mandiant / fidl Goto Github PK

  �(0000000040000007��void *v7���	;�	 // ��[xsp+48h] [xbp-8h]��

�(0000000000000031  �(0000000000000033��objc_release���(0000000000000032�	(�	�(0000000000000034��v1���	)�	�	;�	�(0000000000000031           

            v
OBJC_CLASS__|_NSFileManager

Python 3.8.5
[GCC 9.3.0] 
IDAPython v7.4.0 final (serial 0) (c) The IDAPython Team <[email protected]>
--------------------------------------------------------------------------------------
Python>import FIDL.decompiler_utils as du
Python>c = du.controlFlowinator(ea=here(),fast=False)
...
 -> OK
in method 'ctree_items_t___getitem__', argument 2 of type 'size_t'
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "/path/FIDL/FIDL/decompiler_utils.py", line 1403, in __init__
    self._generate_better_cfg()
  File "/path/FIDL/FIDL/decompiler_utils.py", line 1845, in _generate_better_cfg
    hi = citem2higher(obj)  # cinsn_t
  File "/path/FIDL/FIDL/decompiler_utils.py", line 530, in citem2higher
    if citem.is_expr():
AttributeError: 'NoneType' object has no attribute 'is_expr'

Python>import FIDL.decompiler_utils as du
Python>du.display_all_calls_to("decryptString")
Traceback (most recent call last):
  File "<string>", line 1, in <module>
  File "c:\apps\fidl\FIDL\decompiler_utils.py", line 1309, in display_all_calls_to
    f_ea = LocByName(func_name)
NameError: name 'LocByName' is not defined

if not has_cached_cfunc(ea):
    # Open the disassembly view here
    # to populate the cache
    pw = pseudoViewer()
    pw.show(ea=ea)
try:
    cf = decompile(ea=ea, flags=ida_hexrays.DECOMP_NO_WAIT)
except ida_hexrays.DecompilationFailure as e:
    print("Failed to decompile @ {:X}".format(ea))
    cf = None

import itertools
from idaapi import *
from idautils import *
from idc import *
import ida_hexrays
import FIDL.decompiler_utils as du

def string_decoder(args):
    if args and args[0].type == 'string':
        s = bytearray.fromhex(args[0].val)
        res = ""
        last = s[0]
        for a,b in zip(s[1:], itertools.cycle('IIDH47ETIBQRYOF258RYOSYW5XVMEYODH257Y')):
            x = a ^ ord(b)
            z = (x - last) % 255
            res+= chr(z)
            last = a
        return res

def get_func_start(xref):
    try:
        if len(get_func_name(xref.frm)) > 0:#get_func_start will crash IDA without this additional check
            if xref.iscode:
                func = get_func(xref.frm)
                find_func_bounds(func, idaapi.FIND_FUNC_DEFINE)
                return func.start_ea
        return 0
    except:
        return 0

def main():
    addr = 0x004808E0
    func_list = []
    if addr is not None:
        for xref in XrefsTo(addr, ida_xref.XREF_ALL):
            f = get_func_start(xref)
            if f == 0:
                print('xref outside of defined function %x' % xref.frm)
            else:
                func_list.append(f)
    func_list = set(func_list)
    count = 0
    for f in func_list:
        c = du.controlFlowinator(ea=f)
        for co in c.calls:
            if co.call_ea == addr:
                t = string_decoder(co.args)
                du.create_comment(co.c,co.ea,'%s' % (t))
                count+=1
    print('calls found %d' % (count))
    
if __name__ == '__main__':
    main()

Traceback (most recent call last):
  File "<string>", line 53, in <module>
  File "<string>", line 44, in main
  File "C:\Users\steve\AppData\Roaming\Python\Python38\site-packages\FIDL\decompiler_utils.py", line 1402, in __init__
    self._generate_better_cfg()
  File "C:\Users\steve\AppData\Roaming\Python\Python38\site-packages\FIDL\decompiler_utils.py", line 1844, in _generate_better_cfg
    hi = citem2higher(obj)  # cinsn_t
  File "C:\Users\steve\AppData\Roaming\Python\Python38\site-packages\FIDL\decompiler_utils.py", line 530, in citem2higher
    if citem.is_expr():
AttributeError: 'NoneType' object has no attribute 'is_expr'

  File "<string>", line 62, in main
  File "C:\Python27\lib\site-packages\FIDL\decompiler_utils.py", line 1388, in __init__
    self._generate_i_cfg(blocks_to_expand=blocks)
  File "C:\Python27\lib\site-packages\FIDL\decompiler_utils.py", line 1813, in _generate_i_cfg
    self._generate_i_cfg(blocks_to_expand=blocks_to_expand)
  File "C:\Python27\lib\site-packages\FIDL\decompiler_utils.py", line 1800, in _generate_i_cfg
    new_blocks = self._expand_switch_block(block)
  File "C:\Python27\lib\site-packages\FIDL\decompiler_utils.py", line 1609, in _expand_switch_block
    self.i_cfg.add_edge(case_ins[-2].index, succ)
IndexError: list index out of range```