Loading...
Loading...
Compare original and translation side by side
ida_*idcida_*idc| Task | Module | Key Items |
|---|---|---|
| Bytes/memory | | |
| Functions | | |
| Names | | |
| Types | | |
| Decompiler | | |
| Segments | | |
| Xrefs | | |
| Instructions | | |
| Stack frames | | |
| Iteration | | |
| UI/dialogs | | |
| Database info | | |
| Analysis | | |
| Flow graphs | | |
| Register tracking | | |
| 任务 | 模块 | 核心内容 |
|---|---|---|
| 字节/内存 | | |
| 函数 | | |
| 命名 | | |
| 类型 | | |
| 反编译 | | |
| 段 | | |
| 交叉引用 | | |
| 指令 | | |
| 栈帧 | | |
| 迭代 | | |
| UI/对话框 | | |
| 数据库信息 | | |
| 分析 | | |
| 流程图 | | |
| 寄存器追踪 | | |
for ea in idautils.Functions():
name = ida_funcs.get_func_name(ea)
func = ida_funcs.get_func(ea)for ea in idautils.Functions():
name = ida_funcs.get_func_name(ea)
func = ida_funcs.get_func(ea)for head in idautils.FuncItems(func_ea):
insn = ida_ua.insn_t()
if ida_ua.decode_insn(insn, head):
print(f"{head:#x}: {insn.itype}")for head in idautils.FuncItems(func_ea):
insn = ida_ua.insn_t()
if ida_ua.decode_insn(insn, head):
print(f"{head:#x}: {insn.itype}")for xref in idautils.XrefsTo(ea):
print(f"{xref.frm:#x} -> {xref.to:#x} type={xref.type}")for xref in idautils.XrefsTo(ea):
print(f"{xref.frm:#x} -> {xref.to:#x} type={xref.type}")data = ida_bytes.get_bytes(ea, size)
ida_bytes.patch_bytes(ea, b"\x90\x90")data = ida_bytes.get_bytes(ea, size)
ida_bytes.patch_bytes(ea, b"\x90\x90")name = ida_name.get_name(ea)
ida_name.set_name(ea, "new_name", ida_name.SN_NOCHECK)name = ida_name.get_name(ea)
ida_name.set_name(ea, "new_name", ida_name.SN_NOCHECK)cfunc = ida_hexrays.decompile(ea)
if cfunc:
print(cfunc) # pseudocode
for lvar in cfunc.lvars:
print(f"{lvar.name}: {lvar.type()}")cfunc = ida_hexrays.decompile(ea)
if cfunc:
print(cfunc) # 伪代码
for lvar in cfunc.lvars:
print(f"{lvar.name}: {lvar.type()}")class MyVisitor(ida_hexrays.ctree_visitor_t):
def visit_expr(self, e):
if e.op == ida_hexrays.cot_call:
print(f"Call at {e.ea:#x}")
return 0
cfunc = ida_hexrays.decompile(ea)
MyVisitor().apply_to(cfunc.body, None)class MyVisitor(ida_hexrays.ctree_visitor_t):
def visit_expr(self, e):
if e.op == ida_hexrays.cot_call:
print(f"Call at {e.ea:#x}")
return 0
cfunc = ida_hexrays.decompile(ea)
MyVisitor().apply_to(cfunc.body, None)tif = ida_typeinf.tinfo_t()
if ida_typeinf.parse_decl(tif, None, "int (*)(char *, int)", 0):
ida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)tif = ida_typeinf.tinfo_t()
if ida_typeinf.parse_decl(tif, None, "int (*)(char *, int)", 0):
ida_typeinf.apply_tinfo(ea, tif, ida_typeinf.TINFO_DEFINITE)udt = ida_typeinf.udt_type_data_t()
m = ida_typeinf.udm_t()
m.name = "field1"
m.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)
m.offset = 0
m.size = 4
udt.push_back(m)
tif = ida_typeinf.tinfo_t()
tif.create_udt(udt, ida_typeinf.BTF_STRUCT)
tif.set_named_type(ida_typeinf.get_idati(), "MyStruct")udt = ida_typeinf.udt_type_data_t()
m = ida_typeinf.udm_t()
m.name = "field1"
m.type = ida_typeinf.tinfo_t(ida_typeinf.BTF_INT32)
m.offset = 0
m.size = 4
udt.push_back(m)
tif = ida_typeinf.tinfo_t()
tif.create_udt(udt, ida_typeinf.BTF_STRUCT)
tif.set_named_type(ida_typeinf.get_idati(), "MyStruct")for s in idautils.Strings():
print(f"{s.ea:#x}: {str(s)}")for s in idautils.Strings():
print(f"{s.ea:#x}: {str(s)}")ida_auto.auto_wait() # Block until autoanalysis completesida_auto.auto_wait() # 阻塞直到自动分析完成| Constant | Value/Use |
|---|---|
| Invalid address sentinel |
| Skip name validation |
| Force type application |
| Operand types |
| Data types |
| Code xref types |
| Data xref types |
| 常量 | 值/用途 |
|---|---|
| 无效地址标记 |
| 跳过名称验证 |
| 强制应用类型 |
| 操作数类型 |
| 数据类型 |
| 代码交叉引用类型 |
| 数据交叉引用类型 |
int_convertida_auto.auto_wait()@idasyncea_tint_convertida_auto.auto_wait()@idasyncea_t| Avoid | Do Instead |
|---|---|
| Use |
| Hardcoded addresses | Use names, patterns, or xrefs |
| Manual hex conversion | Use |
| Blocking main thread | Use |
| Guessing at types | Derive from disassembly/decompilation |
| 需避免的做法 | 推荐做法 |
|---|---|
| 使用 |
| 硬编码地址 | 使用名称、模式或交叉引用 |
| 手动十六进制转换 | 使用 |
| 阻塞主线程 | 长操作使用 |
| 猜测类型 | 从反汇编/反编译结果推导 |
docs/<module>.mdida_bytesida_funcsida_hexraysida_typeinfida_nameidautilsida_segmentida_xrefida_uaida_frameida_kernwinida_dbgida_naltida_regfinderdocs/<module>.rstdocs/<module>.mdida_bytesida_funcsida_hexraysida_typeinfida_nameidautilsida_segmentida_xrefida_uaida_frameida_kernwinida_dbgida_naltida_regfinderdocs/<module>.rst