cisco路由器固件字符串修复ida脚本

cisco路由器固件反汇编后部分字符串可能无法正确解析：很多字符串由于前面有个\n符号，ida解析的时候不认为前一部分是字符串，导致字符串解析不完整，只把后面一段解析成了字符串。

由此造成F5的时候部分引用字符串代码让人看不懂，而且直接在字符串上按X查看交叉引用会发现找不到交叉引用。

以下脚本可以修复字符串解析不完整的情况。

注意，请在IDA7.5，python3.8环境下食用！

from idaapi import *
import idautils
import idc

def setString():
    for seg in idautils.Segments():
        segName = idc.get_segm_name(seg)
        if segName != '.rodata' and segName != '.data':
            continue
        segStart = idc.get_segm_start(seg)
        segEnd = idc.get_segm_end(seg)
        print(segName,hex(segStart),hex(segEnd))

        start = segStart
        num = 0
        while start <= segEnd:
            flag = idc.create_strlit(start,BADADDR)
            if flag:
                newStr = idc.guess_type(start)
                if 'char[' == newStr[:5] and ']' == newStr[-1:]:
                    strLen = int(newStr[5:-1])
                    start += strLen
                    num += 1
                    continue
                else:
                    idc.create_byte(start)
            start += 1
        print('set ' + str(num) + ' to string')

#setString()
#ea = idc.get_screen_ea()
#print(type(ea))
#value = idc.get_wide_byte(ea)
#print(value)
#bb = idc.guess_type(ea)
#print(bb)
#print(hex(ea))
#flag = idc.create_byte(ea)
#if flag:
#    print('success')
#else:
#    print('fail')
#addr = idc.get_wide_dword(ea)
#print(hex(addr))
#liii = list(idautils.DataRefsFrom(ea))
#print(len(liii))
#print(liii)
'''
danger_funcs = ["sub_80D1FC3C"]
for func in danger_funcs:
    addr = idc.get_name_ea_simple(func)
    if addr != BADADDR:
        cross_refs = CodeRefsTo(addr, 0)
        print("Cross References to %s" % func)
        print("-------------------------------")
        for ref in cross_refs:
            print("%08x" % ref)
            idc.set_color( ref, CIC_ITEM, 0x0000ff)
'''

标签：segName,cisco,get,seg,字符串,固件,解析,idc,ida
来源： https://www.cnblogs.com/husterlong/p/16103349.html