What is a more efficient way to locate disasm patterns in IDAPython?

Question

This is my first "serious" IDAPython script. As I sorta suspected, it's performing waaaayyyyy too slow so I wanted to ask for some pointers on this:

fp = MinEA()
end = MaxEA()

while fp < end:
    prev_inst = idc.prev_head(fp,MinEA())
    prev_prev = idc.prev_head(prev_inst,MinEA())
    next_inst = idc.next_head(fp,MaxEA())
    if idc.SegName(fp) == '.text' or idc.SegName(fp) == '.code':
        if idc.GetMnem(fp) == 'call':
            if (idc.GetOpnd(fp,0) == 'ds:GetProcAddress') or (idc.GetOpnd(fp,1) == 'ds:GetProcAddress'):
                if(idc.GetMnem(prev_inst) == 'push'):
                    if(idc.GetMnem(next_inst) == 'mov' and idc.GetMnem(prev_prev) == 'mov'):
                        print "GetProcAddress Found at %02X" % hex(fp)

This code is looking for this type of behavior (dynamic API loads):

Answer 1

I typicall solve this by just walking over code references to the import.

Something like

for ref in CodeRefsTo(LocByName('GetTickCount'),True):
    print "%08x" % ref

This is quite powerful because unless I'm mistaken this also references snippets like this properly:

mov     esi, ds:LoadLibraryW
push    edi             ; lpLibFileName
call    esi ; LoadLibraryW

where the code reference is properly returned as the last line, not the first.

Then I typically walk the code backwards with PrevHead and GetMnem until I find the matching arguments.

Answer 2

This is a comment esque answer, but I want to give this my best shot.

Also, I'd like you to understand I'm not the best with programming, and reversing itself, so this answer is probably nowhere near the best.

There is something very odd about this assembly that any reverse engineer would probably instantly notice, and I'm very glad you've noticed it to, thats 1 step down. You'll notice there is also at the end of each opcode byte, a pattern of bytes ... 37 12 is what I mainly am talking about, this means you can possibly check if the end of the opcode bytes are the same. This is a way to locate disasm patterns. Also, by the way, there are a few find signature libraries lying around for python. Here is one, https://pypi.python.org/pypi/libsigscan-python/20170124 (I'm not sure they work with IDAPyton, who knows, by the way, maybe IDAPython has an opcode byte finding function)

Hope this helped! Good luck :)

References:

http://ask-leo.com/what_is_signature_scanning.html