![]() |
|
#1
|
|||
|
|||
|
Question: IDAPython how to call bin_search ?
Code:
from idaapi import *
from idautils import *
from idc import *
"""
bin_search(ea_t startEA, ea_t endEA, uchar image, uchar mask,
size_t len, int step, int flags) -> ea_t
"""
func = get_func(0x000E2324)
pattern = '123456'
mask = '000000'
ea = bin_search(func.startEA,func.endEA,pattern,mask,len(pattern),BIN_SEARCH_FORWARD,BIN_SEARCH_NOCASE)
#equal_bytes
print '%08lx'%(ea)
Quote:
|
|
#2
|
|||
|
|||
|
I recompiled IDAPython.
But I change uchar to char in function: Code:
idaman ea_t ida_export bin_search(
ea_t startEA, // area to search
ea_t endEA,
const uchar *image, // string to search
const uchar *mask, // comparision mask
size_t len, // length of string to search
int step, // direction:
int flags);
|
|
#3
|
|||
|
|||
|
bin_search()? this is how i do search:
Quote:
|
|
#4
|
|||
|
|||
|
bin_search is more powerful, allow using mask bytes.
right now, I use FindBinary too |
|
#5
|
|||
|
|||
|
I think I figured it out.
idaapi.i change Code:
%array_class(uchar, uchar_array); Code:
%array_class(unsigned char, uchar_array); Code:
func = idaapi.get_func(idaapi.get_screen_ea()) patternlen = 3 pattern = idaapi.uchar_array(patternlen) pattern[0] = 0x18; pattern[1] = 0x00; pattern[2] = 0x89; print pattern mask = idaapi.uchar_array(patternlen) mask[0] = 0xFF mask[1] = 0xFF mask[2] = 0xFF print mask ea = idaapi.bin_search(func.startEA,func.endEA,pattern,mask,patternlen,idaapi.BIN_SEARCH_FORWARD,idaapi.BIN_SEARCH_NOCASE) print '%08lx'%(ea) |
![]() |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Advanced IdaPython to change details UI cannot change | chants | General Discussion | 1 | 07-31-2019 15:46 |
| the big call >> mov eax,01 ret | crkelbery | General Discussion | 3 | 03-21-2009 06:40 |
| Fixing an EXE to not call a DLL? | Barry | General Discussion | 11 | 06-03-2004 00:37 |