decode_string_templaate.py 文件源码

def find_function_arg(addr):
    min_addr = addr - 10
    while True:
        addr = idc.PrevHead(addr)
        if addr > min_addr:
            if GetMnem(addr) == "mov" and "ecx" in GetOpnd(addr, 0) and  GetOpType(addr, 1) != 1 and GetOpType(addr, 1) != 4 and GetOpType(addr, 1) != 3 :
                #print "%s => %s => %s" % (hex(addr), GetOpnd(addr, 1), hex(GetOperandValue(addr, 1)) )
                return GetOperandValue(addr, 1)
        else:
            break