IDApython script to be used during debugging to make comments using results from string decoding functions.

MakeComm_DecodingStrFunc.py

#make comms using result from string decoding functions
#27 Apr 2018
#Mark Lim @peta909

def get_string(addr):
  out = ""
  while True:
    if Byte(addr) != 0:
      out += chr(Byte(addr))
    else:
      break
    addr += 1
  return out

def dis_Decode_bpt(Daddr): #use to disable/delete break point
    for addr in idautils.CodeRefsTo(Daddr, 0):
        enable_bpt(addr,False)
        #del_bpt(addr)

def en_Decode_bpt(Daddr):
    for addr in idautils.CodeRefsTo(decodestring_addr, 0):
        addr = addr +5 #the break point is set at the instr AFTER the call to decoding function
        #print hex(addr), idc.GetDisasm(addr)
        add_bpt(addr,0,BPT_SOFT)
        enable_bpt(addr,True)

def makecomm():
    ptr_str = GetRegValue('eax') #eax point to the decoded string
    addr = GetRegValue('eip')   
    comment = get_string(ptr_str)
    #comment = ''
    print hex(addr),comment
    MakeComm(addr, comment)
    enable_bpt(addr,False)
    
        
        

import idautils
decodestring_addr = 0x0405540 #Address of the function decoding the string


dis_Decode_bpt(decodestring_addr)   
StartDebugger("","",""); 
en_Decode_bpt(decodestring_addr)

while(1):
    GetDebuggerEvent(WFNE_SUSP, -1)
    makecomm()
    idaapi.continue_process()