idc. http://www.cnblogs.com/fply/p/8503929.html
获取ida可执行文件路径
GetIdaDirectory() print GetIdaDirectory()
/Applications/tool/IDA Pro 7.0/ida64.app/Contents/MacOS
获取被反编译文件名
GetInputFile()
获取被反编译文件全路径
GetInputFilePath()
SetInputFilePath(path):
Set input file name
This function updates the file name that is stored in the database
It is used by the debugger and other parts of IDA
Use it when the database is moved to another location or when you
use remote debugging.
@param path: new input file path
获取idb文件全路径
GetIdbPath()
获取输入文件md5值
GetInputMD5()
从程序idb文件中获取数据
IdbByte(ea)
获取多个字节
GetManyBytes(ea, size, use_dbg = False)
获取程序ea处字节
Byte(ea)
获取多个数据，调试状态
__DbgValue(ea, len)
获取调试内存数据
DbgByte(ea)
DbgWord
DbgDword
DbgQword
读取数据，调试状态,成功返回获取数据的字符串，失败抛出异常
DbgRead(ea,size)
写数据,data为字符串形式，返回写入长度，失败返回-1
DbgWrite(ea, data)
获取原始数据，
GetOriginalByte(ea)
通过名称获取地址
LocByName(name)
print LocByName("start")#获取起始位置
从指定位置通过名称获取地址
LocByNameEx(fromaddr, name)
获取段地址
SegByBase(base)
"""
Get segment by segment base @param base: segment base paragraph or selector @return: linear address of the start of the segment or BADADDR
if no such segment
获取光标地址
ScreenEA()
here()
获取当标处汇编代码
GetCurrentLine()
print GetCurrentLine()
__text:0000000100005318 FD 03 00 91 MOV x29,sp
获取选择区域的起始位置
SelStart()
SelEnd()
获取寄存器值
GetReg(ea, reg)
print GetReg(ea,"eax")#错误返回-1
NextAddr(ea)
PrevAddr(ea)
获取下条指令或者数据位置
NextHead(ea)
PrevHead(ea)#前一条
#尾部不显示
NextNotTail(ea)
获取指令或数据起始位置
ItemHead(ea)
获取指令长度
ItemSize(ea)
NameEx(fromaddr, ea)
GetTrueNameEx(fromaddr, ea)
Demangle(name, disable_mask)
获取汇编代码
GetDisasmEx(ea, flags)
GetDisasm(ea)
print GetDisasm(ea)
MOV X19, X1
获取指令助记符
print GetMnem(ea)#MOV
获取操作码
GetOpnd(ea, n):
"""
Get operand of an instruction @param ea: linear address of instruction
@param n: number of operand:
0 - the first operand
1 - the second operand @return: the current text representation of operand or ""
print GetOpnd(ea,1)
获取操作码类型
GetOpType(ea, n)
"""
Get type of instruction operand @param ea: linear address of instruction
@param n: number of operand:
0 - the first operand
1 - the second operand @return: any of o_* constants or -1 on error o_void = idaapi.o_void # No Operand ----------
o_reg = idaapi.o_reg # General Register (al,ax,es,ds...) reg
o_mem = idaapi.o_mem # Direct Memory Reference (DATA) addr
o_phrase = idaapi.o_phrase # Memory Ref [Base Reg + Index Reg] phrase
o_displ = idaapi.o_displ # Memory Reg [Base Reg + Index Reg + Displacement] phrase+addr
o_imm = idaapi.o_imm # Immediate Value value
o_far = idaapi.o_far # Immediate Far Address (CODE) addr
o_near = idaapi.o_near # Immediate Near Address (CODE) addr
o_idpspec0 = idaapi.o_idpspec0 # Processor specific type
o_idpspec1 = idaapi.o_idpspec1 # Processor specific type
o_idpspec2 = idaapi.o_idpspec2 # Processor specific type
o_idpspec3 = idaapi.o_idpspec3 # Processor specific type
o_idpspec4 = idaapi.o_idpspec4 # Processor specific type
o_idpspec5 = idaapi.o_idpspec5 # Processor specific type
