编程实现查找“貌似相同”的函数
本帖最后由 元始天尊 于 2015-11-7 16:05 编辑给ida用的，处于实际需要，临时编写的代码：编程实现查找“貌似相同”的函数，纯字节码对比，用了散列
map={}
#scale/256即为要比对的字节数大小 offset:离函数头偏移
scale=0x1000
offset=5
i=0
while(i<scale):
map=
i=i+1
addr=NextFunction(0)
while(addr<0xffffffff):
sum=0
i=0
#确保函数足够大
if(GetFunctionName(addr)==GetFunctionName(addr+0x20)):
while(i<(scale/256)):
#越过push ebp;mov ebp,esp
sum=sum+Byte(addr+offset+i)
i=i+1
if(map==0):
map=GetFunctionName(addr)
else:
map=map+" "+GetFunctionName(addr)
map=map+1
addr=NextFunction(addr)
i=0
while(i<scale):
if(map>=2):
print map
i=i+1
效果：
sub_204B0 sub_21270
FreeWritablePage sub_180E0 sub_193A0 sub_21180
__SEH_prolog4 __SEH_prolog4_GS
sub_111CF sub_151E0 sub_173B0 sub_1F630 sub_20330
sub_20400 sub_211D0
sub_16910 sub_17D50 sub_19010 sub_20B40
sub_16150 sub_198C0 sub_1FF00 sub_1FFD0 sub_200A0
GetProcessFileObjectName sub_17DB0 sub_19070 sub_1AA50 sub_1B5B0 sub_20BA0
sub_21770 sub_21BC0
GetSysModules GetRegVal sub_17840 sub_17F20 sub_18A40 sub_191E0 sub_1A690 sub_20D10 sub_20E60 sub_21D90
sub_165D0 sub_20900
sub_12599 sub_1D980
sub_10730 sub_26A40
sub_106D0 sub_14A2A
sub_153A0 sub_15510
sub_1CA70 sub_1D400
sub_17270 sub_183F0 sub_19C70 sub_1FBD0 sub_21680
sub_223C0 sub_22460
sub_19730 sub_1C0C0 sub_1C9B0 sub_1DEC0 CsqPeekNextIrp sub_22B20
sub_14B10 sub_1C000 sub_213D0
__aulldiv sub_18C50
sub_22190 sub_22210
sub_177D0 sub_203C0
sub_15440 sub_22860
FreeBuffer sub_17EF0 sub_191B0 sub_20CE0 sub_222D0
sub_1EED0 sub_20540 sub_206E0
sub_1DB20 sub_22070
sub_1AAF0 sub_1E6D0 sub_1EAA0 sub_225E0
sub_19F30 sub_1EFF0
sub_10620 sub_1F990
sub_105A0 sub_105E0
StartRoutine sub_182C0 sub_19B40 sub_21550 sub_229F0
sub_1E820 sub_1E980
sub_179F0 sub_18BF0 sub_1A840 sub_21F40
sub_1C1B0 sub_1C280 sub_1D3B0
sub_201F0 sub_22570
GetTimeDateStamp1 GetTimeDateStamp2 sub_184E0 sub_18640 GetTimeDateStamp3 GetTimeDateStamp4
sub_141A2 sub_1D000
sub_1C2E0 sub_1C330
sub_17A50 sub_18CA0 sub_19580 sub_1A8A0 sub_21FA0
sub_10530 sub_167B0 sub_17BF0 sub_18EB0 sub_209E0
sub_103E0 sub_17360
sub_1DA40 __alldiv
sub_18110 sub_19990 sub_20170
memcpy sub_10DF0
sub_13A77 sub_15DB0
sub_15330 sub_1CB80
sub_193D0 DriverEntry sub_22910
sub_16710 sub_17B50 sub_18E10 sub_20860
sub_1F660 sub_1FCD0
sub_17530 sub_187A0 sub_1A3F0 sub_21920
sub_17810 sub_1D910
sub_128B7 sub_138FD
sub_13C65 sub_1D7D0 论C艹的弊病
页:
[1]