调用thrg cmd提示符时,IDApython中的段起始地址不同

逆向工程 蟒蛇 dll 命令行
2021-07-03 00:56:11

我可以通过以下 ida python 脚本获取段起始地址、结束地址和 DLL 的所有函数:

# Get the segment's starting address
    ea = ScreenEA()
    print(ea)
    print(SegStart(ea),SegEnd(ea))

    callers = dict()
    callees = dict()

    # Loop through all the functions

    for function_ea in Functions(SegStart(ea), SegEnd(ea)):

        f_name = GetFunctionName(function_ea)
        print(f_name)

        # Create a set with all the names of the functions calling (referring to)
        # the current one.
        callers[f_name] = Set(map(GetFunctionName, CodeRefsTo(function_ea, 0)))

        # For each of the incoming references
        for ref_ea in CodeRefsTo(function_ea, 0):


            # Get the name of the referring function
            caller_name = GetFunctionName(ref_ea)

            # Add the current function to the list of functions
            # called by the referring function
            callees[caller_name] = callees.get(caller_name, Set())
            callees[caller_name].add(f_name)

    # Get the list of all functions
    functions = Set(callees.keys()+callers.keys())
    total_callees=0

    # For each of the functions, print the number of functions calling it and
    # number of functions being called. In short, indegree and outdegree
    for f in functions:
        print('%d:%s:%d' % (len(callers.get(f, [])), f, len(callees.get(f, []))))
        total_callees+=len(callees.get(f,[]))

    print("\nTotal callees of \t"+idaapi.get_root_filename()+"\t: "+str(total_callees))

在 IDA pro 中调用时脚本运行良好,但如果通过如下命令提示符调用它:

idaq.exe -A -S"C:\xxx\segment.py" "C:\fff\yy.dll"

输出不同如下:

4294967295
(4294967295L, 4294967295L)    
Total callees of    yy.dll  : 0
1个回答

发生这种情况是因为您从ScreenEA()返回值开始 - 此函数在反汇编窗口中返回当前 EA。当您从命令行运行时,它的行为确实会有所不同。

要迭代段,您可以使用idautils.Segments()函数(它允许迭代所有定义的段)。如果你想获得第一个定义的段,你可以使用idc.FirstSeg()which 应该返回第一个段的起始地址。如果您想将脚本的工作限制为一个段,您可以使用函数检查段名称idc.SegName(ea),其中 ea 是段内的地址,例如,如下所示:

import idautils
import idc

for s in idautils.Segments():
    if idc.SegName(s) == "your_segment_name":
         #do you work here

顺便说一下,4294967295在十六进制0xffffffff中是 的数值idc.BADADDR,这意味着无效的地址或错误。