I'm new in IDA Python, so the question is hard for me. I didn't find any solution in google, so I have to ask for the help there. During code analysis I found decryption function. There are about 1000 calls of this function with different arguments. The function takes one argument - encrypted string, which address is moved to eax before the calling. I'd like to write script for running the function for all encrypted strings. I find address of the function using idc.LocByName. Then I found all references to this function (using idautils.CodeRefsTo(addr, 1)). Now I to find the function's argument for each reference and call the function with this argument. Could you please advise the way I can do it? Thanks.
1 Answer
In general you have 3 possibilities:
1 - Recover arguments statically and use AppCall either with IDC or IDAPython in debug session
2 - Rewrite decryption function in python, recover arguments statically and run the recovered function on each occurrence.
3 - Use something like PyEmu for running functions.
Usually I find variant 2 easier then others.
-
Thanks. Variant two looks like solution. I'll try to implement it. Aug 15, 2018 at 8:40