#include <idc.idc>

static create_log(logname)
{
        auto filename,flag,fp;
        flag="w";
        filename="f:\\"+logname;
         //Warning("Sorry,%s not found in database",filename);
        fp=fopen(filename,flag);
          if (fp==0)
    {
     printf("creat file lose");
     }
     else
             {
                     printf("creat file successfully!");
                     writestr(fp,logname+" has been created\n");
                           fclose(fp);
                }
                return filename;
}
//------------------------------------------------

static findspecialcodetest(need_func,logname)
{
  auto func,addr,xref,source,filep,filename,flag;
printf(logname);
  flag="a+";
  filep=fopen(logname,flag);
if (filep!=0)
    {
            writestr(filep,need_func+"is found in database\n");
     printf("creat file successfully");
   fclose(filep);
        }
  

}

//------------------------------------------------------
static findspecialcode(need_func,logname)
{
  auto func,addr,xref,source,filep,filename,flag;

  flag="a+";
  
  func=LocByName(need_func);
  if (func==BADADDR)
   {return;
   Warning("Sorry,%s not found in database",need_func);
   }
  else
   {
    Message("%s is found in database\n",need_func);
  filep=fopen(logname,flag);
   if (filep!=0)
    { writestr(filep,need_func+" is found in database\n");
     printf("creat file successfully");
   fclose(filep);
}
  else {printf("creat file lose");}   
   }
     
   
/* below is detail process
  else{
    for (addr=RfirstB(func);addr !=BADADDR;addr=RnextB(func,addr))
     {
      xref=XrefType();
      if (xref==fl_CN||xref==fl_CF)
      {
       source= GetFunctionName(addr);
       Message("%s is called from )x%x in %s \n",need_func,addr,source);
      }
     }
*/
}

//------------------------------------------------
static oscmd(cstr)
{
Exec (cstr);
   
}

//------------------------------------------------
static printf(cstr)
{
Message("***************%s*********************** \n",cstr);
}

//------------------------------------------------

static main()
{

auto i,filename,filenamex,filepath,filep,temp;
filename=GetInputFile();
printf(filename);
//creat log file
i = strstr(filename,".");
  if ( i != -1 )
          {
                    i = i + 1;
                    temp=substr(filename,0,i);//temp = xxxx.
                    //printf(temp+"log");//
                    filename=temp+"log";
   
    //return filename;     // get type of the resource
           }
//create a log  
filenamex=create_log(filename);

//-----------------------------------------------------
Message("****************************************** \n");
Message("This is syr ida script to find special code \n");
//-----------------------限制程序功能函数-------------------------
printf("限制程序功能函数");
findspecialcode("EnableMenuItem",filenamex);
findspecialcode("EnableWindow",filenamex);
//----------对话框函数-----------------------------------
printf("对话框函数");
findspecialcode("CreateDialog",filenamex);
findspecialcode("CreateDialogParam",filenamex);
findspecialcode("CreateDialogIndirect",filenamex);
findspecialcode("CreateDialogIndirectParam",filenamex);
findspecialcode("DialogBox",filenamex);
findspecialcode("DialogBoxParam",filenamex);
findspecialcode("DialogBoxIndirect",filenamex);
findspecialcode("DialogBoxIndirectParam",filenamex);
findspecialcode("EndDialog",filenamex);
findspecialcode("MessageBox",filenamex);
findspecialcode("MessageBoxW",filenamex);
findspecialcode("MessageBoxEx",filenamex);
findspecialcode("MessageBoxIndirect",filenamex);
findspecialcode("GetDlgItemInt",filenamex);
findspecialcode("GetDlgItemText",filenamex);
findspecialcode("GetDlgItemTextA",filenamex);
findspecialcode("Hmemcpy",filenamex);
//磁盘处理函数
printf("磁盘处理函数");
findspecialcode("GetDiskFreeSpaceA",filenamex);
findspecialcode("GetDiskFreeSpaceExA",filenamex);
findspecialcode("GetDriveTypeA",filenamex);
findspecialcode("GetLogicalDrives",filenamex);
findspecialcode("GetFullPathNameA",filenamex);
findspecialcode("GetVolumeInformationA",filenamex);
findspecialcode("GetWindowsDirectoryA",filenamex);
findspecialcode("GetSystemDirectoryA",filenamex);
//4、文件处理函数
printf("4、文件处理函数");
findspecialcode("CreateFileA",filenamex);
findspecialcode("OpenFile",filenamex);
findspecialcode("ReadFile",filenamex);
findspecialcode("ReadFileEx",filenamex);
findspecialcode("WriteFile",filenamex);
findspecialcode("WriteFileEx",filenamex);
findspecialcode("SetFilePointer",filenamex);
findspecialcode("SetEndOfFile",filenamex);
findspecialcode("CloseHandle",filenamex);
findspecialcode("_lcreat",filenamex);
findspecialcode("_lopen",filenamex);
findspecialcode("_lread",filenamex);
findspecialcode("_lwrite",filenamex);
findspecialcode("_llseek",filenamex);
findspecialcode("_lclose",filenamex);
findspecialcode("_hread",filenamex);
findspecialcode("_hwrite",filenamex);
findspecialcode("OpenFileMappingA",filenamex);
findspecialcode("CreateFileMappingA",filenamex);
findspecialcode("MapViewOfFile",filenamex);
findspecialcode("MapViewOfFileEx",filenamex);
findspecialcode("CreateDirectoryA",filenamex);
findspecialcode("CreateDirectoryExA",filenamex);
findspecialcode("RemoveDirectoryA",filenamex);
findspecialcode("SetCurrentDirectoryA",filenamex);
findspecialcode("MoveFileA",filenamex);
findspecialcode("DeleteFileA",filenamex);
findspecialcode("CopyFileA",filenamex);
findspecialcode("CompareFileTime",filenamex);
findspecialcode("SetFileAttributesA",filenamex);
findspecialcode("FindFirstFileA",filenamex);
findspecialcode("FindNextFileA",filenamex);
findspecialcode("FindClose",filenamex);
findspecialcode("SearchPathA",filenamex);
findspecialcode("GetBinaryTypeA",filenamex);
findspecialcode("GetFileAttributesA",filenamex);
findspecialcode("GetFileSize",filenamex);
findspecialcode("GetFileTime",filenamex);
findspecialcode("GetFileType",filenamex);
//注册表处理函数
printf("注册表处理函数");
findspecialcode("RegOpenKeyA",filenamex);
findspecialcode("RegOpenKeyExA",filenamex);
findspecialcode("RegCreateKeyA",filenamex);
findspecialcode("RegCreateKeyExA",filenamex);
findspecialcode("RegDeleteKeyA",filenamex);
findspecialcode("RegDeleteValueA",filenamex);
findspecialcode("RegQueryValueA",filenamex);
findspecialcode("RegQueryValueExA",filenamex);
findspecialcode("RegSetValueA",filenamex);
findspecialcode("RegSetValueExA",filenamex);
findspecialcode("RegCloseKey",filenamex);
//时间处理函数
printf("时间处理函数");
findspecialcode("CompareFileTime",filenamex);
findspecialcode("GetFileTime",filenamex);
findspecialcode("GetLocalTime",filenamex);
findspecialcode("GetSystemTime",filenamex);
findspecialcode("GetTickCount",filenamex);
findspecialcode("SetFileTime",filenamex);
findspecialcode("SetLocalTime",filenamex);
findspecialcode("SetSystemTime",filenamex);
//7、进程函数
printf("7、进程函数");
findspecialcode("CreateProcessA",filenamex);
findspecialcode("ExitProcess",filenamex);
findspecialcode("FindExecutableA",filenamex);
findspecialcode("FreeLibray",filenamex);
findspecialcode("GetCurrentProcess",filenamex);
findspecialcode("GetCurrentProcessId",filenamex);
findspecialcode("GetCurrentThread",filenamex);
findspecialcode("GetExitCodeProces",filenamex);
findspecialcode("GetExitCodeThread",filenamex);
findspecialcode("GetModuleHandleA",filenamex);
findspecialcode("GetPriorityClassA",filenamex);
findspecialcode("LoadLibraryA",filenamex);
findspecialcode("LoadLibraryExA",filenamex);
findspecialcode("LoadModule",filenamex);
findspecialcode("TerminateProcess",filenamex);
//
printf("8、断点设置列表");
findspecialcode("GetPrivateProfileString",filenamex);
findspecialcode("GetPrivateProfileInt",filenamex);
findspecialcode("WritePrivateProfileString",filenamex);
findspecialcode("WritePrivateProfileInt",filenamex);
//-------------------------------------------------------

}

-----------------------------------------------------------------------

*version 2
用户可以自主输入要查询的win32 api 函数，及相应的variable；

*显示出指定win32 api 的variable参数的内存中的值

因为api 有 W，A之分 要修改showtext（）
*举例用MessageBoxW ，的第二个参数 lpText

[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课