Skip to content

Instantly share code, notes, and snippets.

@152334H
Created December 12, 2020 12:17
Show Gist options
  • Save 152334H/4e2e5031647065a6de88a73bc44b5da0 to your computer and use it in GitHub Desktop.
Save 152334H/4e2e5031647065a6de88a73bc44b5da0 to your computer and use it in GitHub Desktop.
Labelling the GOT with IDAPython+gdb-gef. Run in IDA with Alt+f7
# -*- coding: utf-8 -*-
import idaapi
import idautils
import idc
import ida_kernwin
'''SAMPLE INPUT:
0x0000555555557f18│+0x0018: 0x00007ffff7f93500 → <seccomp_init+0> endbr64
0x0000555555557f20│+0x0020: 0x00007ffff7da0430 → <__errno_location+0> endbr64
'''
'''CAVEATS:
1. This will overwrite func/var names if anything goes awry.
2. x86_64 only.
3. Will mess up if null-offsets on the GOT table are included.
This was written on a whim during X-MAS CTF 2020.
'''
from re import findall
from struct import unpack
def parse_table(s):
s = s.split('\n')
return dict((int(findall(r"\+(\w+)",l)[0],16),(findall(r"<(.*)>",l)[0][:-2] if '<' in l else None)) for l in s)
def GOT_rename(d):
GOT = idaapi.get_segm_by_name(".got").startEA
for offset,fname in d.items():
if fname is None: continue
idc.MakeNameEx(GOT+offset, fname+'_got', idc.SN_NOWARN)
funcaddr = unpack("<Q", get_bytes(GOT+offset,8))[0]
idc.MakeNameEx(funcaddr, fname+'_jmp', idc.SN_NOWARN)
pltsec = next(XrefsTo(funcaddr)).frm-4
idc.MakeNameEx(pltsec, fname+'_', idc.SN_NOWARN)
if __name__ == "__main__":
s = ida_kernwin.ask_text(99999, "", "paste in the output of `telescope $GOT 25` here:")
GOT_rename(parse_table(s))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment