cisco路由器固件字符串修复ida脚本
cisco路由器固件反汇编后部分字符串可能无法正确解析:很多字符串由于前面有个\n符号,ida解析的时候不认为前一部分是字符串,导致字符串解析不完整,只把后面一段解析成了字符串。
由此造成F5的时候部分引用字符串代码让人看不懂,而且直接在字符串上按X查看交叉引用会发现找不到交叉引用。
以下脚本可以修复字符串解析不完整的情况。
注意,请在IDA7.5,python3.8环境下食用!
from idaapi import * import idautils import idc def setString(): for seg in idautils.Segments(): segName = idc.get_segm_name(seg) if segName != '.rodata' and segName != '.data': continue segStart = idc.get_segm_start(seg) segEnd = idc.get_segm_end(seg) print(segName,hex(segStart),hex(segEnd)) start = segStart num = 0 while start <= segEnd: flag = idc.create_strlit(start,BADADDR) if flag: newStr = idc.guess_type(start) if 'char[' == newStr[:5] and ']' == newStr[-1:]: strLen = int(newStr[5:-1]) start += strLen num += 1 continue else: idc.create_byte(start) start += 1 print('set ' + str(num) + ' to string') #setString() #ea = idc.get_screen_ea() #print(type(ea)) #value = idc.get_wide_byte(ea) #print(value) #bb = idc.guess_type(ea) #print(bb) #print(hex(ea)) #flag = idc.create_byte(ea) #if flag: # print('success') #else: # print('fail') #addr = idc.get_wide_dword(ea) #print(hex(addr)) #liii = list(idautils.DataRefsFrom(ea)) #print(len(liii)) #print(liii) ''' danger_funcs = ["sub_80D1FC3C"] for func in danger_funcs: addr = idc.get_name_ea_simple(func) if addr != BADADDR: cross_refs = CodeRefsTo(addr, 0) print("Cross References to %s" % func) print("-------------------------------") for ref in cross_refs: print("%08x" % ref) idc.set_color( ref, CIC_ITEM, 0x0000ff) '''