TransWikia.com

Using IDAPython Problem in finding string avalilable in .idata section

Reverse Engineering Asked by neeraj on November 26, 2020

I am new to ida pro and idapython
In the following case i want to find the string reference "x is less than zero" while processing a block.
Tested with following script but doesn’t seems to works!

        b = <ida_gdl.qbasic_block_t; proxy of <Swig Object of type 'qbasic_block_t *' at 0x0000026C1A40F6C0> >  #Basic block object       
        for head in Heads(b.start_ea, b.end_ea):
            print (DataRefsFrom(head))

.text:0000000000401599                 add     rax, 3
.text:000000000040159D                 shr     rax, 2
.text:00000000004015A1                 shl     rax, 2
.text:00000000004015A5                 mov     [rbp-40h+var_20], rax
.text:00000000004015A9                 cmp     [rbp-40h+arg_0], 0
.text:00000000004015AD                 jns     short loc_4015BB
|------------------------------------------------------------------------------------------------|
|.text:00000000004015AF                 lea     rcx, Format     ; "x is less than zero"          |
|------------------------------------------------------------------------------------------------|
.text:00000000004015B6                 call    printf
.text:00000000004015BB
.text:00000000004015BB loc_4015BB:                             ; CODE XREF: allocatebuffer(int)+7D↑j
.text:00000000004015BB                 mov     eax, 1
.text:00000000004015C0                 mov     rsp, rbx
.text:00000000004015C3                 lea     rsp, [rbp-48h]
.text:00000000004015C7                 pop     rbx
.text:00000000004015C8                 pop     rbp
.text:00000000004015C9                 retn

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP