-
Notifications
You must be signed in to change notification settings - Fork 18
/
Copy pathIdaSym.py
executable file
·63 lines (51 loc) · 1.7 KB
/
IdaSym.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
import os
import re
import time
from idaapi import *
from idc import *
from idautils import *
SYM_TOKEN = "_SYM"
sym_reg = re.compile(SYM_TOKEN)
call_reg = re.compile("^call")
mbase = idaapi.get_imagebase()
def AllSyms():
ea = ScreenEA()
syms = []
for funcea in Functions(SegStart(ea), SegEnd(ea)):
funcname = GetFunctionName(funcea)
if sym_reg.search(funcname):
syms.extend(Syms(funcea))
return syms
def GetReturnSyms(func_name, block):
syms = []
func_addr = GetFunctionAttr(block.startEA, FUNCATTR_START)
for head in Heads(block.startEA, block.endEA):
dasm = GetDisasm(head)
if call_reg.search(dasm):
ret_addr = NextHead(head, BADADDR);
s = { 'start' : (ret_addr - mbase), 'name' : func_name, 'offset' : (ret_addr - func_addr) }
syms.append(s)
return syms
def Syms(addr = ScreenEA()):
syms = []
func_addr = idaapi.get_func(addr)
start_addr = GetFunctionAttr(addr, FUNCATTR_START)
fname = GetFunctionName(ScreenEA())
func_name = re.sub(SYM_TOKEN, "", fname)
for block in idaapi.FlowChart(func_addr):
s = { 'start' : (block.startEA - mbase), 'name' : func_name, 'offset' : (block.startEA - start_addr) }
syms.append(s)
syms.extend(GetReturnSyms(func_name, block))
return syms
def SaveSyms(syms, out = None):
moduleName = idc.GetInputFile()
moduleShortName = re.sub(r'\.[^.]*$','', moduleName)
fname = "%s.sym" % moduleShortName
if out == None: out = fname
f = open(out,"w")
for s in syms:
str = "%0.8X,%s + 0x%0.4X ( 0x%0.8X )" % (s['start'], s['name'], s['offset'], s['start'])
#print str
f.write( str + '\n')
f.closed
print "\n>> %i syms written to %s\\%s" % (len(syms), os.getcwd(),out)