查看某个危险函数调用地址

查看某个危险函数漏洞地址

查看危险函数地址列表

HexRays ctree图

IDAPython帮助

导入Ghidra函数列表

导入离线断点

https://github.com/torvalds/linux/blob/v4.9/fs/binfmt_elf.c#L784-L789 https://github.com/torvalds/linux/blob/v4.9/fs/binfmt_elf.c#L84

ELF Specification: https://refspecs.linuxbase.org/elf/elf.pdf page 81: https://refspecs.linuxbase.org/elf/elf.pdf#page=81 DT_

触发断点时的处理函数

Displays the total processing time. Args: element: XML element object value (not used).

Displays XML version info in IDA output window. Args: what: String indicating Exporter, Importer, or Loader

Re-open an existing IDB and execute an IDA Python script before leaving Returns False if does not do anything, the subprocess if it was creat

在函数伪代码的 AST 中搜索表达式 ea: 函数内任意地址 q: lambda/function: f(cfunc_t, citem_t) 返回布尔值 parents: False -> 丢弃 cexpr_t 父节点 True -> 维护 ci

在函数伪代码的 AST 中搜索 item ea: 函数内任意地址 q: lambda/function: f(cfunc_t, citem_t) 返回布尔值 parents: False -> 丢弃 cexpr_t 父节点 True -> 维护

寻找函数返回块，不支持多返回函数

返回函数的指令数量

获得函数调用参数（当前仅支持4个参数）

Returns the size of the addressable codebyte for the processor. Returns: Integer representing the number of 8-bi

返回所有segment的名字列表（但其实是section）

Processes a BOOKMARK element. Args: bookmark: XML element object containing bookmark data.

Processes a CODE_BLOCK element by disassembling the address range. Args: code_block: XML element containing code

Processes a COMMENT element by creating the comment at the address. Args: comment: XML element containing the co

Processes the COMPILER element containing the compiler name. Args: compiler: XML element containing the compiler

Processes a DEFINED_DATA element by creating a data item at the specified address. Args: defined_dat

Processes the DESCRIPTION element. Args: description: DESCRIPTION XML element.

Processes an ENUM element by creating the enumeration. Args: enum: XML element containing the enumeration name a

Processes EQUATE_GROUP as IDA enumeration type. Args: equate_group: XML element containing the group name and

Creates a function using the FUNCTION attributes. Args: function: XML element containing the function address an

Processes INFO_SOURCE containing information about the source of the XML PROGRAM file. Args: info_so

Creates a manual instruction. Args: manual_instruction: XML element containing MANUAL_INSTRUCTION.

Creates a manual operand at an address. Args: manual_operand: MANUAL_OPERAND XML element.

Processes the MEMORY_MAP element. Args: memory_map: MEMORY_MAP XML element. MEMORY_MAP is o

Processes the MEMORY_REFERENCE element. Currently nothing is done with MEMORY_REFERENCEs. Args: memory_r

Creates a memory segment in the database. Args: memory_section: MEMORY_SECTION XML element.

Processes the PROCESSOR element. Args: processor: PROCESSOR XML element.

Processes the PROGRAM element. Args: program: PROGRAM XML element.

Defines a program entry point. Args: program_entry_point: PROGRAM_ENTRY_POINT XML element. Conta

Defines the address range for a register value. Args: register_value_range: REGISTER_VALUE_RANGE XML element.

Adds a structure. Args: structure: STRUCTURE XML element. Contains the STRUCTURE attributes and

Adds a symbol name at the specified address. Args: symbol: SYMBOL XML element. Contains symbol n

Adds a union datatype. Args: union: UNION XML element. Contains UNION attributes and child eleme

Imports the XML PROGRAM file into the database.

Determines if IDA version is supported by this idaxml module. Returns: True if IDA version is supported, else False.

重新打开已存在的 IDB Returns False if does not do anything, the subprocess if it was created of True if it was listing only.

Processes the list of deferred structure members when the DATATYPES end element is encountered. Args: el

在 IDB 上执行 query q: lambda/function: f(cfunc_t, citem_t) 返回布尔值 query_full: False -> 仅搜索 cexpr_t True -> 搜索 citem_t（包括 cexpr_t

刷新伪代码

函数名重命名（如有重名在末尾加数字区分）

设置指令背景色

取消函数命名，退回sub_xxxx