Skip to content

Instantly share code, notes, and snippets.

@thngkaiyuan
Last active May 27, 2016 10:39
Show Gist options
  • Save thngkaiyuan/e445ee1defcabc4d1e880e3d2e9f4275 to your computer and use it in GitHub Desktop.
Save thngkaiyuan/e445ee1defcabc4d1e880e3d2e9f4275 to your computer and use it in GitHub Desktop.
import idaapi
idaapi.CompileLine('static run() { RunPythonStatement("run()"); }')
AddHotkey("Alt-L", "run")
def print_fn_calls(fn_names):
for name in fn_names:
print name
def run_n_times(n):
fn_calls = []
for i in range(n):
GetDebuggerEvent(WFNE_SUSP, -1)
fn_name = run()
GetDebuggerEvent(WFNE_SUSP, -1)
fn_calls.append(fn_name)
print_fn_calls(fn_calls)
def run():
add_bps()
ResumeProcess()
GetDebuggerEvent(WFNE_SUSP, -1)
remove_bps()
fn_name = GetFunctionName(GetRegValue("eip"))
if not fn_name:
ea = GetRegValue("eip")
fn_name = NameEx(ea, ea)
if not fn_name:
return
print "CALL: " + fn_name
StepUntilRet()
GetDebuggerEvent(WFNE_SUSP, -1)
StepInto()
return fn_name
def add_bps():
for ea, size in bpts:
AddBptEx(ea, size, 8)
def remove_bps():
for ea, size in bpts:
DelBpt(ea)
def enum_all_modules():
mods, mod = [], GetFirstModule()
blacklist = [0x400000, 0x1100000] # process' own modules
while mod:
if mod not in blacklist:
size = GetModuleSize(mod)
mods.append((mod, size))
mod = GetNextModule(mod)
return mods
bpts = enum_all_modules()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment