IDAPython 解混淆记录

原创已于 2025-08-12 16:54:20 修改 · 1k 阅读

6 ·

CC 4.0 BY-SA版权

文章标签：

#java #开发语言

于 2025-08-12 16:53:46 首次发布

IDA 9.0， Python 3.13.5， MacOS ARM64

情况1

.text:000000000008130C ADRL X19, dword_10B51C
.text:0000000000081314 LDRSW X8, [X19]
.text:0000000000081318 MOV X0, X20
.text:000000000008131C MOV X1, X27
.text:0000000000081320 MOV W2, WZR
.text:0000000000081324 LDR X8, [X25,X8,LSL#3]
.text:0000000000081328 BLR X8

Python>idc.print_operand(0x8130C , 1)
'dword_10B51C'

Python>idc.get_operand_value(0x8130C ,1)
0x10b51c

情况2

.text:000000000008167C ADRP X8, #dword_10B62C@PAGE
.text:0000000000081680 LDRSW X8, [X8,#dword_10B62C@PAGEOFF]
.text:0000000000081684 LDR X0, [X24]
.text:0000000000081688 LDR X8, [X25,X8,LSL#3]
.text:000000000008168C BLR X8

Python>idc.print_operand(0x8167C , 1)
'#dword_10B62C@PAGE'
Python>idc.get_operand_value(0x8167C ,1)
0x10b000

Python>idc.print_operand(0x81680 , 1)
'[X8,#dword_10B62C@PAGEOFF]'
Python>idc.get_operand_value(0x81680 ,1)
0x62c

0x10b000 + 0x62c = 0x10B62C

情况3

.text:000000000008132C LDRSW X8, [X19,#(dword_10B520 - 0x10B51C)]
.text:0000000000081330 MOV X2, X0
.text:0000000000081334 MOV W3, #1
.text:0000000000081338 MOV X0, X23
.text:000000000008133C LDR X8, [X25,X8,LSL#3]
.text:0000000000081340 MOV X1, X20
.text:0000000000081344 BLR X8

Python>idc.print_operand(0x8132C , 1)
'[X19,#(dword_10B520 - 0x10B51C)]'

Python>idc.get_operand_value(0x8132C ,1)
0x4

0x10B520 - 0x10B51C = 0x4