1

This is my first "serious" IDAPython script. As I sorta suspected, it's performing waaaayyyyy too slow so I wanted to ask for some pointers on this:

fp = MinEA()
end = MaxEA()

while fp < end:
    prev_inst = idc.prev_head(fp,MinEA())
    prev_prev = idc.prev_head(prev_inst,MinEA())
    next_inst = idc.next_head(fp,MaxEA())
    if idc.SegName(fp) == '.text' or idc.SegName(fp) == '.code':
        if idc.GetMnem(fp) == 'call':
            if (idc.GetOpnd(fp,0) == 'ds:GetProcAddress') or (idc.GetOpnd(fp,1) == 'ds:GetProcAddress'):
                if(idc.GetMnem(prev_inst) == 'push'):
                    if(idc.GetMnem(next_inst) == 'mov' and idc.GetMnem(prev_prev) == 'mov'):
                        print "GetProcAddress Found at %02X" % hex(fp)

This code is looking for this type of behavior (dynamic API loads): enter image description here

3

I typicall solve this by just walking over code references to the import.

Something like

for ref in CodeRefsTo(LocByName('GetTickCount'),True):
    print "%08x" % ref

This is quite powerful because unless I'm mistaken this also references snippets like this properly:

mov     esi, ds:LoadLibraryW
push    edi             ; lpLibFileName
call    esi ; LoadLibraryW

where the code reference is properly returned as the last line, not the first.

Then I typically walk the code backwards with PrevHead and GetMnem until I find the matching arguments.

0

This is a comment esque answer, but I want to give this my best shot.

Also, I'd like you to understand I'm not the best with programming, and reversing itself, so this answer is probably nowhere near the best.

There is something very odd about this assembly that any reverse engineer would probably instantly notice, and I'm very glad you've noticed it to, thats 1 step down. You'll notice there is also at the end of each opcode byte, a pattern of bytes ... 37 12 is what I mainly am talking about, this means you can possibly check if the end of the opcode bytes are the same. This is a way to locate disasm patterns. Also, by the way, there are a few find signature libraries lying around for python. Here is one, https://pypi.python.org/pypi/libsigscan-python/20170124 (I'm not sure they work with IDAPyton, who knows, by the way, maybe IDAPython has an opcode byte finding function)

Hope this helped! Good luck :)

References:

http://ask-leo.com/what_is_signature_scanning.html

  • 1
    Uhm, other than that this should really be a comment (as you point out yourself), what's so odd about 37 12? The whole instruction looks like an ordinary call with ds selector and an address. Now that the address is 0x1237.... seems logical looking at the line prefixes shown by IDA and another way to represent that call would be call DWORD PTR ds:0x1237A1AC ... – 0xC0000022L Dec 19 '17 at 22:48
  • Sorry, I meant to put more of the bytecode pattern in, but you'll notice it forms a pattern. – Graham Best Dec 20 '17 at 13:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.