idapython函数学习笔记

记录一波idapython的学习，加深印象，之后找起来也方便。

长期更新

ida_bytes

patch_byte(一次patch一个byte)

第一个参数是起始地址，第二个参数是用什么进行填充。

next_head(参数的下个指令的地址)

一个参数

到达参数的下个指令的地址。用来从一个指令步入下一个指令，而不是单纯的前进一个字节。

一个参数

返回参数地址的指令。比如当前指令是mov a1，1，调用这个函数就会返回mov。

返回该地址的汇编指令的操作数的字符串，并用列表存储。

比如当前地址是mov eax,1，返回的列表的元素从小到大分别是eax,1(都是字符串形式！)

idc

wait_for_next_exent(等待下个事件)

1
2
3
4
5
6
7
8
9
10
11
r"""
    wait_for_next_event(wfne, timeout) -> dbg_event_code_t
    Wait for the next event.

    This function (optionally) resumes the process execution, and waits for a
    debugger event until a possible timeout occurs.

    @param wfne: (C++: int) combination of Wait for debugger event flags constants
    @param timeout: (C++: int) number of seconds to wait, -1-infinity
    @return: either an event_id_t (if > 0), or a dbg_event_code_t (if <= 0)
    """

等待下个事件

step_over(单步步过)

1
2
3
4
5
6
r"""
    step_over() -> bool
    Execute one instruction in the current thread, but without entering into
    functions. Others threads keep suspended. \sq{Type, Asynchronous function -
    available as Request, Notification, dbg_step_over}
    """

就是动调的f8，一般用作自动化调试

ida_funcs

get_func_name(返回对应地址的函数的名字)

1
func_name = get_func_name(func)
1
2
3
4
5
get_func_name(ea) -> str
Get function name.

@param ea: (C++: ea_t) any address in the function
@return: length of the function name

get_func(返回对应的函数的结构体)

1
2
3
4
5
6
7
8
r"""
get_func(ea) -> func_t
Get pointer to function structure by address.

@param ea: (C++: ea_t) any address in a function
@return: ptr to a function or nullptr. This function returns a function entry
         chunk.
"""

可以用start_ea和end_ea获得起始和终止地址

idautils

Functions(返回范围内所有函数的起始和终止地址的列表)

1
2
3
4
5
6
7
8
9
10
11
12
13
"""
Get a list of functions

@param start: start address (default: inf.min_ea)
@param end:   end address (default: inf.max_ea)

@return: list of function entrypoints between start and end

@note: The last function that starts before 'end' is included even
if it extends beyond 'end'. Any function that has its chunks scattered
in multiple segments will be reported multiple times, once in each segment
as they are listed.
"""

默认是返回所有函数

ida_dbg