Advertisement
Guest User

Untitled

a guest
Apr 19th, 2019
113
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 2.51 KB | None | 0 0
  1. import ida_funcs
  2. import idaapi
  3. import idautils
  4. import idc
  5.  
  6.  
  7. def get_member_xrefs(sid):
  8.     for (offset, name, size) in idautils.StructMembers(sid):
  9.         mid = idc.GetMemberId(sid, offset)
  10.         if mid != -1:
  11.             for xref in idautils.XrefsTo(mid):
  12.                 yield (idc.get_member_name(sid, offset), xref.frm)
  13.  
  14.  
  15. def get_block_and_instruction(ea):
  16.     func = ida_funcs.get_func(ea)
  17.  
  18.     for (idxBlock, block) in enumerate(idaapi.FlowChart(func)):
  19.         if block.startEA <= ea < block.endEA:
  20.             for (idxHead, head) in enumerate(idautils.Heads(block.startEA, block.endEA)):
  21.                 if head == ea:
  22.                     return idxBlock, idxHead
  23.  
  24.  
  25. default_ida_types = ["GUID", "CPPEH_RECORD", "_EH3_EXCEPTION_REGISTRATION", "FuncInfo", "UnwindMapEntry",
  26.                      "TryBlockMapEntry", "HandlerType", "TypeDescriptor", "_SCOPETABLE_ENTRY", "_EH4_SCOPETABLE",
  27.                      "_EH4_SCOPETABLE_RECORD", "_LARGE_INTEGER::$837407842DC9087486FDFA5FEB63B74E",
  28.                      "_TIME_ZONE_INFORMATION", "SYSTEMTIME", "_WIN32_FIND_DATAA", "FILETIME", "tagPOINT",
  29.                      "_RTL_CRITICAL_SECTION", "_SYSTEMTIME", "_STARTUPINFOA", "_PROCESS_INFORMATION", "tagMSG", "POINT",
  30.                      "WSAData", "WNDCLASSA", "tagRECT", "tagLOGFONTA", "_OFSTRUCT", "_SYSTEM_INFO",
  31.                      "_SYSTEM_INFO::$A707B71C060B6D10F73A71917EA8473F::$AA04DEB0C6383F89F13D312A174572A9",
  32.                      "tagTRACKMOUSEEVENT", "tagWINDOWINFO", "RECT", "_FILETIME", "_OSVERSIONINFOA",
  33.                      "tagCOMPOSITIONFORM", "HINSTANCE__", "_EXCEPTION_POINTERS", "_STARTUPINFOW",
  34.                      "_MEMORY_BASIC_INFORMATION", "_cpinfo", "localeinfo_struct", "tm", "_INPUT_RECORD",
  35.                      "KEY_EVENT_RECORD", "MOUSE_EVENT_RECORD", "COORD", "WINDOW_BUFFER_SIZE_RECORD",
  36.                      "MENU_EVENT_RECORD", "FOCUS_EVENT_RECORD", "_MEMORYSTATUS", "sockaddr", "_OSVERSIONINFOW",
  37.                      "fd_set", "timeval", "FILE", "RTTICompleteObjectLocator", ]
  38.  
  39. for (idx, sid, struct_name) in idautils.Structs():
  40.     if struct_name in default_ida_types:
  41.         continue
  42.  
  43.     for (member_name, xref_ea) in get_member_xrefs(sid):
  44.         func_name = ida_funcs.get_func_name(xref_ea)
  45.         (iBlock, iInstruction) = get_block_and_instruction(xref_ea)
  46.         print "%s.%s -> 0x%X (instruction %d of block %d of %s)" % (struct_name, member_name, xref_ea, iInstruction,
  47.                                                                     iBlock, func_name)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement