idapython获取cpython数据

cpython中使用结构体封装数据，简单写了个脚本快速转化获取数据

可以获取选中地址的数据，或者所有寄存器的值

输出内容如下：

import idaapi
import ida_bytes
import ida_funcs
import ida_name
from ida_bytes import get_bytes, patch_byte, patch_dword
from idautils import CodeRefsTo
import ida_kernwin
import ida_bytes
import idc
import ida_nalt
import os
REGS = ["RAX", "RBX", "RCX", "RDX", "R8", "R9", "R10", "R11", "R12", "R13", "R14", "R15"]

ACTION_GETMEMDATA = "devil:getmemdata"
ACTION_GETREGDATA = "devil:getregdata"
ACTION_GETIMPORTFUN = "devil:getimportfun"
ACTION_EXPORTSTRUCTURE = "devil:getexportstructures"
def export_structures():
    """导出所有结构体定义到指定目录，每个结构体一个文件"""
    output_dir="structures_output"
    if not os.path.exists(output_dir):
        os.makedirs(output_dir)
    sid = idaapi.get_first_struc_idx()
    while sid != idaapi.BADADDR:
        struc_id = idaapi.get_struc_by_idx(sid)
        struct = idaapi.get_struc(struc_id)

        if struct:
            struct_name = idaapi.get_struc_name(struct.id)
            safe_struct_name = struct_name.replace("::", "_").replace("<", "_").replace(">", "_")
            output_file = os.path.join(output_dir, f"{safe_struct_name}.h")

            try:
                with open(output_file, "w", encoding="utf-8") as f:
                    f.write(f"struct {struct_name} {{\n")
                    for member in struct.members:
                        m_name = idaapi.get_member_name(member.id) or "unnamed_member"
                        m_offset = member.soff
                        m_size = idaapi.get_member_size(member)
                        tif = idaapi.tinfo_t()
                        if idaapi.get_member_tinfo(tif, member):
                            m_type_str = tif.dstr()
                        else:
                            m_type_str = "unknown"
                        f.write(f"    {m_type_str} {m_name}; // offset: 0x{m_offset:X}, size: {m_size}\n")

                    f.write("};\n\n")

                print(f"结构体 {struct_name} 已导出到 {output_file}")
            except OSError as e:
                print(f"无法导出结构体 {struct_name} 到文件 {output_file}: {e}")

        sid = idaapi.get_next_struc_idx(sid)


def get_external_functions():
    if not idaapi.is_debugger_on():
        return
    nimps = idaapi.get_import_module_qty()

    for i in range(nimps):
        # 获取模块名称
        module_name = idaapi.get_import_module_name(i)
        if not module_name:
            continue

        # 使用回调函数处理每个导入函数
        def imp_cb(ea, name, ordinal):
            if name:
                print(f"Address: {hex(ida_bytes.get_qword(ea))}, Function: {name}")
            return True

        # 枚举该模块的所有导入函数
        idaapi.enum_import_names(i, imp_cb)

'''相当于2**30进制，转化一下数据'''
def convert2Long(data, length):
    result = 0
    for i in range(length):
        result += (data[i] << (30 * i))
    return result


'''获取PyLong'''
def getLong(addr):
    ispyd = idaapi.get_root_filename().endswith("pyd")
    addr += 0x8
    length = ida_bytes.get_qword(addr + 0x8)
    if ispyd:
        length//=8
    data = [ida_bytes.get_dword(addr + 0x8 * 2 + 0x4 * (i)) for i in range(length)]
    data = convert2Long(data, length)
    return data


'''获取PyList'''
def getList(addr):
    addr+=0x8
    length = ida_bytes.get_qword(addr + 0x8)
    listAddr = ida_bytes.get_qword(addr + 0x10)
    test=ida_bytes.get_qword(listAddr)
    if test==0:
        return []
    data = [getLong(ida_bytes.get_qword(listAddr + 0x8 * i)) for i in range(length)]
    return data
def getTuple(addr):
    length=ida_bytes.get_qword(addr+0x10)
    if length==0:
        return []
    data=[getLong(ida_bytes.get_qword(addr+0x18+0x8*i)) for i in range(length)]
    return data


def getRange(addr):
    addr+=0x8
    data = [getLong(ida_bytes.get_qword(addr + 0x8 + 0x8 * i)) for i in range(3)]
    return data

def getString(addr):
    strtype = ida_nalt.STRTYPE_C
    max_length = ida_bytes.get_max_strlit_length(addr, ida_nalt.STRTYPE_C)
    string = ida_bytes.get_strlit_contents(addr, max_length, strtype)
    if string:
        return string.decode('utf-8')

def getBytes(addr):
    addr+=8
    length=ida_bytes.get_qword(addr+0x8)
    result=ida_bytes.get_bytes(addr+0x18,length)
    return result

def read_ptr(ea):
  if idaapi.get_inf_structure().is_64bit():
    return idaapi.get_qword(ea)
  return idaapi.get_dword(ea)

def getMemData(selected_address=None, info="",tag=""):
    # 获取当前选中的地址
    if selected_address == None:
        selected_address = ida_kernwin.get_screen_ea()
    try:
        type = idc.get_name(ida_bytes.get_qword(selected_address + 0x8))
    except:
        return
    if type and type.startswith("python"):
        if info != "":
            info = info + "-->"
        if type.endswith("PyLong_Type"):
            print(info + "PyLong_Type:", hex(getLong(selected_address)))
        if type.endswith("PyList_Type"):
            data = getList(selected_address)
            print(info + "PyList_Type:["+",".join(map(hex, data))+"]")
        if type.endswith("PyRange_Type"):
            print(info + "PyRange_Type:", end="")
            print("("+",".join(map(hex,getRange(selected_address)))+")")
        if type.endswith("PyType_Type"):
            print(info + "PyType_Type:", end="")
            print(getString(ida_bytes.get_qword(selected_address+0x18)))
        if type.endswith("PyBytes_Type"):
            print(info + "PyBytes_Type:", end="")
            print(str(getBytes(selected_address)))
        if type.endswith("PyUnicode_Type"):
            print(info + "PyUnicode_Type:", end="")
            print(getString(selected_address+0x28))
        if type.endswith("PyTuple_Type"):
            print(info + "PyTuple_Type:", end="")
            print("("+",".join(map(hex, getTuple(selected_address)))+")")


    else:
        if tag=="":
            getMemData(read_ptr(selected_address),info,"tag")


def getRegData():
    print("\n\n\n----------------reg's data------------------------")
    for reg in REGS:
        getMemData(idc.get_reg_value(reg), reg)

class menu_action_handler_t(idaapi.action_handler_t):
    """
    Action handler for menu actions
    """

    def __init__(self, action):
        idaapi.action_handler_t.__init__(self)
        self.action = action

    def activate(self, ctx):
        if self.action == ACTION_GETMEMDATA:
            getMemData()
        if self.action == ACTION_GETREGDATA:
            getRegData()
        if self.action == ACTION_GETIMPORTFUN:
            get_external_functions()
        if self.action == ACTION_EXPORTSTRUCTURE:
            export_structures()

    def update(self, ctx):
        return idaapi.AST_ENABLE_ALWAYS


class UI_Hook(idaapi.UI_Hooks):
    def __init__(self):
        idaapi.UI_Hooks.__init__(self)

    def finish_populating_widget_popup(self, form, popup):
        form_type = idaapi.get_widget_type(form)
        # 判断窗口
        if form_type == idaapi.BWN_DISASM or form_type == idaapi.BWN_DUMP:
            # 用于获取当前活动窗口（view）中的选定区域，并将选定区域的起始地址和结束地址分别存储在 t0 和 t1 中
            # t0, t1, view = idaapi.twinpos_t(), idaapi.twinpos_t(), idaapi.get_current_viewer()
            # if idaapi.read_selection(view, t0, t1) or idc.get_item_size(idc.get_screen_ea()) > 1:
            idaapi.attach_action_to_popup(form, popup, ACTION_GETMEMDATA, "devil/")
            idaapi.attach_action_to_popup(form, popup, ACTION_GETREGDATA, "devil/")
            idaapi.attach_action_to_popup(form, popup, ACTION_GETIMPORTFUN, "devil/")
            idaapi.attach_action_to_popup(form, popup, ACTION_EXPORTSTRUCTURE, "devil/")


def PLUGIN_ENTRY():
    return MyIDAPlugin()


class MyIDAPlugin(idaapi.plugin_t):
    flags = idaapi.PLUGIN_KEEP
    comment = "Devil's plugin"
    help = "Devil's plugin"
    wanted_name = "Devil's plugin"
    wanted_hotkey = "Ctrl-F8"

    def init(self):

        self.hexrays_inited = False
        self.registered_actions = []
        self.registered_hx_actions = []

        global ARCH
        global BITS
        ARCH = idaapi.ph_get_id()
        info = idaapi.get_inf_structure()
        if info.is_64bit():
            BITS = 64
        elif info.is_32bit():
            BITS = 32
        else:
            BITS = 16
            # Register menu actions

        menu_actions = (
            idaapi.action_desc_t(ACTION_GETMEMDATA, "GetMemData", menu_action_handler_t(ACTION_GETMEMDATA), None,
                                 None, 80),
            idaapi.action_desc_t(ACTION_GETREGDATA, "GetRegData", menu_action_handler_t(ACTION_GETREGDATA), None,
                                 None, 80),
            idaapi.action_desc_t(ACTION_GETIMPORTFUN, "GetImportFun", menu_action_handler_t(ACTION_GETIMPORTFUN), None,
                                 None, 80),
            idaapi.action_desc_t(ACTION_EXPORTSTRUCTURE, "ExportStructures", menu_action_handler_t(ACTION_EXPORTSTRUCTURE), None,
                                 None, 80),
        )
        for action in menu_actions:
            idaapi.register_action(action)
            self.registered_actions.append(action.name)

        self.ui_hook = UI_Hook()
        self.ui_hook.hook()
        # 件已成功加载，并且将在 IDA Pro 运行期间保持活动状态。如果一个插件的 init 方法返回此值，那么插件的 run 方法可以在任何时候被调用。
        return idaapi.PLUGIN_KEEP

    def run(self, arg):
        pass

    def term(self):
        if hasattr(self, "ui_hook"):
            self.ui_hook.unhook()

        # Unregister actions
        for action in self.registered_actions:
            idaapi.unregister_action(action)

        if self.hexrays_inited:
            # Unregister hexrays actions
            for action in self.registered_hx_actions:
                idaapi.unregister_action(action)
            if self.hx_hook:
                idaapi.remove_hexrays_callback(self.hx_hook.callback)
            idaapi.term_hexrays_plugin()