I'm trying to catch epilogue/prologue of functions in IDApython. Anyone got clue/snippet/algorithm of how should I do this?
Still not entirely clear what you are hoping to do. IDA has no function that will return to you a function's prologue or epilogue. Here is some code that will iterate over all functions with some suggestions of things you might add:
for s in idautils.Functions(): f = idaapi.get_func(s) e = f.endEA #s is the start of the function e is the end of the function #You can iterate over a functions items with the following for i in idautils.FuncItems(s): #i is the ea of each function item print "%x" % i
If you have some idea of specific prologues and epilogues you are looking for (push ebp/move ebp, esp? leave/ret? pop ebp/ret?) you can always try to match the corresponding opcode sequences around the start and end EAs.
Although I'm not entirely sure what your end goal is, I have found myself when working with firmware dumps needing to find functions. Depending on the architecture, this can get interesting when you talk about function prologues. I found this script from Milad Kahsari Alhadi Blog to be useful and might be a good reference for you to look at. Effectively, this script goes through the functions that (as W S commented above) have manually defined or were defined in auto analysis and enumerates part of their "prologue", then attempts to find similar byte strings within the binary and attempts to MakeCode on them.
In the past, I have modified this script to run against one file that analyzes well in IDA (aka an ELF for the same architecture) and then spit out the "prologues" to use against a firmware image that I was too lazy to manually find functions.
NOTE: I put prologue in quotes because really this script is just taking the first opcode and checking it against mnemonics we "like". So its not truly finding arbitrary prologues which might be what you are after.