Образ мышления – дизассемблер IDA Pro

Касперски К.

Table of contents :
Введение. Об этой книге……Page 3
Версии IDA Pro……Page 4
Кратное введение в дизассемблирование……Page 5
Первые шаги с IDA Pro……Page 7
Консоль……Page 25
Функции, объявление функций, аргументы функции, возвращаемое значение……Page 26
Объявление переменных, типы переменных, преобразования переменных……Page 27
Математические и битовые операторы……Page 29
Архитектура виртуальной памяти……Page 30
Архитектура страничной памяти……Page 32
Взаимодействие с физической памятью……Page 35
Навигатор по функциям……Page 36
long Byte (long ea)……Page 40
long Word (long ea)……Page 42
long Dword (long ea)……Page 43
void PatchDword (long ea,long value)……Page 44
long NextAddr (long ea)……Page 45
long PrevAddr (long ea)……Page 46
long GetFlags(long ea)……Page 47
long FindBinary(long ea,long flag,char str)……Page 48
#Definition……Page 49
Навигатор по функциям……Page 51
Сводная таблица функций……Page 58
long MK_FP (long seg,long off)……Page 59
success SegCreate(long startea,long endea,long base,long use32,long align,long comb)……Page 60
success SegDelete(long ea,long disable)……Page 62
long SegStart(long ea)……Page 65
long SegEnd(long ea)……Page 66
long SegByName(char segname)……Page 67
long SegByBase(long base)……Page 68
success SegRename(long ea,char name)……Page 69
success SegAddrng(long ea,long use32)……Page 71
success SegAlign(long ea,long alignment)……Page 72
success SegComb(long segea,long comb)……Page 73
success SegClass(long ea,char class)……Page 74
success SegDefReg(long ea,char reg,long value)……Page 75
success SetSegmentType (long segea,long type)……Page 77
long GetSegmentAttr(long segea,long attr)……Page 78
long FirstSeg()……Page 79
long NextSeg(long ea)……Page 80
void SetSelector(long sel,long value)……Page 82
long AskSelector(long sel)……Page 83
long FindSelector(long val)……Page 84
#Defenition……Page 85
Навигатор по функциям……Page 87
Сводная таблица функций……Page 89
long ItemSize(long ea)……Page 90
long NextHead(long ea)……Page 92
long NextHead(long ea, long maxea)……Page 93
long PrevHead(long ea, long minea)……Page 94
long PrevNotTail(long ea)……Page 95
#Definition……Page 96
Навигатор по функуциям……Page 98
Сводная таблица функций……Page 99
success MakeByte(long ea)……Page 100
success MakeWord(long ea)……Page 102
success MakeDword(long ea)……Page 103
success MakeQword(long ea)……Page 105
success MakeFloat(long ea)……Page 106
success MakeDouble(long ea)……Page 107
success MakePackReal(long ea)……Page 108
success MakeTbyte(long ea)……Page 109
success MakeStr(long ea,long endea)……Page 110
success MakeArray(long ea,long nitems)……Page 112
success MakeAlign(long ea,long count,long align)……Page 113
long MakeCode (long ea)……Page 114
char GetMnem(long ea)……Page 116
void MakeUnkn(long ea,long expand)……Page 117
long FindData(long ea,long flag)……Page 119
long FindExplored(long ea,long flag)……Page 120
long FindUnexplored(long ea,long flag)……Page 121
#definition……Page 122
Сводная таблица функций……Page 123
success OpBinary(long ea,int n)……Page 124
success OpDecimal(long ea,int n)……Page 125
success OpHex(long ea,int n)……Page 126
success OpChr(long ea,int n)……Page 127
success OpOff(long ea,int n,long base)……Page 128
success OpOffEx(long ea,int n,long reftype,long target,long base,long tdelta)……Page 130
success OpSeg(long ea,int n)……Page 132
success OpSign(long ea,int n)……Page 133
success OpStkvar(long ea,int n)……Page 134
char GetOpnd(long ea,long n)……Page 135
char AltOp (long ea,long n)……Page 136
long GetOpType (long ea,long n)……Page 137
longGetOperandValue(long ea,long n)……Page 138
long FindVoid (long ea,long flag)……Page 139
long FindImmediate(long ea,long flag,long value)……Page 140
Сводная таблица функций……Page 141
success MakeName(long ea,char name)……Page 142
success MakeComm(long ea,char comment)……Page 143
success MakeRptCmt(long ea,char comment)……Page 144
void ExtLinA(long ea,long n,char line)……Page 145
void ExtLinB(long ea,long n,char line)……Page 146
void DelExtLnA(long ea,long n)……Page 147
void DelExtLnB(long ea,long n)……Page 148
char Name(long ea)……Page 149
char Comment(long ea)……Page 151
char LineA(long ea,long num)……Page 152
char LineB(long ea,long num)……Page 153
ФУНКЦИИ……Page 154
#Definition……Page 155
Сводная таблица функций……Page 157
success MakeFunction(long start,long end);……Page 159
success DelFunction(long ea);……Page 161
success SetFunctionEnd(long ea,long end);……Page 162
long NextFunction(long ea);……Page 166
long PrevFunction(long ea)……Page 167
long GetFunctionFlags(long ea);……Page 168
FUNC_FAR……Page 169
FUNC_FRAME……Page 170
FUNC_USERFAR……Page 171
FUNC_HIDDEN……Page 172
success SetFunctionFlags(long ea,long flags);……Page 173
char GetFunctionName(long ea);……Page 174
void SetFunctionCmt(long ea, char cmt, long repeatable);……Page 175
char GetFunctionCmt(long ea, long repeatable);……Page 176
long ChooseFunction(char title);……Page 177
char GetFuncOffset(long ea);……Page 179
long FindFuncEnd(long ea);……Page 180
long GetFrame(long ea);……Page 182
long GetFrameLvarSize(long ea);……Page 183
long GetFrameRegsSize(long ea);……Page 184
long GetFrameArgsSize(long ea);……Page 185
long GetFrameSize(long ea);……Page 187
long MakeFrame(long ea,long lvsize,long frregs,long argsize);……Page 189
long GetSpd(long ea);……Page 191
long GetSpDiff(long ea);……Page 192
success SetSpDiff(long ea,long delta);……Page 193
success SetReg (long ea,char reg,long value);……Page 195
long GetReg (long ea,char reg);……Page 197
ПЕРЕКРЕСТНЫЕ ССЫЛКИ……Page 198
ЧТО ТАКОЕ ПЕРЕКРЕСТНЫЕ ССЫЛКИ?……Page 199
ALMA MATER……Page 201
АРХИТЕКТРУА ПЕРЕКРЕСТНЫХ ССЫЛОК……Page 204
МЕТОДЫ……Page 208
void AddCodeXref(long From,long To,long flowtype);……Page 209
long DelCodeXref(long From,long To,int undef);……Page 212
long Rfirst (long From);……Page 214
long Rnext (long From,long current);……Page 215
long RfirstB (long To);……Page 217
long RnextB (long To,long current);……Page 218
long Rfirst0 (long From);……Page 220
long RfirstB0(long To);……Page 221
void add_dref(long From,long To,long drefType);……Page 222
Dr_W Запись (Write)……Page 223
void del_dref(long From,long To);……Page 224
long Dnext (long From,long current);……Page 225
long DnextB (long To,long current);……Page 227
АРХИТЕКТУРА ТОЧЕК ВХОДА……Page 229
long GetEntryPointQty(void);……Page 230
success AddEntryPoint(long ordinal,long ea,char name,long makecode);……Page 231
long GetEntryPoint(long ordinal)……Page 235
success RenameEntryPoint(long ordinal,char name);……Page 236
ALMA MATER……Page 237
Архитектура структур в IDA……Page 239
Методы……Page 241
long GetFirstStrucIdx(void);……Page 243
long GetLastStrucIdx(void);……Page 244
long GetNextStrucIdx(long index);……Page 245
long GetPrevStrucIdx(long index);……Page 246
long GetStrucId(long index);……Page 248
long GetStrucIdByName(char name);……Page 249
char GetStrucName(long id);……Page 250
long GetStrucSize(long id);……Page 251
long GetMemberQty(long id);……Page 252
long GetStrucNextOff(long id,long offset);……Page 253
long GetStrucPrevOff(long id,long offset);……Page 254
long GetFirstMember(long id);……Page 255
long GetLastMember(long id);……Page 256
char GetMemberName(long id,long member_offset);……Page 257
char GetMemberComment(long id,long member_offset,long repeatable);……Page 259
long GetMemberSize(long id,long member_offset);……Page 260
long GetMemberStrId(long id,long member_offset);……Page 261
long AddStrucEx(long index,char name,long is_union);……Page 263
long IsUnion(long id);……Page 266
success DelStruc(long id);……Page 267
long SetStrucIdx(long id,long index);……Page 269
long SetStrucName(long id,char name);……Page 271
long SetStrucComment(long id,char comment,long repeatable);……Page 272
long AddStrucMember(long id,char name,long offset,long flag, long typeid,long nbytes);……Page 273
long DelStrucMember(long id,long member_offset);……Page 276
long SetMemberName(long id,long member_offset,char name);……Page 278
long SetMemberType(long id,long member_offset,long flag,long typeid,long nitems);……Page 279
long SetMemberComment(long id,long member_offset,char comment,long repeatable);……Page 281
ALMA MATER……Page 282
МЕТОДЫ……Page 284
long GetEnumQty(void);……Page 285
long GetnEnum(long idx);……Page 286
long GetEnum(char name);……Page 287
char GetEnumName(long enum_id);……Page 288