# There can be more processor specific types # x86
o_trreg = idaapi.o_idpspec0 # trace register
o_dbreg = idaapi.o_idpspec1 # debug register
o_crreg = idaapi.o_idpspec2 # control register
o_fpreg = idaapi.o_idpspec3 # floating point register
o_mmxreg = idaapi.o_idpspec4 # mmx register
o_xmmreg = idaapi.o_idpspec5 # xmm register # arm
o_reglist = idaapi.o_idpspec1 # Register list (for LDM/STM)
o_creglist = idaapi.o_idpspec2 # Coprocessor register list (for CDP)
o_creg = idaapi.o_idpspec3 # Coprocessor register (for LDC/STC)
o_fpreg_arm = idaapi.o_idpspec4 # Floating point register
o_fpreglist = idaapi.o_idpspec5 # Floating point register list
o_text = (idaapi.o_idpspec5+1) # Arbitrary text stored in the operand # ppc
o_spr = idaapi.o_idpspec0 # Special purpose register
o_twofpr = idaapi.o_idpspec1 # Two FPRs
o_shmbme = idaapi.o_idpspec2 # SH & MB & ME
o_crf = idaapi.o_idpspec3 # crfield x.reg
o_crb = idaapi.o_idpspec4 # crbit x.reg
o_dcr = idaapi.o_idpspec5 # Device control register
GetOperandValue(ea, n):
"""
Get number used in the operand This function returns an immediate number used in the operand @param ea: linear address of instruction
@param n: the operand number @return: value
operand is an immediate value => immediate value
operand has a displacement => displacement
operand is a direct memory ref => memory address
operand is a register => register number
operand is a register phrase => phrase number
otherwise => -1
LineA(ea, num)
LineB(ea, num)
获取注释
GetCommentEx(ea, repeatable)
@param repeatable: 1 to get the repeatable comment, 0 to get the normal comment
同上
CommentEx(ea, repeatable)
获取手动修改的指令参数
AltOp(ea, n)
print AltOp(ea,0)
获取指定地址字符串
GetString(ea, length = -1, strtype = ASCSTR_C)
FindVoid (ea, flag)FindCode (ea, flag)#找到下一个代码位置FindData (ea, flag)FindUnexplored (ea, flag)FindExplored (ea, flag)FindImmediate (ea, flag, value) SEARCH_UP = idaapi.SEARCH_UP # search backward
SEARCH_DOWN = idaapi.SEARCH_DOWN # search forward
SEARCH_NEXT = idaapi.SEARCH_NEXT # start the search at the next/prev item
# useful only for FindText() and FindBinary()
SEARCH_CASE = idaapi.SEARCH_CASE # search case-sensitive
# (only for bin&txt search)
SEARCH_REGEX = idaapi.SEARCH_REGEX # enable regular expressions (only for text)
SEARCH_NOBRK = idaapi.SEARCH_NOBRK # don't test ctrl-break
SEARCH_NOSHOW = idaapi.SEARCH_NOSHOW # don't display the search progress
#查找字符串
FindText(ea, flag, y, x, searchstr)
"""
@param ea: start address
@param flag: combination of SEARCH_* flags
@param y: number of text line at ea to start from (0..MAX_ITEM_LINES)
@param x: coordinate in this line
@param searchstr: search string @return: ea of result or BADADDR if not found
FindBinary(ea, flag, searchstr, radix=16)
@param ea: start address
@param flag: combination of SEARCH_* flags
@param searchstr: a string as a user enters it for Search Text in Core
@param radix: radix of the numbers (default=16)
@return: ea of result or BADADDR if not found
@note: Example: "41 42" - find 2 bytes 41h,42h (radix is 16)