IDA python 脚本

import idautils
import idaapi

补丁为nop

# 补丁为nop
def patch_nop(start, end):
  # ea = 0x0000000100FF4934
  nop = 0xD503201F
  for i in range((end - start) / 4):
    addr = start + (i * 4)
    idc.PatchDword(addr, nop)
  return

---

解析为code

# 解析为code
def make_code(start, end):
  for i in range((end - start) / 4):
    addr = start + (i * 4)
    idaapi.do_unknown_range(addr, 4, 0)
    idaapi.auto_make_code(addr)
  return

---

解析为无指令

# 解析为无指令
def make_unknown(start, end):
  for i in range((end - start) / 4):
    addr = start + (i * 4)
    idaapi.do_unknown_range(addr, 4, 0)
  return

---

查找替换指令

# 查找替换指令
def find_replace_hex(hex_value, number, replaceHex):

  addr = MinEA()
  # addr = 0x100FF494c
  for x in range(number):
    addr = idc.FindBinary(addr, SEARCH_DOWN | SEARCH_NEXT, hex_value)
    if addr != idc.BADADDR:
      idc.PatchDword(addr, replaceHex)
      print(hex(addr), idc.GetDisasm(addr))
    else:
      break

---

从addr开始，打印内容

# 从addr开始，打印内容
def get_string(addr):
  out = ""
  while True:
    if Byte(addr) != 0:
      out += chr(Byte(addr))
    else:
      break
    addr += 1
  return out

---

从addr开始，向上查找是同一字符串的地址

# 从addr开始，向上查找是同一字符串的地址
def get_addr(addr):
  out = ""
  while True:
    if Byte(addr) != 0:
      out = addr
    else:
      break
    addr -= 1
  return out

---

查找替换指令

# 查找替换指令
def find_hex(hex_value, number):
  addr = 0x9E9B6000
  number = 0x00079000
  # addr = MinEA()
  # addr = 0x100FF494c
  for x in range(number):
    addr = idc.FindBinary(addr, SEARCH_DOWN | SEARCH_NEXT, hex_value)
    if addr != idc.BADADDR:
      return addr
    else:
      break
  return 0  

#find_hex 例子
.text:0003D910 80 B5                       PUSH            {R7,LR}
.text:0003D912 6F 46                       MOV             R7, SP
.text:0003D914 82 B0                       SUB             SP, SP, #8
.text:0003D916 D7 F8 08 C0                 LDR.W           R12, [R7,#8]
.text:0003D91A F9 68                       LDR             R1, [R7,#0xC]
.text:0003D91C 00 91                       STR             R1, [SP,#0x10+var_10]
.text:0003D91E 11 46                       MOV             R1, R2
.text:0003D920 1A 46                       MOV             R2, R3
.text:0003D922 63 46                       MOV             R3, R12
.text:0003D924 D9 F7 82 FF                 BL              sub_1782C
.text:0003D928 02 B0                       ADD             SP, SP, #8
.text:0003D92A 80 BD                       POP             {R7,PC}
.text:0003D92A             ; } // 

addr = find_hex('80 B5 6F 46 82 B0 D7 F8 08 C0', MaxEA())
print(hex(addr))