Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python3 #9

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
.idea/
3 changes: 1 addition & 2 deletions ida_kernelcache.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,5 +5,4 @@
# A script to import the ida_kernelcache module into IDA.
#

import ida_kernelcache
import ida_kernelcache as kc
from __future__ import absolute_import
48 changes: 25 additions & 23 deletions ida_kernelcache/__init__.py
Original file line number Diff line number Diff line change
Expand Up @@ -7,23 +7,25 @@

# This isn't kernelcache-specific, but it's useful to have access to in the interpreter and other
# scripts.
import ida_utilities
from __future__ import absolute_import
from __future__ import print_function

import build_struct
import class_struct
import classes
import kernel
import kplist
import metaclass
import offset
import segment
import stub
import tagged_pointers
import vtable
from . import build_struct
from . import class_struct
from . import classes
from . import ida_utilities
from . import kernel
from . import kplist
from . import metaclass
from . import offset
from . import segment
from . import stub
from . import tagged_pointers
from . import vtable
from .classes import (ClassInfo, collect_class_info, class_info)
from .kplist import (kplist_parse)
from .segment import (kernelcache_kext)

from classes import (ClassInfo, collect_class_info, class_info)
from kplist import (kplist_parse)
from segment import (kernelcache_kext)

def kernelcache_process(untag_pointers=True):
"""Process the kernelcache in IDA for the first time.
Expand All @@ -44,34 +46,34 @@ def kernelcache_process(untag_pointers=True):
import idc
def autoanalyze():
idc.Wait()

autoanalyze()
if (kernel.kernelcache_format == kernel.KC_12_MERGED
and untag_pointers
and idaapi.IDA_SDK_VERSION < 720):
print 'Processing tagged kernelcache pointers'
print('Processing tagged kernelcache pointers')
tagged_pointers.untag_pointers()
autoanalyze()
segment.initialize_segments()
print 'Initializing data offsets'
print('Initializing data offsets')
offset.initialize_data_offsets()
autoanalyze()
print 'Initializing vtables'
print('Initializing vtables')
vtable.initialize_vtables()
autoanalyze()
vtable.initialize_vtable_symbols()
autoanalyze()
metaclass.initialize_metaclass_symbols()
if kernel.kernelcache_format == kernel.KC_11_NORMAL:
print 'Creating offset and stub symbols'
print('Creating offset and stub symbols')
offset.initialize_offset_symbols()
autoanalyze()
stub.initialize_stub_symbols()
autoanalyze()
print 'Propagating vtable method symbols'
print('Propagating vtable method symbols')
vtable.initialize_vtable_method_symbols()
print 'Initializing class structs'
print('Initializing class structs')
class_struct.initialize_vtable_structs()
class_struct.initialize_class_structs()
autoanalyze()
print 'Done'

print('Done')
11 changes: 5 additions & 6 deletions ida_kernelcache/build_struct.py
Original file line number Diff line number Diff line change
Expand Up @@ -5,20 +5,20 @@
# A module to build an IDA structure automatically from code accesses.
#

import collections
from __future__ import absolute_import

import idc
import idautils
import idaapi

import ida_utilities as idau
from . import ida_utilities as idau

_log = idau.make_log(3, __name__)


def field_name(offset):
"""Automatically generated IDA structs have their fields named by their absolute offset."""
return 'field_{:x}'.format(offset)


def create_struct_fields(sid=None, name=None, accesses=None, create=False, base=0):
"""Create an IDA struct with fields corresponding to the specified access pattern.

Expand Down Expand Up @@ -67,6 +67,5 @@ def create_struct_fields(sid=None, name=None, accesses=None, create=False, base=
else:
success = False
_log(1, 'Could not add {}.{} for access ({}, {}): {}', name, member, offset, size,
ret)
ret)
return success

Loading