自己找一下规律,然后 IDA Python 自动化 patch 一下
例子来自
import capstone
import keystone
now_ea = 0x4140C0
target_hex = 'E8 00 00 00 00 83 04 24 05 C3'
target_bytes = bytes.fromhex(target_hex)
target_binpat = ida_bytes.compiled_binpat_vec_t()
ida_bytes.parse_binpat_str(target_binpat, now_ea, 'E8 00 00 00 00 83 04 24 05 C3', 16)
while True:
now_ea = ida_bytes.bin_search(
now_ea + 1,
ida_ida.inf_get_max_ea(),
target_binpat,
ida_bytes.BIN_SEARCH_FORWARD | ida_bytes.BIN_SEARCH_NOBREAK
)
print(now_ea)
if now_ea == ida_idaapi.BADADDR:
break
ida_bytes.patch_bytes(now_ea, b'\\x90'*len(target_bytes))
now_ea = 0x4140C0
target_hex = '0F 84'
target_bytes = bytes.fromhex(target_hex)
target_binpat = ida_bytes.compiled_binpat_vec_t()
ida_bytes.parse_binpat_str(target_binpat, now_ea, '0F 84', 16)
md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)
ks = keystone.Ks(keystone.KS_ARCH_X86, keystone.KS_MODE_64)
while True:
now_ea = ida_bytes.bin_search(
now_ea + 1,
ida_ida.inf_get_max_ea(),
target_binpat,
ida_bytes.BIN_SEARCH_FORWARD | ida_bytes.BIN_SEARCH_NOBREAK
)
if now_ea == ida_idaapi.BADADDR:
break
print(now_ea)
try:
ins1, ins2 = list(md.disasm(ida_bytes.get_bytes(now_ea, 12), 0))
if set([ins1.mnemonic, ins2.mnemonic]) == set(['je', 'jne']) and ins1.op_str == ins2.op_str:
data = bytes(ks.asm(f'jmp {ins1.op_str}')[0]).ljust(12, b'\\x90')
ida_bytes.patch_bytes(now_ea, data)
except:
pass
now_ea = 0x4140C0
target_hex = '74'
target_bytes = bytes.fromhex(target_hex)
target_binpat = ida_bytes.compiled_binpat_vec_t()
ida_bytes.parse_binpat_str(target_binpat, now_ea, '74', 16)
md = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)
ks = keystone.Ks(keystone.KS_ARCH_X86, keystone.KS_MODE_64)
while True:
now_ea = ida_bytes.bin_search(
now_ea + 1,
ida_ida.inf_get_max_ea(),
target_binpat,
ida_bytes.BIN_SEARCH_FORWARD | ida_bytes.BIN_SEARCH_NOBREAK
)
if now_ea == ida_idaapi.BADADDR:
break
print(now_ea)
try:
ins1, ins2 = list(md.disasm(ida_bytes.get_bytes(now_ea, 4), 0))
if set([ins1.mnemonic, ins2.mnemonic]) == set(['je', 'jne']) and ins1.op_str == ins2.op_str:
data = bytes(ks.asm(f'jmp {ins1.op_str}')[0]).ljust(4, b'\\x90')
ida_bytes.patch_bytes(now_ea, data)
except:
pass