cory.py 文件源码

def find_qmemcpy():
    hex = '{:x}'.format
    for f in db.functions.iterate():
        try:
            res = idaapi.decompile(f)
            qmemcpys = [x for x in re.findall('printf\(.*?;', str(res)) if 'sizeof' not in x]
            # heads = re.findall('::Next', str(res))
            if not qmemcpys:
                continue
            print(hex(f), func.name(f))
            for q in qmemcpys:
                print(q)
        except:
            pass

# Natus