char GetEnumCmt(long enum_id,long repeatable)……Page 289
long GetEnumSize(long enum_id);……Page 290
long GetEnumFlag(long enum_id);……Page 291
long GetConstValue(long const_id);……Page 292
char GetConstCmt(long const_id,long repeatable);……Page 293
long AddEnum(long idx,char name,long flag);……Page 294
void DelEnum(long enum_id);……Page 296
success SetEnumIdx(long enum_id,long idx);……Page 297
ALMA MATER……Page 298
long GetNextFixupEA(long ea);……Page 300
long GetFixupTgtType(long ea);……Page 301
long GetFixupTgtSel(long ea);……Page 302
void SetFixup(long ea,long type,long targetsel,long targetoff,long displ);……Page 303
АНАЛИЗ……Page 305
void DeleteAll ();……Page 306
long AnalyseArea (long sEA,long eEA);……Page 307
void AutoMark2 (long start,long end,long queuetype);……Page 308
long FindText (long ea,long flag,long y,long x,char str);……Page 309
ALMA MATER……Page 310
МЕТОДЫ……Page 313
char AskStr (char defval,char prompt);……Page 314
char AskFile (long forsave,char mask,char prompt);……Page 315
long AskAddr (long defval,char prompt);……Page 316
long AskLong (long defval,char prompt);……Page 318
long AskSeg (long defval,char prompt);……Page 319
char AskIdent (char defval,char prompt);……Page 320
long AskYN (long defval,char prompt);……Page 321
void Message (char format,…);……Page 322
void Warning (char format,…);……Page 324
void Fatal (char format,…);……Page 326
long ScreenEA ();……Page 327
long SelStart ();……Page 328
success Jump (long ea);……Page 329
long AddHotkey(char hotkey, char idcfunc);……Page 330
МЕТОДЫ……Page 331
void MarkPosition(long ea,long lnnum,long x,long y,long slot,char comment);……Page 332
long GetMarkedPos(long slot);……Page 334
char GetMarkComment(long slot);……Page 335
int GenerateFile(long type, long file_handle, long ea1, long ea2, long flags);……Page 336
long fopen (char file,char mode);……Page 339
void fclose (long handle);……Page 341
long fseek (long handle,long offset,long origin);……Page 342
success loadfile (long handle,long pos,long ea,long size);……Page 343
success savefile (long handle,long pos,long ea,long size);……Page 346
long fgetc (long handle);……Page 347
long fprintf (long handle,char format,…);……Page 348
long readshort (long handle,long mostfirst);……Page 349
long writeshort (long handle,long word,long mostfirst);……Page 351
char readstr (long handle);……Page 352
ОРГАНИЗАЦИЯ МАССИВОВ……Page 353
МЕТОДЫ……Page 359
long CreateArray(char name);……Page 360
long GetArrayId(char name);……Page 361
success SetArrayLong(long id,long idx,long value);……Page 362
success SetArrayString(long id,long idx,char str);……Page 363
success DelArrayElement(long tag,long id,long idx);……Page 364
long GetFirstIndex(long tag,long id);……Page 365
long GetNextIndex(long tag,long id,long idx);……Page 366
long GetPrevIndex(long tag,long id,long idx)……Page 367
АРХИТЕКТУРА АССОЦИАТИВНЫХ МАССИВОВ……Page 368
success SetHashLong(long id,char idx,long value);……Page 369
long GetHashLong(long id,char idx);……Page 370
char GetHashString(long id,char idx);……Page 371
char GetFirstHashKey(long id);……Page 373
char GetNextHashKey(long id,char idx);……Page 374
char GetPrevHashKey(long id,char idx);……Page 375
МЕТОДЫ……Page 376
INF_VERSION……Page 377
INF_LFLAGS……Page 378
INF_DEMNAMES……Page 379
INF_FILETYPE……Page 380
INF_OSTYPE……Page 381
INF_START_SP……Page 382
INF_START_AF……Page 383
INF_MAX_EA……Page 389
INF_MAXREF……Page 390
INF_ASCII_BREAK……Page 391
INF_COMMENT……Page 392
INF_ENTAB……Page 393
INF_AUTO……Page 394
INF_NULL……Page 395
INF_ASMTYPE……Page 396
INF_XREFS……Page 397
SW_RPTCMT……Page 398
INF_NAMETYPE……Page 399
INF_SHOWBADS……Page 400
INF_PACKBASE……Page 401
INF_ASCIIFLAGS……Page 402
INF_LISTNAMES……Page 403
INF_SHORT_DN……Page 404
INF_DATATYPES……Page 405
INF_AF2……Page 406
success SetPrcsr (char processor);……Page 407
char GetIdaDirectory ();……Page 411
СТРОКИ……Page 412
char substr (char str, long x1,long x2);……Page 413
long strstr (char str, char substr);……Page 414
char form (char format,…);……Page 415
long xtol (char str);……Page 418
char ltoa (long n,long radix);……Page 419
РАЗНОЕ……Page 420
void Exit (long code);……Page 421
ОПЦИИ КОМАНДНОЙ СТРОКИ……Page 422