stackscan.py 文件源码

def ret_addr(ea):

    #we can't assume Thumb only, so we also keep ARM cases, just adjust addr in Thumb cases
    if (ea % 2) != 0:
        ea -= 1

    '''
    #calculating code segment ranges every time is wasteful
    code_segs = []
    for s in idautils.Segments():
        if idaapi.segtype(s) == idaapi.SEG_CODE:
            s_end = idc.GetSegmentAttr(s, SEGATTR_END)
            code_segs.append({"start" : s, "end" : s_end})

    if not reduce(lambda x, y: x or y, map(lambda x: (x["start"] <= ea) and (x["end"] > ea), code_segs)):
        return False
    '''

    #this is-in-function check is enough (segment check redundant) if we trust function ID'ing anyway.

    f_ea = idaapi.get_func(ea)
    if not f_ea:
        return False

    #Preceding or Previous?
    #   Not necessarily all preceding will be a call to a ret instruction,
    #   but "the" prev should be always the one.
    i = idautils.DecodePreviousInstruction(ea)
    if i and "BL" in idc.GetMnem(i.ea):
        return True

    return False