-
-
[求助]关于IDC脚本的编写及使用求助
-
发表于:
2011-6-11 11:49
5590
-
.spm_:0040F002 push 437AA8h
.spm_:0040F007 pop eax
.spm_:0040F008 mov edi, (offset loc_40F018+2)
.spm_:0040F00D nop
.spm_:0040F00E push 598h
.spm_:0040F013 pop esi
.spm_:0040F014 nop
.spm_:0040F015
.spm_:0040F015 loc_40F015: ; CODE XREF: .spm_:0040F01Bj
.spm_:0040F015 xor [esi+edi], eax
.spm_:0040F018
.spm_:0040F018 loc_40F018: ; DATA XREF: .spm_:0040F008o
.spm_:0040F018 sub esi, 4
.spm_:0040F01B jnz short loc_40F015
分析一木马,上面这段汇编代码是个解码循环,次数多,想用脚本实现,于是shift+f2调出command,为何会出现错误撒,IDA版本5.5
错误提示:syntax error near:static,希望大牛帮忙看下撒,谢谢喽
#include <idc.idc>
static main()
{
auto Key,StartAddr,Counter,Cbuffer;
StartAddr = 0x40F01A + 0x598;
Key = 0x437AA8;
for(Counter=0x598;Counter!=0;Counter=Counter-4)
{
Cbuffer = StartAddr^Key;
StartAddr = StartAddr - 4;
}
}
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课