poison_ivy_api_name_fix.py 文件源码

def createenum(self, symbols):
        """
            Given full symbols and addresses create an enum name with the library name (the string before !)
            Some constants will fail due to weird characters in symbols used by MS. eg( `$)
            symbols: (dict) A set of symbols and addresses that have been cleaned.
        """
        enum_name = symbols.keys()[0].split('!')[0]
        enum = idc.AddEnum(0, enum_name, idaapi.hexflag())
        if enum == idaapi.BADADDR:
            print "[!] Failed to create enum: %s\n" % enum_name
            return 
        for symbol, address in symbols.iteritems():
            # "ADVAPI32!RegCreateKeyExWStub": "0xffff8007be2f89f0"
            org_symb = symbol
            symbol = str(symbol.split('!')[1].encode('utf-8'))
            symbol = symbol.strip()
            symbol = 's_'+symbol 
            address = int(address,16)
            ret = idc.AddConstEx(enum, symbol, address, -1)
            if ret !=0:
                print "[!] Failed to create constant for symbol %s - (%s). %s" % (org_symb,symbol,ENUM_ERRORS[ret])
                continue
            self.enums[address] = enum

        print "[+] Finished adding enum %s\n" % enum_name