2

I am able to get Segments start address, end address and all functions of a DLL through follwoing ida python script:

# Get the segment's starting address
    ea = ScreenEA()
    print(ea)
    print(SegStart(ea),SegEnd(ea))

    callers = dict()
    callees = dict()

    # Loop through all the functions

    for function_ea in Functions(SegStart(ea), SegEnd(ea)):

        f_name = GetFunctionName(function_ea)
        print(f_name)

        # Create a set with all the names of the functions calling (referring to)
        # the current one.
        callers[f_name] = Set(map(GetFunctionName, CodeRefsTo(function_ea, 0)))

        # For each of the incoming references
        for ref_ea in CodeRefsTo(function_ea, 0):


            # Get the name of the referring function
            caller_name = GetFunctionName(ref_ea)

            # Add the current function to the list of functions
            # called by the referring function
            callees[caller_name] = callees.get(caller_name, Set())
            callees[caller_name].add(f_name)

    # Get the list of all functions
    functions = Set(callees.keys()+callers.keys())
    total_callees=0

    # For each of the functions, print the number of functions calling it and
    # number of functions being called. In short, indegree and outdegree
    for f in functions:
        print('%d:%s:%d' % (len(callers.get(f, [])), f, len(callees.get(f, []))))
        total_callees+=len(callees.get(f,[]))

    print("\nTotal callees of \t"+idaapi.get_root_filename()+"\t: "+str(total_callees))

Script is working well when invoked inside IDA pro but if it is invoked through command prompt like below:

idaq.exe -A -S"C:\xxx\segment.py" "C:\fff\yy.dll"

The output is different as below:

4294967295
(4294967295L, 4294967295L)    
Total callees of    yy.dll  : 0
2

This happens because you are starting from the ScreenEA() return value - this function returns the current EA in the disassembly window. When you're running from the command line it really can behave different.

To iterate over segments you can use idautils.Segments() function (it allows iteration over all defined segments). If you want to get the first defined segment you can use idc.FirstSeg() which should return the start address of the first segment. If you want to limit the work of your script to one segment you can check segment name with function idc.SegName(ea), where ea is an address within the segment, for example, as follows:

import idautils
import idc

for s in idautils.Segments():
    if idc.SegName(s) == "your_segment_name":
         #do you work here

By the way, 4294967295 in hex is 0xffffffff which is numeric value of idc.BADADDR, which means invalid address or error.

| improve this answer | |
  • Thanks! but unable to pass arguments to script...idaq64 -A -S"myscrip.py outpath.txt" "bin_path" gives idc.argv[0] argument error while running the script – user3264821 Jun 29 '16 at 4:14
  • did you use it as idc.argv or as idc.ARGV ? – w s Jun 29 '16 at 5:31
  • idc.ARGV and its working :) last doubt ! how to find hanging instructions i.e those intructions which are not under any function module in a DLL using IDAPython? – user3264821 Jun 29 '16 at 10:53
  • I'd suggest to ask it as different question. – w s Jun 29 '16 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.