首页
社区
课程
招聘
[原创]IDA小插件:一键导出所有函数的伪代码,方便搜索分析
发表于: 2022-11-4 12:43 25305

[原创]IDA小插件:一键导出所有函数的伪代码,方便搜索分析

2022-11-4 12:43
25305

基于trace_natives插件修改完成,仓库地址:Humenger/export_func_code

# -*- coding:utf-8 -*-
import os
from idaapi import plugin_t
from idaapi import PLUGIN_PROC
from idaapi import PLUGIN_OK
import ida_nalt
import idaapi
import idautils
import idc
import time
 
 
# 获取SO文件名和路径
def getSoPathAndName():
    fullpath = ida_nalt.get_input_file_path()
    filepath,filename = os.path.split(fullpath)
    return filepath,filename
 
# 获取代码段的范围
def getSegAddr():
    textStart = []
    textEnd = []
 
    for seg in idautils.Segments():
        if (idc.get_segm_name(seg)).lower() == '.text' or (
        idc.get_segm_name(seg)).lower() == 'text':
            tempStart = idc.get_segm_start(seg)
            tempEnd = idc.get_segm_end(seg)
 
            textStart.append(tempStart)
            textEnd.append(tempEnd)
 
    return min(textStart), max(textEnd)
 
 
class traceNatives(plugin_t):
    flags = PLUGIN_PROC
    comment = "export_func_code"
    help = ""
    wanted_name = "export_func_code"
    wanted_hotkey = ""
 
    def init(self):
        print("export_func_code(v0.1) plugin has been loaded.")
        return PLUGIN_OK
 
    def run(self, arg):
        # 查找需要的函数
        ea, ed = getSegAddr()
        so_path, so_name = getSoPathAndName()
        script_name = so_name.split(".")[0] + "_" + str(int(time.time())) +".cc"
        save_path = os.path.join(so_path, script_name)
        print(f"导出路径:{save_path}")
        F=open(save_path, "w+", encoding="utf-8")
        F.write("\n#####################################\n")
        for func in idautils.Functions(ea, ed):
            try:
                functionName = str(idaapi.ida_funcs.get_func_name(func))
                if len(list(idautils.FuncItems(func))) > 10:
                    # 如果是thumb模式,地址+1
                    arm_or_thumb = idc.get_sreg(func, "T")
                    if arm_or_thumb:
                        func += 1
                    code=str(idaapi.decompile(func))+"\n#####################################\n"
                    print(code)
                    F.write(code)
                    F.flush()
            except Exception as e:
                print(e)
        print(f"导出完成:{save_path}")
        F.close()
 
    def term(self):
        pass
 
 
def PLUGIN_ENTRY():
    return traceNatives()
# -*- coding:utf-8 -*-
import os
from idaapi import plugin_t
from idaapi import PLUGIN_PROC
from idaapi import PLUGIN_OK
import ida_nalt
import idaapi
import idautils
import idc
import time
 
 
# 获取SO文件名和路径
def getSoPathAndName():
    fullpath = ida_nalt.get_input_file_path()
    filepath,filename = os.path.split(fullpath)
    return filepath,filename
 
# 获取代码段的范围
def getSegAddr():
    textStart = []
    textEnd = []
 
    for seg in idautils.Segments():
        if (idc.get_segm_name(seg)).lower() == '.text' or (
        idc.get_segm_name(seg)).lower() == 'text':
            tempStart = idc.get_segm_start(seg)
            tempEnd = idc.get_segm_end(seg)
 
            textStart.append(tempStart)
            textEnd.append(tempEnd)
 
    return min(textStart), max(textEnd)
 
 
class traceNatives(plugin_t):
    flags = PLUGIN_PROC
    comment = "export_func_code"
    help = ""

[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课

最后于 2022-11-4 13:01 被逆向涉猎编辑 ,原因:
收藏
免费 4
支持
分享
最新回复 (4)
雪    币: 1446
活跃值: (3871)
能力值: ( LV3,RANK:30 )
在线值:
发帖
回帖
粉丝
2
导出后能直接编译不?
2022-11-6 17:54
0
雪    币: 12
活跃值: (20)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
3
这个不错
2023-6-8 09:35
0
雪    币: 237
能力值: ( LV1,RANK:0 )
在线值:
发帖
回帖
粉丝
4
ctrl+F5就能导出啊
2023-6-8 09:56
1
雪    币: 477
活跃值: (1412)
能力值: ( LV2,RANK:10 )
在线值:
发帖
回帖
粉丝
5
有没有一键出可编译项目文件啊
2023-6-8 18:36
0
游客
登录 | 注册 方可回帖
返回
//