identify_string_decoders.py 文件源码

def find_suspicous_movs(functions):
    candidate_functions = []
    regs = ["esp", "ebp", "rsp", "rbp"]
    for fva in functions:
        for (loopStart, loopEnd) in find_tight_loops(fva):
            cva = loopStart
            while cva <= loopEnd:
                if idc.GetMnem(cva) == "mov":
                    if is_list_item_in_s(regs, idc.GetOpnd(cva, 0)):
                        cva = idc.NextHead(cva)
                        continue
                    # identify register dereferenced writes to memory, e.g. mov [eax], cl
                    if idc.GetOpType(cva, 0) == OP_TYPE.BASE_INDEX.value:
                        if idc.GetOpType(cva, 1) not in [OP_TYPE.IMMEDIATE.value, OP_TYPE.IMMEDIATE_FAR.value,
                                                         OP_TYPE.IMMEDIATE_NEAR.value]:
                            g_logger.debug("suspicious MOV instruction at 0x%08X in function 0x%08X: %s", cva, fva,
                                           idc.GetDisasm(cva))
                            candidate_functions.append(fva)
                            break
                cva = idc.NextHead(cva)
    return candidate_functions