Created
January 14, 2025 20:24
-
-
Save CodeCouturiers/d6c554c4c5605a7c8304433209d80dc3 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import ida_kernwin | |
import ida_idaapi | |
import ida_name | |
import ida_funcs | |
import idautils | |
import idc | |
class ExitFinder(ida_kernwin.Choose): | |
def __init__(self): | |
ida_kernwin.Choose.__init__(self, | |
"Найденные exit вызовы", | |
[ | |
["Адрес", 16], | |
["Тип", 20], | |
["Дополнительно", 40] | |
]) | |
self.items = [] | |
self.find_exits() | |
def find_exits(self): | |
# Поиск прямых вызовов exit | |
for ea in idautils.Functions(): | |
func_name = idc.get_func_name(ea) | |
if "exit" in func_name.lower(): | |
self.items.append([hex(ea), "Функция exit", func_name]) | |
# Поиск вызовов exit через импорты | |
nimps = ida_name.get_nlist_size() | |
for i in range(nimps): | |
name = ida_name.get_nlist_name(i) | |
if name and "exit" in name.lower(): | |
ea = ida_name.get_nlist_ea(i) | |
for xref in idautils.XrefsTo(ea): | |
func = idc.get_func_name(xref.frm) | |
self.items.append([hex(xref.frm), "Вызов " + name, f"Из {func}"]) | |
def OnGetLine(self, n): | |
return self.items[n] | |
def OnGetSize(self): | |
return len(self.items) | |
def OnSelectLine(self, n): | |
addr = int(self.items[n][0], 16) | |
ida_kernwin.jumpto(addr) | |
return True | |
def main(): | |
chooser = ExitFinder() | |
chooser.Show() | |
main() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment