idaapi.get_func(x).endEA-1) for x in
                            idautils.Functions()}
        self.seg_mapping = {idc.SegName(x): (idc.SegStart(x), idc.SegEnd(x)) for x in idautils.Segments()} 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def available_funcs(self):
        return map(lambda x:"0x%x" % x, idautils.Functions()) 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def abi(self):
        """Return the IDA guessed ABI
        """

        architecture = self.architecture

        available_abis = self.IDAABI2SibylABI.get(architecture, None)
        if not available_abis:
            raise ValueError("No ABI available for architecture %s" % architecture)

        if isinstance(available_abis, str):
            return available_abis

        # Search for IDA guessed type
        for func_addr in idautils.Functions():
            gtype = idc.GuessType(func_addr)
            if gtype is None:
                continue
            match = self.gtype_matcher.match(gtype)
            if match is None:
                continue
            calling_conv = match.group(1)
            abi = available_abis.get(calling_conv, None)
            if abi is None:
                raise ValueError("No ABI matching %s" % calling_conv)
            return abi
        raise ValueError("Unable to guess ABI") 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def find_dispatch_by_cfg():
    """ 
    Finds the functions in the binary which are not directly called anywhere and counts how many other functions they call,
    returing all functions which call > 0 other functions but are not called themselves. As a dispatch function is not normally directly
    called but will normally many other functions this is a fairly good way to guess which function it is.
    """
        
    out = []
    called = set()
    caller = dict()
    # Loop through all the functions in the binary
    for function_ea in idautils.Functions():
        flags = idc.get_func_flags(function_ea)
        # skip library functions
        if flags & idc.FUNC_LIB:
            continue
        f_name = idc.GetFunctionName(function_ea)
        # For each of the incoming references
        for ref_ea in idautils.CodeRefsTo(function_ea, 0):
            called.add(f_name)
            # Get the name of the referring function
            caller_name = idc.GetFunctionName(ref_ea)
            if caller_name not in caller.keys():
                caller[caller_name] = 1
            else:
                caller[caller_name] += 1
    while True:
        if len(caller.keys()) == 0:
            break
        potential = max(caller, key=caller.get)
        if potential not in called:
            out.append(potential)
        del caller[potential]
    return out 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def functionsInner(self):
        """Create a collection / generator of all of the functions in the program (will be called only once).

        Return Value:
            collection of all of the functions in the program
        """
        return idautils.Functions()

    # Overridden base function 

# 需要导入模块: import idautils [as 别名]
# 或者: from idautils import Functions [as 别名]
def hook_lib_funcs():
    from angrdbg import load_project
    project = load_project()
    for func in idautils.Functions():
        flags = idc.GetFunctionFlags(func)
        if flags & idc.FUNC_LIB:
            name = idc.GetFunctionName(func)
            simproc = search_simproc(name)
            if simproc is not None:
                print name, simproc
                project.hook_symbol(func, simproc())