A blog for posting random things that we want to archive for the internet. Game Development, Networking, Private Server Emulation, Game Hacking & Exploiting, Game & Software security, Tutorials, The dark arts, food :D So its all in one place for people to learn from.
Tuesday, 22 October 2013
Using Python in IDA Pro to iterate over functions and name them
The following code finds what calls the function GameSendPacket,
It then iterates through each function till it finds the opcode of mov with param of byte ptr[xxx]
It then reads the hex param which happens to be the packetID for what I am using this for.
Then it goes to the function and gets its name, if it starts with sub_ then its just been named automatically by IDA so then rename it to be SendXX where XX is the packetID woo!
for ref in CodeRefsTo(LocByName('GameSendPacket'), 1):
E = list(FuncItems(ref))
if len(E) == 0:
print "ORPHAN CALL (NOT IN A FUNCTION)!!!!"
print " at %X " % ref
continue
for e in E:
if (GetMnem(e)=="mov"):
p1 = GetOpnd(e,0)
if (p1=="byte ptr [eax]" or p1=="byte ptr [ebx]" or p1=="byte ptr [ecx]" or p1=="byte ptr [edx]"):
OpHex(e, 1)
n = GetOpnd(e,1)[:2].zfill(2)
OldName = GetFunctionName(ref)
NewName = 'Send'+n;
FuncAddr = PrevFunction(ref)
print '%s NewName: %s OldName: %s' % (hex(FuncAddr), NewName, OldName)
Jump(FuncAddr)
if (OldName.startswith('sub_')):
print 'Rename %s to %s' % (OldName, NewName)
MakeName(FuncAddr,NewName)
break
Funtimes.
Now to make one for handling recv array.
And maybe later graphing GUI click events through to their packets they send.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment