IDA python,获取特定dll的地址范围

逆向工程 艾达 蟒蛇 dll
2021-06-21 13:48:59

我有以下 IDA Python 脚本。当调用来自感兴趣的模块时,它旨在中断导入函数的第一条指令:

list = []

def set_cb(ea, name, ord):
    global list
    actual_ea = Dword(ea)
    AddBpt(actual_ea)
    list.append(actual_ea)
        return True

def set_breakpoints():
    global list
    del list[:]
    nimps = idaapi.get_import_module_qty()
    for i in xrange(0, nimps):
        idaapi.enum_import_names(i, set_cb)

def rem_cb(ea, name, ord):
    actual_ea = Dword(ea)
    DelBpt(actual_ea)
        return True

def rem_breakpoints():
    global list
    del list[:]
    nimps = idaapi.get_import_module_qty()
    for i in xrange(0, nimps):
        idaapi.enum_import_names(i, rem_cb)

def step_cb():
    global list
    minea = MinEA()
    maxea = MaxEA()
    while GetDebuggerEvent(WFNE_SUSP | WFNE_CONT, -1) > 0:
        r_eip = GetRegValue("EIP")
        if r_eip in list:
            r_esp = GetRegValue("ESP")
            caller = Dword(r_esp)
            if (caller >= minea) and (caller < maxea):
                break
        else:
            break

idaapi.add_hotkey("F3", set_breakpoints)
idaapi.add_hotkey("F5", rem_breakpoints)
idaapi.add_hotkey("F10", step_cb)

我调试了 dll,我只需要中断直接从这个 dll 发出的 win api 调用,而不是从 C 运行时库。但是MinEAMaxEA函数返回整个程序中使用的最小和最大地址。我需要的是这样的:

ea = GetModuleByName("some.dll")
minea = ModuleStart(ea)
maxea = ModuleEnd(ea)

你知道这样的api吗?谢谢。

2个回答

GetModuleByNameIDA 中没有,而是使用EIP您可以使用寄存器值(您已经获取)SegStartSegEnd

您的代码应该类似于:

def step_cb():
    global list
    while GetDebuggerEvent(WFNE_SUSP | WFNE_CONT, -1) > 0:
        r_eip = GetRegValue("EIP")
        if r_eip in list:
            r_esp = GetRegValue("ESP")
            caller = Dword(r_esp)
            if (caller >= SegStart(r_eip)) and (caller < SegEnd(r_eip)):
                break
        else:
            break

脚本的最终版本,以防其他人需要它。你需要做什么:

1) set breakpoint and wait until debugger hits it
2) load script (file -> script file)
3) open breakpoints window (to see whether breakpoints were added)
4) press "F3", breakpoints will be added automatically (you can also add another breakpoints by hand)
5) press "F10", debugger will stop on breakpoints added by hand or on API calls that were made directly from module being examined (calls from library functions are skipped)
6) you can examine stack now and follow pushed EIP in disassembly view
7) when suspended you can delete breakpoints that were added by script (with "F5"), add them again, and so on (it is useful when you want to quickly disable breakpoints to follow usual execution flow)
8) also notice the condition in 'set_cb' callback (you can filter out some well-known functions)

list = []   #global list to hold EIP values

def set_cb(ea, name, ord):
    global list
    if (name != 'lstrcpynA') and (name != 'lstrcmpA') and (name != 'lstrcpyA') and (name != 'lstrcatA') and (name != 'lstrcmpiA') and (name != 'lstrlenA') and (name != 'wsprintfA') and (name != 'DefWindowProcA') and (name != 'PeekMessageA') and (name != 'TranslateMessage') and (name != 'DispatchMessageA') and (name != 'IsDBCSLeadByte') and (name != 'CharNextA'):
        actual_ea = Dword(ea)
        AddBpt(actual_ea)
        list.append(actual_ea)
        return True

def set_breakpoints():
    global list
    del list[:]
    nimps = idaapi.get_import_module_qty()
    for i in xrange(0, nimps):
        idaapi.enum_import_names(i, set_cb)

def rem_cb(ea, name, ord):
    actual_ea = Dword(ea)
    DelBpt(actual_ea)
        return True

def rem_breakpoints():
    global list
    del list[:]
    nimps = idaapi.get_import_module_qty()
    for i in xrange(0, nimps):
        idaapi.enum_import_names(i, rem_cb)

def step_cb():
    global list
    minea = idaapi.get_imagebase()
    maxea = minea + 0x98000     #image size retrieved by WIN API (from C++ program)
    while GetDebuggerEvent(WFNE_SUSP | WFNE_CONT, -1) > 0:
        r_eip = GetRegValue("EIP")
        if r_eip in list:
            r_esp = GetRegValue("ESP")
            caller = Dword(r_esp)
            if (caller >= minea) and (caller < maxea):
                if not(GetFunctionFlags(caller) & FUNC_LIB):
                    break
        else:
            break

idaapi.add_hotkey("F3", set_breakpoints)
idaapi.add_hotkey("F5", rem_breakpoints)
idaapi.add_hotkey("F10", step_cb)