Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- import ida_funcs
- import idaapi
- import idautils
- import idc
- def get_member_xrefs(sid):
- for (offset, name, size) in idautils.StructMembers(sid):
- mid = idc.GetMemberId(sid, offset)
- if mid != -1:
- for xref in idautils.XrefsTo(mid):
- yield (idc.get_member_name(sid, offset), xref.frm)
- def get_block_and_instruction(ea):
- func = ida_funcs.get_func(ea)
- for (idxBlock, block) in enumerate(idaapi.FlowChart(func)):
- if block.startEA <= ea < block.endEA:
- for (idxHead, head) in enumerate(idautils.Heads(block.startEA, block.endEA)):
- if head == ea:
- return idxBlock, idxHead
- default_ida_types = ["GUID", "CPPEH_RECORD", "_EH3_EXCEPTION_REGISTRATION", "FuncInfo", "UnwindMapEntry",
- "TryBlockMapEntry", "HandlerType", "TypeDescriptor", "_SCOPETABLE_ENTRY", "_EH4_SCOPETABLE",
- "_EH4_SCOPETABLE_RECORD", "_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E",
- "_TIME_ZONE_INFORMATION", "SYSTEMTIME", "_WIN32_FIND_DATAA", "FILETIME", "tagPOINT",
- "_RTL_CRITICAL_SECTION", "_SYSTEMTIME", "_STARTUPINFOA", "_PROCESS_INFORMATION", "tagMSG", "POINT",
- "WSAData", "WNDCLASSA", "tagRECT", "tagLOGFONTA", "_OFSTRUCT", "_SYSTEM_INFO",
- "_SYSTEM_INFO::$A707B71C060B6D10F73A71917EA8473F::$AA04DEB0C6383F89F13D312A174572A9",
- "tagTRACKMOUSEEVENT", "tagWINDOWINFO", "RECT", "_FILETIME", "_OSVERSIONINFOA",
- "tagCOMPOSITIONFORM", "HINSTANCE__", "_EXCEPTION_POINTERS", "_STARTUPINFOW",
- "_MEMORY_BASIC_INFORMATION", "_cpinfo", "localeinfo_struct", "tm", "_INPUT_RECORD",
- "KEY_EVENT_RECORD", "MOUSE_EVENT_RECORD", "COORD", "WINDOW_BUFFER_SIZE_RECORD",
- "MENU_EVENT_RECORD", "FOCUS_EVENT_RECORD", "_MEMORYSTATUS", "sockaddr", "_OSVERSIONINFOW",
- "fd_set", "timeval", "FILE", "RTTICompleteObjectLocator", ]
- for (idx, sid, struct_name) in idautils.Structs():
- if struct_name in default_ida_types:
- continue
- for (member_name, xref_ea) in get_member_xrefs(sid):
- func_name = ida_funcs.get_func_name(xref_ea)
- (iBlock, iInstruction) = get_block_and_instruction(xref_ea)
- print "%s.%s -> 0x%X (instruction %d of block %d of %s)" % (struct_name, member_name, xref_ea, iInstruction,
- iBlock, func_name)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement