Skip to content

Instantly share code, notes, and snippets.

@arizvisa
Last active September 14, 2022 21:30
Show Gist options
  • Save arizvisa/725dab358c595ab0461db4f2e7e2672d to your computer and use it in GitHub Desktop.
Save arizvisa/725dab358c595ab0461db4f2e7e2672d to your computer and use it in GitHub Desktop.
practically useless ctree shiz
F = idaapi.decompile(address)
def ctree_relexer(F, idabits=8 if idaapi.get_inf_structure().is_64bit() else 4):
iterable = (F.pseudocode[i].line for i in range(1 + F.hdrlines, F.pseudocode.size()))
items = ' '.join(iterable).split("\x01({:0{:d}s}".format('', 2 * idabits))
line, = filter(None, items)
for m in re.finditer(r"\x01\(([0-9A-F]{{{:d}}})[\1\2]([^\1\2]+)".format(2 * idabits), line):
id, x = m.groups()
idx = int(id, 0x10)
if F.treeitems.size() <= idx: continue
item = F.treeitems[idx]
yield idaapi.tag_remove(item.print1(F)), item.cexpr
return
name, index = 'malloc', 0
def ctree_parameter(F, name, index):
iterable = ctree_relexer(F)
for string, item in iterable:
if string.startswith(name + '('):
[consume for _, consume in zip(range(index), iterable)]
yield (lambda *a: a)(item.ea, string, *next(iterable))
continue
return
item = ctree_parameters[idx][-1]
def ctree_resolve(F, item):
if hasattr(item, 'operands'):
ops = item.operands
return resolve(F, ops.get('n', ops.get('v', ops.get('x', ops))))
elif hasattr(item, 'getv'):
loc = item.getv().location
return resolve(F, loc)
elif hasattr(item, 'get_reginfo'):
offset, Fregname = item.reg1(), lambda midx: '@' + idaapi.get_mreg_name(midx, 0x2318 + 1)
return Fregname(offset) if item.is_reg() else (Fregname(idaapi.reg2mreg(idaapi.ph.regnames.index('sp'))), offset - F.mba.stacksize)
elif hasattr(item, '_value'):
return item._value
return item
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment