src/Scripts/ImpRef.py at master · idapython/src · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
from __future__ import print_function
# -----------------------------------------------------------------------
# This is an example illustrating how to enumerate all addresses
# that refer to all imported functions in a given module
#
# (c) Hex-Rays
#
import re

import ida_kernwin
import ida_nalt
import ida_funcs

import idautils

# -----------------------------------------------------------------------
def find_imported_funcs(dllname):
    def imp_cb(ea, name, ord):
        if not name:
            name = ''
        imports.append([ea, name, ord])
        return True

    imports = []
    nimps = ida_nalt.get_import_module_qty()
    for i in range(0, nimps):
        name = ida_nalt.get_import_module_name(i)
        if re.match(dllname, name, re.IGNORECASE) is None:
            continue
        ida_nalt.enum_import_names(i, imp_cb)

    return imports


# -----------------------------------------------------------------------
def find_import_ref(dllname):
    imports = find_imported_funcs(dllname)
    R = dict()
    for i, (ea, name,_) in enumerate(imports):
        #print("%x -> %s" % (ea, name))
        for xref in idautils.XrefsTo(ea):
            # check if referrer is a thunk
            ea = xref.frm
            f = ida_funcs.get_func(ea)
            if f and (f.flags & ida_funcs.FUNC_THUNK) != 0:
                imports.append([f.start_ea, ida_funcs.get_func_name(f.start_ea), 0])
                #print("\t%x %s: from a thunk, parent added %x" % (ea, name, f.start_ea))
                continue

            # save results
            if i not in R:
                R[i] = []

            R[i].append(ea)

    return (imports, R)

# -----------------------------------------------------------------------
def main():
    dllname = ida_kernwin.ask_str('kernel32', 0, "Enter module name")
    if not dllname:
        print("Cancelled")
        return

    imports, R = find_import_ref(dllname)
    for k, v in R.items():
        print(imports[k][1])
        for ea in v:
            print("\t%x" % ea)

# -----------------------------------------------------------------------
main()