IDA 特征码生成和搜索脚本

1 importida_bytes2 importida_ida3 
4 def SearchPattern(hexStr, num =0):5     '''
6 hexStr： 输入的特征码字符串，例：41 80 BE ?? ?? ?? ?? 0F 84 ?? ??7 num：    搜索到多少个结果时返回，为 0 时搜索全部匹配的地址8     '''
9     
10     #生成掩码
11     bMask = hexStr.replace('00', '01')12     bMask = bMask.replace('??', '00')13     bMask =bytes.fromhex(bMask)14     #print(bMask)
15     
16     #生成模式码
17     bPattern = hexStr.replace('??', '00')18     bPattern =bytes.fromhex(bPattern)19     #print(bPattern)
20 
21 
22     results =[]23     ea =ida_ida.inf_get_min_ea()24     
25     whileTrue:26         ea =ida_bytes.bin_search(27             ea + 1,28 ida_ida.inf_get_max_ea(),29 bPattern,30 bMask,31             1,32             ida_bytes.BIN_SEARCH_FORWARD| ida_bytes.BIN_SEARCH_NOBREAK|ida_bytes.BIN_SEARCH_NOSHOW)33         if ea ==ida_idaapi.BADADDR:34             break
35         else:36             #这里可以稍作修改，让返回值变为当前函数的首地址
37 results.append(hex(ea))38             if num != 0 and len(results) >=num:39                 break
40     #print("find {} result".format(len(results)))
41     
42     returnresults43 
44 
45 ## 测试
46 print(SearchPattern("48 8B C4 48 89 50 ??", 3))

1 importida_bytes, ida_ua2 
3 defGenerateFunctionSignature(funcBase):4     #初始化要用到的变量
5     instruction =ida_ua.insn_t()6     offset =07     signature = ""
8     
9     #最多分析 100 条指令
10     for count in range(1, 101):11         ida_ua.decode_insn(instruction, funcBase +offset)12         offset +=instruction.size13         patternTemp = [0 for i inrange(0, instruction.size)]14         
15         
16         #遍历当前指令的全部操作数，并将部分操作数的机器码置为 ??
17         for op ininstruction.ops:18             if op.type ==o_void:19                 continue
20             #模糊位 ?? 的匹配条件：
21             #and op.type != ida_ua.o_phrase and op.type != ida_ua.o_displ
22             elif (op.type !=ida_ua.o_reg):23                 for index inrange(op.offb, instruction.size):24                     patternTemp[index] = "??"
25 
26 
27         #读入除模糊位之外的机器码
28         for index inrange(0, instruction.size):29             if patternTemp[index] == "??":30                 pass
31             else:32                 byteStr = format(ida_bytes.get_byte(instruction.ea + index), '02X')33                 patternTemp[index] =byteStr34             signature = signature + ' ' +patternTemp[index]35 
36         
37         #每分析 3 条指令，判断一次当前的 signature 是否唯一
38         if count%3 ==0:39             if len(SearchPattern(signature, 2)) == 1:40                 print('unique signature')41                 returnsignature42             else:43                 #print('not unique signature')
44                 continue
45             
46     returnNone47     
48 
49 ## 测试
50 print("pattern =", GenerateFunctionSignature(0x320E21F))