Advertisement
Guest User

Untitled

a guest
Nov 13th, 2019
197
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 1.67 KB | None | 0 0
  1. import idautils
  2. import idc
  3.  
  4. REGISTERS = {
  5.     1: 'R0',
  6.     2: 'R1',
  7.     3: 'R2',
  8.     4: 'R3',
  9. }
  10.  
  11. def get_debug_func_ea(function_str):
  12.     for f in Functions():
  13.         name = idaapi.get_func_name(f)
  14.         if name == function_str:
  15.             return f
  16.     return None
  17.    
  18. def get_nth_arg(start_ea, end_ea, n=0):
  19.     for addr in range(start_ea, end_ea, 4)[::-1]:
  20.         if not DecodeInstruction(addr):
  21.             continue
  22.         if DecodeInstruction(addr).get_canon_mnem() == 'LDR' and idc.print_operand(addr, 0) == REGISTERS[n]:
  23.             return idc.get_operand_value(addr, 1)
  24.     return None
  25.  
  26. ea = get_debug_func_ea('ProcUserLog')
  27. for ref in CodeRefsTo(ea, 1):
  28.     caller_name = idaapi.get_func_name(ref)
  29.     caller_address = idc.get_name_ea_simple(caller_name)
  30.     if not caller_name:
  31.         continue
  32.     if caller_name.startswith('sub_'):
  33.         if not ref:
  34.             continue                                                                      
  35.         ea = get_nth_arg(ref - 0x20, ref, 3)
  36.         if ea:
  37.             if get_segm_name(ea) == '.text':
  38.                 ea = idc.get_wide_dword(ea)
  39.             if get_segm_name(ea) == '.rodata':
  40.                 fn_name = idc.get_strlit_contents(ea)
  41.                 if fn_name:
  42.                     print '--------------------------------------------------------'
  43.                     print 'Function Address:  ' + hex(caller_address)
  44.                     print 'Function Old Name: ' + caller_name
  45.                     print 'Function New Name: ' + fn_name
  46.                     print '---------------------------------------------------------'
  47.                     idc.set_name(caller_address, fn_name, 0x800)
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement