Python idaapi.FUNC_LIB Examples
The following are 6
code examples of idaapi.FUNC_LIB().
You can vote up the ones you like or vote down the ones you don't like,
and go to the original project or source file by following the links above each example.
You may also want to check out all available functions/classes of the module
idaapi
, or try the search function
.
Example #1
Source File: IDATypeWrapers.py From DIE with MIT License | 6 votes |
def __init__(self, ea, iatEA=None, library_name=None): """ Ctor """ self.logger = logging.getLogger(__name__) self.ea = ea # Effective Address of the function self.iatEA = iatEA # If imported function, the address in the IAT try: function = sark.Function(ea) except sark.exceptions.SarkNoFunction: raise DIE.Lib.DIE_Exceptions.DieNoFunction("No Function at 0x%08X" % (ea, )) self.funcName = get_function_name(function.ea) self.func_start = function.startEA self.func_end = function.endEA self.proto_ea = self.getFuncProtoAdr() # Address of function prototype self.typeInfo = idaapi.tinfo_t() # Function type info self.funcInfo = idaapi.func_type_data_t() # Function info self.argNum = 0 # Number of input arguments self.args = [] # Function argument list self.retArg = None # Return argument self.library_name = library_name # If library function, name of containing library self.isLibFunc = False if self.iatEA: self.isLibFunc = True # Is this a library function elif sark.Function(ea).flags & (idaapi.FUNC_LIB | idaapi.FUNC_THUNK): self.isLibFunc = True try: self.getArguments() except Exception as ex: self.logger.error("Failed to get function arguments for function %s: %s", self.funcName, ex)
Example #2
Source File: Util.py From VMAttack with MIT License | 5 votes |
def is_import_or_lib_func(ea): """ Is ea part of an imported function or a known library? @param ea: any ea within the function scope @return: True if function is either imported or a known library function. """ return Functions(ea).flags & (idaapi.FUNC_LIB | idaapi.FUNC_THUNK)
Example #3
Source File: IDAConnector.py From DIE with MIT License | 5 votes |
def is_import_or_lib_func(ea): """ Is ea part of an imported function or a known library? @param ea: any ea within the function scope @return: True if function is either imported or a known library function. """ return sark.Function(ea).flags & (idaapi.FUNC_LIB | idaapi.FUNC_THUNK)
Example #4
Source File: function.py From Sark with MIT License | 5 votes |
def is_library(self): """ Is a library function. """ return bool(self.flags & idaapi.FUNC_LIB) # 0x00000004
Example #5
Source File: ida_prefix.py From prefix with MIT License | 5 votes |
def graph_down(ea, path=set()): """ Recursively collect all function calls. Copied with minor modifications from http://hooked-on-mnemonics.blogspot.com/2012/07/renaming-subroutine-blocks-and.html """ path.add(ea) # # extract all the call instructions from the current function # call_instructions = [] instruction_info = idaapi.insn_t() for address in idautils.FuncItems(ea): # decode the instruction if not idaapi.decode_insn(instruction_info, address): continue # check if this instruction is a call if not idaapi.is_call_insn(instruction_info): continue # save this address as a call instruction call_instructions.append(address) # # iterate through all the instructions in the target function (ea) and # inspect all the call instructions # for x in call_instructions: # TODO for r in idautils.XrefsFrom(x, idaapi.XREF_FAR): #print(0x%08X" % h, "--calls-->", "0x%08X" % r.to) if not r.iscode: continue # get the function pointed at by this call func = idaapi.get_func(r.to) if not func: continue # ignore calls to imports / library calls / thunks if (func.flags & (idaapi.FUNC_THUNK | idaapi.FUNC_LIB)) != 0: continue # # if we have not traversed to the destination function that this # call references, recurse down to it to continue our traversal # if r.to not in path: graph_down(r.to, path) return path
Example #6
Source File: function.py From ida-minsc with BSD 3-Clause "New" or "Revised" License | 5 votes |
def is_library(cls, func): '''Return true if the function `func` is considered a library function.''' fn = by(func) return fn.flags & idaapi.FUNC_LIB == idaapi.FUNC_LIB