here is the original C++ source code of the executable that I've created to do simple RE
#include <iostream>
void myFunction() {
printf("Hello!");
}
int main()
{
myFunction();
return 0;
}
When I disassembled my executable in IDA, this is the first block that I see
With the address being 0x4112c1
I've created a simple IDAPython script to find out what is the next address after the jump _main_0
from idautils import *
from idaapi import *
from idc import *
cursor = 0
start_addr = 0
end_addr = 0
print("----------Starting python script----------\n")
for func in Functions():
name = get_func_name(func)
if "_main" == name:
start_addr = get_func_attr(func, FUNCATTR_START)
end_addr = get_func_attr(func, FUNCATTR_END)
print("Start: 0x%x, End: 0x%x" %(start_addr, end_addr))
cursor = start_addr
print('0x%x %s' % (cursor, generate_disasm_line(cursor, 0)))
cur_addr = next_head(cursor, end_addr)
print("Next Head: 0x%x" %cur_addr)
print("---------Exiting Python script------")
And this is the following output:
----------Starting python script----------
Start: 0x4112c1, End: 0x4112c6
0x4112c1 jmp _main_0
Next Head: 0xffffffff
---------Exiting Python script------
I have 2 questions I would like to ask:
- May I ask why isn't the address of the next head 0x411930 (which is the address of _main_0, as shown in the screenshot below) ?
- Is it possible to make the script go to the address of the mentioned function when it detects a jump statement? (because I thought next head will do the trick)
**Disclaimer: I'm kinda new to RE and IDAPython so do bear with me if I ask too much