zoukankan      html  css  js  c++  java
  • 函数功能相关

    idc 

    http://www.cnblogs.com/fply/p/8506225.html 

    创建函数

    MakeFunction(start, end = idaapi.BADADDR)

    删除函数

     DelFunction(ea)

    修数结束位置

    SetFunctionEnd(ea, end)


    查找下一个函数

    NextFunction(ea)

    上一个函数

    PrevFunction(ea)

    获取设置函数属性

    GetFunctionAttr(ea, attr)

    SetFunctionAttr(ea, attr, value)

    FUNCATTR_START   =  0     # function start address
    FUNCATTR_END     =  4     # function end address
    FUNCATTR_FLAGS   =  8     # function flags
    FUNCATTR_FRAME   = 10     # function frame id
    FUNCATTR_FRSIZE  = 14     # size of local variables
    FUNCATTR_FRREGS  = 18     # size of saved registers area
    FUNCATTR_ARGSIZE = 20     # number of bytes purged from the stack
    FUNCATTR_FPD     = 24     # frame pointer delta
    FUNCATTR_COLOR   = 28     # function color code
    FUNCATTR_OWNER   = 10     # chunk owner (valid only for tail chunks)
    FUNCATTR_REFQTY  = 14     # number of chunk parents (valid only for tail chunks)
    
    # Redefining the constants for 64-bit
    if __EA64__:
        FUNCATTR_START   = 0
        FUNCATTR_END     = 8
        FUNCATTR_FLAGS   = 16
        FUNCATTR_FRAME   = 18
        FUNCATTR_FRSIZE  = 26
        FUNCATTR_FRREGS  = 34
        FUNCATTR_ARGSIZE = 36
        FUNCATTR_FPD     = 44
        FUNCATTR_COLOR   = 52
        FUNCATTR_OWNER   = 18
        FUNCATTR_REFQTY  = 26
    
    
    _FUNCATTRMAP = {
        FUNCATTR_START   : (True, 'startEA'),
        FUNCATTR_END     : (True, 'endEA'),
        FUNCATTR_FLAGS   : (False, 'flags'),
        FUNCATTR_FRAME   : (True, 'frame'),
        FUNCATTR_FRSIZE  : (True, 'frsize'),
        FUNCATTR_FRREGS  : (True, 'frregs'),
        FUNCATTR_ARGSIZE : (True, 'argsize'),
        FUNCATTR_FPD     : (False, 'fpd'),
        FUNCATTR_COLOR   : (False, 'color'),
        FUNCATTR_OWNER   : (True, 'owner'),
        FUNCATTR_REFQTY  : (True, 'refqty')
    }

    获取函数flag

    GetFunctionFlags(ea)

    SetFunctionFlags(ea, flags)

    FUNC_NORET         = idaapi.FUNC_NORET         # function doesn't return
    FUNC_FAR           = idaapi.FUNC_FAR           # far function
    FUNC_LIB           = idaapi.FUNC_LIB           # library function
    FUNC_STATIC        = idaapi.FUNC_STATICDEF     # static function
    FUNC_FRAME         = idaapi.FUNC_FRAME         # function uses frame pointer (BP)
    FUNC_USERFAR       = idaapi.FUNC_USERFAR       # user has specified far-ness
                                                    # of the function
    FUNC_HIDDEN        = idaapi.FUNC_HIDDEN        # a hidden function
    FUNC_THUNK         = idaapi.FUNC_THUNK         # thunk (jump) function
    FUNC_BOTTOMBP      = idaapi.FUNC_BOTTOMBP      # BP points to the bottom of the stack frame
    FUNC_NORET_PENDING = idaapi.FUNC_NORET_PENDING # Function 'non-return' analysis
                                                    # must be performed. This flag is
                                                    # verified upon func_does_return()
    FUNC_SP_READY      = idaapi.FUNC_SP_READY      # SP-analysis has been performed
                                                    # If this flag is on, the stack
                                                    # change points should not be not
                                                    # modified anymore. Currently this
                                                    # analysis is performed only for PC
    FUNC_PURGED_OK     = idaapi.FUNC_PURGED_OK     # 'argsize' field has been validated.
                                                    # If this bit is clear and 'argsize'
                                                    # is 0, then we do not known the real
                                                    # number of bytes removed from
                                                    # the stack. This bit is handled
                                                    # by the processor module.
    FUNC_TAIL          = idaapi.FUNC_TAIL          # This is a function tail.
                                                    # Other bits must be clear
                                                    # (except FUNC_HIDDEN)

    获取函数名

    GetFunctionName(ea)

    获取函数i注释

    GetFunctionCmt(ea, repeatable)

    SetFunctionCmt(ea, cmt, repeatable)

    用户选择一个函数 与ctrl+p相同功能

    ChooseFunction(title)

    获取函数 地址+函数名信息

    GetFuncOffset(ea)

    FindFuncEnd(ea)
    """
    Determine a new function boundaries

    GetFrame(ea)
    """
    Get ID of function frame structure

    GetFrameLvarSize(ea)

    GetFrameRegsSize(ea)
    """
    Get size of saved registers in function frame

    GetSpd(ea)
    """
    Get current delta for the stack pointer

    GetSpDiff(ea)
    Get modification of SP made by the instruction

    SetSpDiff(ea, delta):
    """
    Setup modification of SP made by the instruction

  • 相关阅读:
    Circular dependency issuse on cocoapods version(0.36.0) 全然解决方式(非降版本号)
    Android Studio经常使用配置及使用技巧(二)
    poj 2195 Going Home(最小费最大流)
    OpenFace库(Tadas Baltrusaitis)中基于Haar Cascade Classifiers进行人脸检測的測试代码
    Divisibility by Eight
    hdu 5055(坑)
    微服务(Microservices)
    mysql 运行计划explain具体解释
    URAL 题目1297. Palindrome(后缀数组+RMQ求最长回文子串)
    Windows下将nginx安装为服务运行
  • 原文地址:https://www.cnblogs.com/fply/p/8506225.html
Copyright © 2011-2022 走看看