Tuesday, 22 October 2013

Using Python in IDA Pro to iterate over functions and name them


The following code finds what calls the function GameSendPacket,
It then iterates through each function till it finds the opcode of mov with param of byte ptr[xxx]
It then reads the hex param which happens to be the packetID for what I am using this for.

Then it goes to the function and gets its name, if it starts with sub_ then its just been named automatically by IDA so then rename it to be SendXX where XX is the packetID woo!



for ref in CodeRefsTo(LocByName('GameSendPacket'), 1):
   E = list(FuncItems(ref))
   if len(E) == 0:
     print "ORPHAN CALL (NOT IN A FUNCTION)!!!!"
     print " at %X " % ref
     continue
   for e in E:
      if (GetMnem(e)=="mov"):
         p1 = GetOpnd(e,0)
         if (p1=="byte ptr [eax]" or p1=="byte ptr [ebx]" or p1=="byte ptr [ecx]" or p1=="byte ptr [edx]"):
            OpHex(e, 1)
            n = GetOpnd(e,1)[:2].zfill(2)
            OldName = GetFunctionName(ref)
            NewName = 'Send'+n;
            FuncAddr = PrevFunction(ref)
            print '%s NewName: %s OldName: %s' % (hex(FuncAddr), NewName, OldName)
            Jump(FuncAddr)
            if (OldName.startswith('sub_')):
               print 'Rename %s to %s' % (OldName, NewName)
               MakeName(FuncAddr,NewName)
            break


Funtimes.

Now to make one for handling recv array.
And maybe later graphing GUI click events through to their packets they send.

No comments:

Post a Comment