forked from WinMin/ida_medigate
-
Notifications
You must be signed in to change notification settings - Fork 0
/
decompiler_utils.py
75 lines (60 loc) · 1.8 KB
/
decompiler_utils.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
import logging
import ida_hexrays
import idc
from . import utils
from idaapi import BADADDR
def get_insn(ea=None):
if ea is None:
ea = idc.here()
xfunc = ida_hexrays.decompile(ea)
return xfunc.get_eamap()[ea][0]
def get_str_from_expr(expr, make_str=True):
if expr is None:
return None
str_addr = get_obj_ea_from_expr(expr)
if str_addr == BADADDR:
return None
ret = idc.get_strlit_contents(str_addr)
if ret is not None:
ret = ret.decode()
return ret
def extract_op_from_expr(expr, op):
if expr is None:
return BADADDR
while expr.is_expr() and expr.op != op:
expr = expr.x
if expr is None:
return BADADDR
if expr.op == op:
return expr
def get_obj_ea_from_expr(expr):
expr = extract_op_from_expr(expr, ida_hexrays.cot_obj)
if expr is None:
return BADADDR
return expr.obj_ea
def get_num_from_expr(expr):
expr = extract_op_from_expr(expr, ida_hexrays.cot_num)
if expr is None:
return None
return expr.get_const_value()
def get_call_from_insn(insn):
expr = None
if type(insn) == ida_hexrays.cinsn_t and insn.op == ida_hexrays.cit_expr:
expr = insn.cexpr
elif type(insn) == ida_hexrays.cexpr_t:
expr = insn
else:
return None
if expr.op != ida_hexrays.cot_call:
return None
return expr
def run_operation_on_func_xrefs(func_name, operation, exception_msg=None):
if exception_msg is None:
exception_msg = "exception in %s xrefs" % func_name
ea = utils.get_func_ea_by_name(func_name)
for xref in utils.get_code_xrefs(ea):
try:
insn = get_insn(xref)
operation(insn, xref)
except Exception as e:
logging.exception("0x%x: %s", ea, exception_msg)