IDA Name Chang via idc Script


/////////////////////////////////////////////////////////////////////////////////////////////////////
//Change the unknow names in ida ,such as the IAT struct or the the function names created         //
//by the loadlibrary and getprocadress method.                                                     //
//The data formart show be like fallows:                                                           //
//0x007714F4  CFDictionaryRemoveValue                                                              //
//0x007714F8  CFDictionarySetValue                                                                 //
//The first is a address, and then 2 spaces ,and the last is the function name or the Global names //
//Script by obaby , site:http://www.h4ck.org.cn ,Email:root@h4ck.ws ,Date:15:50 2011-11-2          //
/////////////////////////////////////////////////////////////////////////////////////////////////////
#include 
static main()
{
 Message("====================IDA Name Chang idc Script========================\n");
 Message("                        Code By obaby                                \n");
 Message("                       http://www.h4ck.ws                            \n");
 Message("=====================================================================\n");
 auto func,addr,linetext,oldname,handle,filelen,off,funclen,file,path,oldhandle;
 file = AskFile(1,"*.txt","Please Select the map file");
 path = GetIdbPath();
 path = substr(path, 0, strlen(path) - 4) + "Namebackup.txt";// Back up orginal names
 oldhandle = fopen(path,"w");
 handle = fopen(file,"r");
 off = 0;
 if (handle == 0 || oldhandle == 0)
	{
	 Message("ReadFile or Createfile Error! \n");
	}
 else {
	 filelen = filelength(handle);
	 if (filelen == 0)
		{
			Message("The input file is empty! \n");
		}
	else {
		Message("Now BackUp Old Names and change new names..........\n");
		while (off < filelen)
			{
				linetext = readstr(handle);
				addr = substr(linetext,0,10);			//get the addres
				funclen = strlen(linetext);
				func  = substr(linetext,12,funclen -1 );//get the function name
				off = off + funclen;
				if (strlen(func) == 0)
					{
						break;
					}
				Message("Func addr is %s,and name is %s. \n",addr,func);
				oldname = Name(addr);	//get the old names
				if (strlen(oldname) ==0)
					{
						Message("Error:get name at addr %s Failed.\n",addr);
					}else {
						writestr(oldhandle,addr + "  " + oldname + "\n"); //write the old name and address into the backupfile
					}
				if (!MakeNameEx(addr,func,1))
					{
						Message("Change Paramter Name %s,at Address %X failed.\n",func,addr);
					}
			}		
		}
	fclose(handle);
	fclose(oldhandle);
	Message("Conguratelations,All successed ,now Exit.......\n");
	}
}

 

☆版权☆

* 网站名称:obaby@mars
* 网址:https://obaby.org.cn/
* 个性:https://oba.by/
* 本文标题: 《IDA Name Chang via idc Script》
* 本文链接:https://obaby.org.cn/2011/11/3245
* 短链接:https://oba.by/?p=3245
* 转载文章请标明文章来源,原文标题以及原文链接。请遵从 《署名-非商业性使用-相同方式共享 2.5 中国大陆 (CC BY-NC-SA 2.5 CN) 》许可协议。


You may also like

发表回复

您的邮箱地址不会被公开。 必填项已用 * 标注