mount -n -o remount,rw / mount -n -t ramfs tmp /tmp mount -n -t proc proc /proc mount -n -t usbdevfs usbdevfs /proc/bus/usb
#echo "copy for etc" cp -a /etc/* /tmp mount -n -t ramfs etc /etc cp -a /tmp/* /etc rm -rf /tmp/*
#echo "copy for dev" cp -a /dev/* /tmp mount -n -t ramfs dev /dev cp -a /tmp/* /dev rm -rf /tmp/* mount -n -t devpts pts /dev/pts mount -n -t tmpfs shm /dev/shm
#echo "copy for var" cp -a /var/* /tmp mount -n -t ramfs var /var cp -a /tmp/* /var rm -rf /tmp/*
#echo "copy for root" cp -a /root/.b* /tmp mount -n -t ramfs root /root cp -a /tmp/.b* /root rm -rf /tmp/.b*
for ea in idautils.Heads(): if not ida_bytes.is_code(ida_bytes.get_flags(ea)): continue
insn = ida_ua.insn_t() if ida_ua.decode_insn(insn, ea) == 0: continue
if start_range <= ea and ea <= end_range: for op_num in range(ida_ida.UA_MAXOP): op = insn.ops[op_num] if op.type == ida_ua.o_void: break if op.type == ida_ua.o_imm: imm_value = op.value if op.value > 0xFFFFFFFF: imm_value = (0xFFFFFFFF & op.value) checked_count += 1 if min_ea <= imm_value and imm_value <= max_ea: if idc.op_offset(ea, op_num, REF_OFF32): converted_count += 1 else: print(f" -> Convert Failed: 0x{ea:X}[{op_num}]")
def get_the_firsstr_ea(ea): addr = ea - 1 last_byte = ida_bytes.get_byte(addr) if 32 < last_byte and last_byte < 127: ea = get_the_firsstr_ea(addr) return ea
def find_str_address(start_ea, end_ea): current_ea = start_ea found_count = 0 while current_ea < end_ea: if current_ea == ida_idaapi.BADADDR: break address_flags = ida_bytes.get_flags(current_ea) if ida_bytes.is_strlit(address_flags): str_size = ida_bytes.get_item_size(current_ea) the_first_str_addr = get_the_firsstr_ea(current_ea) if the_first_str_addr != current_ea: len = current_ea - the_first_str_addr + str_size ida_bytes.create_strlit(the_first_str_addr, len, 0) print(f"Fix str at 0x{current_ea:X}, before: {str_size}, after: {len}") current_ea += ida_bytes.get_item_size(current_ea) continue
GCC: (GNU) 3.3.1 GCC: (GNU) 3.2.1 20021207 (Red Hat Linux 8.0 3.2.1-2) GCC: (GNU) 3.2.1 20030202 (Red Hat Linux 8.0 3.2.1-7) GCC: (GNU) 3.2.2 20030222 (Red Hat Linux 3.2.2-4) GCC: (GNU) 3.2.2 20030222 (Red Hat Linux 3.2.2-5)
# 获取段信息 seg = ida_segment.getseg(str_ea) if seg: seg_start = seg.start_ea seg_name = ida_segment.get_segm_name(seg) ifnot seg_name: seg_name = f"seg_{seg_start:08X}" else: seg_start = 0 seg_name = "unknown" target_functions = [] # 存储目标函数名 # 使用XrefsTo获取所有引用 for xref in idautils.XrefsTo(str_ea): xref_ea = xref.frm
# 获取引用地址所在的函数 func = ida_funcs.get_func(xref_ea) if func: # 获取函数名 func_name = ida_funcs.get_func_name(func.start_ea) if func_name and func_name notin xref_functions: xref_functions.append(func_name) # 分析目标函数 target_func = find_target_function(xref_ea) if target_func and target_func notin target_functions: target_functions.append(target_func) # else: # # 如果不在函数中，尝试获取该地址的名称 # name = ida_name.get_name(xref_ea) # if name and name not in xref_functions: # xref_functions.append(f"@{name}") # else: # # 如果没有名称，使用地址 # addr_name = f"addr_0x{xref_ea:X}" # if addr_name not in xref_functions: # xref_functions.append(addr_name)
# 添加数据引用 # for xref_ea in idautils.DataRefsTo(str_ea): # func = ida_funcs.get_func(xref_ea) # if func: # func_name = ida_funcs.get_func_name(func.start_ea) # if func_name and func_name not in xref_functions: # xref_functions.append(func_name) # # 分析目标函数 # target_func = find_target_function(xref_ea) # if target_func and target_func not in target_functions: # target_functions.append(target_func) # else: # name = ida_name.get_name(xref_ea) # if name and name not in xref_functions: # xref_functions.append(f"@{name}") # else: # addr_name = f"addr_0x{xref_ea:X}" # if addr_name not in xref_functions: # xref_functions.append(addr_name)
search_ea = xref_ea while search_ea < current_func.end_ea: search_ea = ida_bytes.next_head(search_ea, ida_idaapi.BADADDR) if search_ea == ida_idaapi.BADADDR: break ifnot ida_ua.decode_insn(insn, search_ea): continue if insn.itype in [ida_allins.NN_call, ida_allins.NN_callfi, ida_allins.NN_callni]: target_ea = insn.ops[0].addr if insn.ops[0].type == ida_ua.o_near elseNone if target_ea: target_func_name = ida_name.get_name(target_ea) if target_func_name: return target_func_name, target_ea else: func = ida_funcs.get_func(target_ea) if func: return ida_funcs.get_func_name(func.start_ea), func.start_ea returnNone, None defprocess_string_data(json_file_path): """ 从JSON文件读取字符串数据，在rodata段搜索字符串， 跳转到第一个交叉引用的函数，并根据需要重命名函数 参数: json_file_path: JSON文件路径 """ try: # 读取JSON文件 with open(json_file_path, 'r', encoding='utf-8') as f: string_data_list = json.load(f) print(f"成功读取JSON文件，包含 {len(string_data_list)} 个字符串条目") # 获取.rodata段 rodata_seg = None for seg in idautils.Segments(): seg_name = ida_segment.get_segm_name(ida_segment.getseg(seg)) if seg_name == ".rodata": rodata_seg = ida_segment.getseg(seg) break ifnot rodata_seg: print("错误：无法找到.rodata段") return print(f"找到.rodata段: 0x{rodata_seg.start_ea:X} - 0x{rodata_seg.end_ea:X}") # 处理每个字符串条目 for idx, item in enumerate(string_data_list): # print(f"\n[{idx + 1}/{len(string_data_list)}] 处理字符串: '{item['str']}'") # 在rodata段搜索字符串 string_to_search = item['str'] found_ea = search_string_in_segment(string_to_search, rodata_seg) if found_ea == ida_idaapi.BADADDR: # print(f" 未在.rodata段找到字符串 '{string_to_search}'") continue # 获取字符串的交叉引用 xrefs = get_xrefs_to_address(found_ea) ifnot xrefs: print(f" 字符串在 0x{found_ea:X} 没有交叉引用") continue print(f" 找到 {len(xrefs)} 个交叉引用") # 获取第一个交叉引用 first_xref = xrefs[0] # 找到包含该交叉引用的函数 func = ida_funcs.get_func(first_xref) ifnot func: print(f" 0x{first_xref:X} 不在任何函数中") continue
target_func_name, target_func_ea = find_target_function(first_xref) if target_func_name: if target_func_name.startswith('sub_') and item['target_func_name']: rename_function(target_func_ea, item['target_func_name'][0])
defmain(): parser = argparse.ArgumentParser(description='Recover game from IGS E2000 platform') parser.add_argument('head_file', type=str, help='head file to read') parser.add_argument('rc_dir', type=str, help='game parts dir to read') parser.add_argument('game_file', type=str, help='game file to write') args = parser.parse_args()
