Skip to content

Instantly share code, notes, and snippets.

Embed
What would you like to do?
IDApython script to be used during debugging to make comments using results from string decoding functions.
#make comms using result from string decoding functions
#27 Apr 2018
#Mark Lim @peta909
def get_string(addr):
out = ""
while True:
if Byte(addr) != 0:
out += chr(Byte(addr))
else:
break
addr += 1
return out
def dis_Decode_bpt(Daddr): #use to disable/delete break point
for addr in idautils.CodeRefsTo(Daddr, 0):
enable_bpt(addr,False)
#del_bpt(addr)
def en_Decode_bpt(Daddr):
for addr in idautils.CodeRefsTo(decodestring_addr, 0):
addr = addr +5 #the break point is set at the instr AFTER the call to decoding function
#print hex(addr), idc.GetDisasm(addr)
add_bpt(addr,0,BPT_SOFT)
enable_bpt(addr,True)
def makecomm():
ptr_str = GetRegValue('eax') #eax point to the decoded string
addr = GetRegValue('eip')
comment = get_string(ptr_str)
#comment = ''
print hex(addr),comment
MakeComm(addr, comment)
enable_bpt(addr,False)
import idautils
decodestring_addr = 0x0405540 #Address of the function decoding the string
dis_Decode_bpt(decodestring_addr)
StartDebugger("","","");
en_Decode_bpt(decodestring_addr)
while(1):
GetDebuggerEvent(WFNE_SUSP, -1)
makecomm()
idaapi.continue_process()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment