IDApython练习1-脚本去花

这里主要是练习IDApython脚本去花

这里

jz跳转条件是zf=1，

jnz跳转条件是zf=0，

但是zf就2种可能,所以无论如何都会跳转到loc_411DDF+3的位置,等于jmp loc_411DDF+3.

这里可以等长度的nop，我们可以手动nop，这里是脚本练习，需要我们自己写

import idc
def clear(start_ea,end_ea):
    s_o_h=[0x74,0x05,0x75,0x03,0xe8,0x11,0x00]
    while start_ea<end_ea:
        if idc.get_bytes(start_ea,7)==bytes(s_o_h):
            for i in range(7):
                idc.patch_byte(start_ea+i,0x90)
        start_ea+=1

start_ea=0x00411DC0
end_ea=0x00411E1E
clear(start_ea,end_ea)
print("ok")

xor eax,eax

这个运算结果为0，zf为1

触发jz跳转

import idc
def clear(start_ea,end_ea):
    s_o_h=[0xe8,0x1a,0xe9]
    while start_ea<end_ea:
        if idc.get_bytes(start_ea,len(s_o_h))==bytes(s_o_h):
            for i in range(len(s_o_h)):
                idc.patch_byte(start_ea+i,0x90)
        start_ea+=1

start_ea=0x000411DC0
end_ea=0x00411E1E
clear(start_ea,end_ea)
print("ok")

这里call loc_400F64

会把我们的返回地址压栈

 loc_400F64:                             ; CODE XREF: sub_400F40+1E↑j
.text:0000000000400F64 58                            pop     rax           #从栈顶拿返回地址 rax=返回地址
.text:0000000000400F65 90                            nop
.text:0000000000400F66 48 83 C0 0A                   add     rax, 0Ah      #rax+=10  相当于返回地址+10
.text:0000000000400F6A 50                            push    rax           #重新把返回地址压栈
.text:0000000000400F6B C3                            retn                  #返回到返回地址

这个函数大概作用就是把返回地址+10，

我们的返回地址是.text:0000000000400F63

加10变成

.text:0000000000400F6D

import idc
def clear(start_ea,end_ea):
    s_o_h=[0xe8,0x1,0x00,0x00,0x00,0xe9,0x58,0x90,0x48,0x83,0xc0,0x0A,0x50,0xc3,0xe9]
    while start_ea<end_ea:
        if idc.get_bytes(start_ea,len(s_o_h))==bytes(s_o_h):
            for i in range(len(s_o_h)):
                idc.patch_byte(start_ea+i,0x90)
        start_ea+=1
start_ea=0x00400F40
end_ea=0x000040106F
clear(start_ea,end_ea)
print("ok")

后面发现

同样道理，但是我们写精准一点

import idc
def clear(start_ea,end_ea):
    s_o_h_head=[0xe8,0x1,0x00,0x00,0x00]
    Machine_code=0xe9
    s_o_h_tail=[0x58,0x90,0x48,0x83,0xc0,0x0A,0x50,0xc3,]
    while start_ea<end_ea:
        if idc.get_bytes(start_ea,len(s_o_h_head))==bytes(s_o_h_head):
            temp_now_ea=start_ea
            temp_now_ea+=len(s_o_h_head)+1
            if idc.get_bytes(temp_now_ea,len(s_o_h_tail))==bytes(s_o_h_tail):
                for i in range(len(s_o_h_head)+len(s_o_h_tail)+2):
                    idc.patch_byte(start_ea+i,0x90)
        start_ea+=1

start_ea=0x00004009AE
end_ea=0x00000400AB7
clear(start_ea,end_ea)
print("ok")

esp指向栈顶，而栈顶是返回地址，导致返回地址+1

确定好特征后开始写

import idc
def clear(start_ea,end_ea):
    s_o_h=[0xE8, 0x06, 0x00, 0x00, 0x00, 0xEB, 0xE9, 0x05, 0x00, 0x00,
  0x00, 0x83, 0x04, 0x24, 0x01, 0xC3]
    while start_ea<end_ea:
        if idc.get_bytes(start_ea,len(s_o_h))==bytes(s_o_h):
            for i in range(len(s_o_h)):
                idc.patch_byte(start_ea+i,0x90)
        start_ea+=1
start_ea=0x000401490
end_ea=0x0004017CD
clear(start_ea,end_ea)
print("ok")

import idc
ea_start=0x000798
ea_end=0x00F66
s_o_h=[0x72,0x03,0x73,0x01]
while ea_start<ea_end:
    if idc.get_bytes(ea_start,len(s_o_h))==bytes(s_o_h):
        for i in range(len(s_o_h)+1):
            idc.patch_byte(ea_start+i,0x90)
        ea_start+=i
    ea_start+=1
print("ok")

这里面有2种花

第一种，这种只用去掉0xeb就行

第二种

按静态分析解析成这样

import idc

def s_o_h(start_ea,end_ea):
    soh=[0xeb,0xff,0xc0,0x48]
    while start_ea<end_ea:
        if idc.get_bytes(start_ea,4)==bytes(soh):
            for i in range(3):
                idc.patch_byte(start_ea+i,0x90)
            start_ea+=3
        start_ea+=1

def s_o_h1(start_ea,end_ea):
    soh=[0x66,0xb8,0xeb,0x05,0x31,0xc0,0x74,0xfa,0xe8]
    while start_ea<end_ea:
        if idc.get_bytes(start_ea,len(soh))==bytes(soh):
            for i in range(len(soh)):
                idc.patch_byte(start_ea+i,0x90)
            start_ea+=len(soh)
        start_ea+=1           

start_ea=0x0004016C0
end_ea=0x000401A3B

s_o_h(start_ea,end_ea)
s_o_h1(start_ea,end_ea)
print("ok")