Lyxica

Rename addresses based on nearby strings in operands

Aug 20th, 2020
257
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Python 0.75 KB | None | 0 0
  1.  
  2. def niceHex(num):
  3.     hexnum = hex(num)
  4.     return hexnum[: len(hexnum) - 1]
  5.  
  6. def stringOffset(loc):
  7.     global lastStr
  8.     str = idc.get_bytes(idc.get_operand_value(loc, 0), 128)
  9.     if str.startswith("Py"):
  10.         lastStr = str
  11.  
  12. def eaxMov(loc, run = False):
  13.     global lastStr
  14.     print "@", niceHex(loc), " | ", idc.generate_disasm_line(loc, 0), " [eax -> ", lastStr, "]"
  15.     if run:
  16.         idc.set_name(idc.get_operand_value(loc, 0), lastStr)
  17.     lastStr = ""
  18.  
  19. locs = list(idautils.FuncItems(here()))
  20. for loc in locs:
  21.     isEaxMov = idc.print_insn_mnem(loc) == "mov" and idc.get_operand_type(loc, 0) == 2
  22.     isStringOffset = idc.print_insn_mnem(loc) == "push" and idc.get_operand_type(loc, 0) == 5
  23.    
  24.     if isStringOffset:
  25.         stringOffset(loc)
  26.     if isEaxMov:
  27.         eaxMov(loc, False)
  28.  
  29.  
  30.  
Advertisement
Add Comment
Please, Sign In to add comment