逆向工程 - IDA python，列出所有导入的函数 - 吾爱随笔录

我有以下 IDA python 脚本。它在对库函数的所有调用上设置和删除断点：

import idc
import idaapi
import idautils

def set_breakpoints():
    ea = idc.ScreenEA()
    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
        if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
            for ref in idautils.CodeRefsTo(function_ea, 0):
                    idc.AddBpt(ref)

def rem_breakpoints():
    ea = idc.ScreenEA()
    for function_ea in idautils.Functions(idc.SegStart(ea), idc.SegEnd(ea)):
        if idc.GetFunctionFlags(function_ea) & FUNC_LIB:
            for ref in idautils.CodeRefsTo(function_ea, 0):
                    idc.DelBpt(ref)

idaapi.add_hotkey("Alt-Z", set_breakpoints)
idaapi.add_hotkey("Alt-X", rem_breakpoints)

现在我想为导入的 win api 函数（从“导入”选项卡）拥有相同的功能，但我找不到任何表明该函数已导入的标志。也许有人可以指出我正确的方向来做到这一点。谢谢。

# ----------------------------------------------------------------------- # This is an example illustrating how to enumerate imports # (c) Hex-Rays # import idaapi def imp_cb(ea, name, ord): if not name: print "%08x: ord#%d" % (ea, ord) else: print "%08x: %s (ord#%d)" % (ea, name, ord) # True -> Continue enumeration # False -> Stop enumeration return True nimps = idaapi.get_import_module_qty() print "Found %d import(s)..." % nimps for i in xrange(0, nimps): name = idaapi.get_import_module_name(i) if not name: print "Failed to get import module name for #%d" % i continue print "Walking-> %s" % name idaapi.enum_import_names(i, imp_cb) print "All done..."