zoukankan      html  css  js  c++  java
  • 函数功能相关

    idc 

    http://www.cnblogs.com/fply/p/8506225.html 

    创建函数

    MakeFunction(start, end = idaapi.BADADDR)

    删除函数

     DelFunction(ea)

    修数结束位置

    SetFunctionEnd(ea, end)


    查找下一个函数

    NextFunction(ea)

    上一个函数

    PrevFunction(ea)

    获取设置函数属性

    GetFunctionAttr(ea, attr)

    SetFunctionAttr(ea, attr, value)

    FUNCATTR_START   =  0     # function start address
    FUNCATTR_END     =  4     # function end address
    FUNCATTR_FLAGS   =  8     # function flags
    FUNCATTR_FRAME   = 10     # function frame id
    FUNCATTR_FRSIZE  = 14     # size of local variables
    FUNCATTR_FRREGS  = 18     # size of saved registers area
    FUNCATTR_ARGSIZE = 20     # number of bytes purged from the stack
    FUNCATTR_FPD     = 24     # frame pointer delta
    FUNCATTR_COLOR   = 28     # function color code
    FUNCATTR_OWNER   = 10     # chunk owner (valid only for tail chunks)
    FUNCATTR_REFQTY  = 14     # number of chunk parents (valid only for tail chunks)
    
    # Redefining the constants for 64-bit
    if __EA64__:
        FUNCATTR_START   = 0
        FUNCATTR_END     = 8
        FUNCATTR_FLAGS   = 16
        FUNCATTR_FRAME   = 18
        FUNCATTR_FRSIZE  = 26
        FUNCATTR_FRREGS  = 34
        FUNCATTR_ARGSIZE = 36
        FUNCATTR_FPD     = 44
        FUNCATTR_COLOR   = 52
        FUNCATTR_OWNER   = 18
        FUNCATTR_REFQTY  = 26
    
    
    _FUNCATTRMAP = {
        FUNCATTR_START   : (True, 'startEA'),
        FUNCATTR_END     : (True, 'endEA'),
        FUNCATTR_FLAGS   : (False, 'flags'),
        FUNCATTR_FRAME   : (True, 'frame'),
        FUNCATTR_FRSIZE  : (True, 'frsize'),
        FUNCATTR_FRREGS  : (True, 'frregs'),
        FUNCATTR_ARGSIZE : (True, 'argsize'),
        FUNCATTR_FPD     : (False, 'fpd'),
        FUNCATTR_COLOR   : (False, 'color'),
        FUNCATTR_OWNER   : (True, 'owner'),
        FUNCATTR_REFQTY  : (True, 'refqty')
    }

    获取函数flag

    GetFunctionFlags(ea)

    SetFunctionFlags(ea, flags)

    FUNC_NORET         = idaapi.FUNC_NORET         # function doesn't return
    FUNC_FAR           = idaapi.FUNC_FAR           # far function
    FUNC_LIB           = idaapi.FUNC_LIB           # library function
    FUNC_STATIC        = idaapi.FUNC_STATICDEF     # static function
    FUNC_FRAME         = idaapi.FUNC_FRAME         # function uses frame pointer (BP)
    FUNC_USERFAR       = idaapi.FUNC_USERFAR       # user has specified far-ness
                                                    # of the function
    FUNC_HIDDEN        = idaapi.FUNC_HIDDEN        # a hidden function
    FUNC_THUNK         = idaapi.FUNC_THUNK         # thunk (jump) function
    FUNC_BOTTOMBP      = idaapi.FUNC_BOTTOMBP      # BP points to the bottom of the stack frame
    FUNC_NORET_PENDING = idaapi.FUNC_NORET_PENDING # Function 'non-return' analysis
                                                    # must be performed. This flag is
                                                    # verified upon func_does_return()
    FUNC_SP_READY      = idaapi.FUNC_SP_READY      # SP-analysis has been performed
                                                    # If this flag is on, the stack
                                                    # change points should not be not
                                                    # modified anymore. Currently this
                                                    # analysis is performed only for PC
    FUNC_PURGED_OK     = idaapi.FUNC_PURGED_OK     # 'argsize' field has been validated.
                                                    # If this bit is clear and 'argsize'
                                                    # is 0, then we do not known the real
                                                    # number of bytes removed from
                                                    # the stack. This bit is handled
                                                    # by the processor module.
    FUNC_TAIL          = idaapi.FUNC_TAIL          # This is a function tail.
                                                    # Other bits must be clear
                                                    # (except FUNC_HIDDEN)

    获取函数名

    GetFunctionName(ea)

    获取函数i注释

    GetFunctionCmt(ea, repeatable)

    SetFunctionCmt(ea, cmt, repeatable)

    用户选择一个函数 与ctrl+p相同功能

    ChooseFunction(title)

    获取函数 地址+函数名信息

    GetFuncOffset(ea)

    FindFuncEnd(ea)
    """
    Determine a new function boundaries

    GetFrame(ea)
    """
    Get ID of function frame structure

    GetFrameLvarSize(ea)

    GetFrameRegsSize(ea)
    """
    Get size of saved registers in function frame

    GetSpd(ea)
    """
    Get current delta for the stack pointer

    GetSpDiff(ea)
    Get modification of SP made by the instruction

    SetSpDiff(ea, delta):
    """
    Setup modification of SP made by the instruction

  • 相关阅读:
    HTML+CSS,让div在屏幕中居中(水平居中+垂直居中)方法总结
    HTML+CSS,让div在屏幕中居中(水平居中+垂直居中)方法总结
    How to set the Default Page in ASP.NET?
    百练1089:数字反转
    百练1089:数字反转
    【分治的典型应用:归并排序】
    【分治的典型应用:归并排序】
    【分治的典型应用:归并排序】
    【分治的典型应用:快速排序】
    【分治的典型应用:快速排序】
  • 原文地址:https://www.cnblogs.com/fply/p/8506225.html
Copyright © 2011-2022 走看看