1

I'm new in IDA Python, so the question is hard for me. I didn't find any solution in google, so I have to ask for the help there. During code analysis I found decryption function. There are about 1000 calls of this function with different arguments. The function takes one argument - encrypted string, which address is moved to eax before the calling. I'd like to write script for running the function for all encrypted strings. I find address of the function using idc.LocByName. Then I found all references to this function (using idautils.CodeRefsTo(addr, 1)). Now I to find the function's argument for each reference and call the function with this argument. Could you please advise the way I can do it? Thanks.

1 Answer 1

0

In general you have 3 possibilities:

1 - Recover arguments statically and use AppCall either with IDC or IDAPython in debug session

2 - Rewrite decryption function in python, recover arguments statically and run the recovered function on each occurrence.

3 - Use something like PyEmu for running functions.

Usually I find variant 2 easier then others.

1
  • Thanks. Variant two looks like solution. I'll try to implement it. Aug 15, 2018 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.