mirror of
https://github.com/JHUAPL/IDAPythonEmbeddedToolkit.git
synced 2026-01-09 15:18:05 -05:00
49 lines
2.5 KiB
Python
49 lines
2.5 KiB
Python
##############################################################################################
|
|
# Copyright 2017 The Johns Hopkins University Applied Physics Laboratory LLC
|
|
# All rights reserved.
|
|
# Permission is hereby granted, free of charge, to any person obtaining a copy of this
|
|
# software and associated documentation files (the "Software"), to deal in the Software
|
|
# without restriction, including without limitation the rights to use, copy, modify,
|
|
# merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
|
|
# permit persons to whom the Software is furnished to do so.
|
|
#
|
|
# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
|
|
# INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
|
|
# PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE
|
|
# LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
|
# TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE
|
|
# OR OTHER DEALINGS IN THE SOFTWARE.
|
|
|
|
##############################################################################################
|
|
# identify_operand_locations.py
|
|
# Identifies the instructions in the range start_addr to end_addr that reference the
|
|
# input operand (regex_operand). The addresses of all instructions where the operand is
|
|
# found are printed to the IDA output window and saved to a file.
|
|
#
|
|
# User-Defined Input:
|
|
# ** Before use, edit the regex_operand regular expression to match how the operand of interest
|
|
# is displayed in instructions.
|
|
# ** If you do not want to search the entire database, change start_addr and end_addr.
|
|
#
|
|
##############################################################################################
|
|
|
|
# UPDATE THIS VALUE FOR THE REFERENCES TO THE OPERAND YOU'RE LOOKING FOR
|
|
regex_operand = re.compile(r"\[ebp+arg_4\]")
|
|
|
|
start_addr = AskAddr(MinEA(), "Please enter the starting address for the code to be analyzed.")
|
|
end_addr = AskAddr(MaxEA(), "Please enter the ending address for the code to be analyzed.")
|
|
|
|
default_fn = "operand_locations.txt"
|
|
filename = AskFile(1, default_fn, "Please choose the location to save the operand use locations file.")
|
|
|
|
curr_addr = start_addr
|
|
with open(filename, "w") as out_file:
|
|
while curr_addr < end_addr:
|
|
if (isCode(GetFlags(curr_addr))):
|
|
instruct = GetDisasm(curr_addr);
|
|
if regex_operand.search(instruct):
|
|
out_file.write(("0x%08x: " % curr_addr) + instruct);
|
|
print ("0x%08x: " % curr_addr) + instruct
|
|
curr_addr = NextHead(curr_addr)
|
|
|
|
|