mirror of
https://github.com/idapython/src
synced 2026-06-08 14:47:00 +00:00
Arnaud Diederen
76 lines
2.2 KiB
Python
76 lines
2.2 KiB
Python
"""
|
|
summary: decompile entrypoint automatically
|
|
|
|
description:
|
|
Attempts to load a decompiler plugin corresponding to the current
|
|
architecture right after auto-analysis is performed,
|
|
and then tries to decompile the function at the first entrypoint.
|
|
|
|
It is particularly suited for use with the '-S' flag, for example:
|
|
idat -Ldecompile.log -Sdecompile_entry_points.py -c file
|
|
|
|
level: intermediate
|
|
"""
|
|
|
|
import ida_ida
|
|
import ida_auto
|
|
import ida_loader
|
|
import ida_hexrays
|
|
import ida_idp
|
|
import ida_entry
|
|
import ida_kernwin
|
|
|
|
# because the -S script runs very early, we need to load the decompiler
|
|
# manually if we want to use it
|
|
def init_hexrays():
|
|
ALL_DECOMPILERS = {
|
|
ida_idp.PLFM_386: "hexx64",
|
|
ida_idp.PLFM_ARM: "hexarm",
|
|
ida_idp.PLFM_PPC: "hexppc",
|
|
ida_idp.PLFM_MIPS: "hexmips",
|
|
ida_idp.PLFM_RISCV: "hexrv",
|
|
}
|
|
cpu = ida_idp.ph.id
|
|
decompiler = ALL_DECOMPILERS.get(cpu, None)
|
|
if not decompiler:
|
|
print("No known decompilers for architecture with ID: %d" % ida_idp.ph.id)
|
|
return False
|
|
if ida_loader.load_plugin(decompiler) and ida_hexrays.init_hexrays_plugin():
|
|
return True
|
|
else:
|
|
print('Couldn\'t load or initialize decompiler: "%s"' % decompiler)
|
|
return False
|
|
|
|
|
|
def decompile_func(ea, outfile):
|
|
ida_kernwin.msg("Decompiling at: %X..." % ea)
|
|
cf = ida_hexrays.decompile(ea)
|
|
if cf:
|
|
ida_kernwin.msg("OK\n")
|
|
outfile.write(str(cf) + "\n")
|
|
else:
|
|
ida_kernwin.msg("failed!\n")
|
|
outfile.write("decompilation failure at %X!\n" % ea)
|
|
|
|
|
|
def main():
|
|
print("Waiting for autoanalysis...")
|
|
ida_auto.auto_wait()
|
|
if init_hexrays():
|
|
eqty = ida_entry.get_entry_qty()
|
|
if eqty:
|
|
idbpath = idc.get_idb_path()
|
|
cpath = idbpath[:-4] + ".c"
|
|
with open(cpath, "w") as outfile:
|
|
print("writing results to '%s'..." % cpath)
|
|
for i in range(eqty):
|
|
ea = ida_entry.get_entry(ida_entry.get_entry_ordinal(i))
|
|
decompile_func(ea, outfile)
|
|
else:
|
|
print("No known entrypoint. Cannot decompile.")
|
|
if ida_kernwin.cvar.batch:
|
|
print("All done, exiting.")
|
|
ida_pro.qexit(0)
|
|
|
|
main()
|