The Rename of Dynamic Function

Recently I reversed a program about Apple. This software have lots of dynamic functions to call the official function. Such as below:

......
aaa = (int (__cdecl *)(_DWORD))GetProcAddress(hModule, "aaa");
if ( aaa )
{
    bbb = (int)GetProcAddress(hModule,"bbb");
    if ( bbb )
......

But in default in IDA, aaa or bbb may show as dword_xxxxxxx. It's more different to identify all of them. So I decide to write a script to help to rename from dword_xxxxxxxx to aaa/bbb.
Just like below:

# FixGetProcName IDApython script
#
# Author: ipfans
#
# Fix the dynamics funcation name called by GetProcAddress() API.

import idaapi,idautils,idc,re

p = re.compile("mov\s+(.*),\s+eax")

def fixGetProcAddr(ea):
    t_ea = ea
    push_count = 0
    while push_count < 2:
        while idc.GetDisasm(t_ea).find("push") == -1:
            t_ea = idc.PrevHead(t_ea, 0)
        t_ea = idc.PrevHead(t_ea, 0)
        push_count +=1
    t_ea = idc.NextHead(t_ea, idc.SegEnd(t_ea))
    func_name_ea = Dword(t_ea + 1)
    func_name = ""
    while idc.Byte(func_name_ea):
        func_name += "%c" % Byte(func_name_ea)
        func_name_ea += 1
    while not p.match(idc.GetDisasm(ea)):
        ea = idc.NextHead(ea, SegEnd(ea))
    MakeNameEx(LocByName(p.match(idc.GetDisasm(ea)).groups(1)[0]), func_name, idc.SN_NOCHECK)

def imp_cb(ea, name, ord):
    if name:
        if name == "GetProcAddress":
            print "Found %s at 0x%08x"%(name, ea)
            for xref in XrefsTo(ea, 0):
                if XrefTypeName(xref.type) == "Code_Near_Call":
                    #print xref.type, XrefTypeName(xref.type),'from', hex(xref.frm), 'to', hex(xref.to)
                    fixGetProcAddr(xref.frm)
            print "Fixup Done!"
    return True

nimps = idaapi.get_import_module_qty()
print "Found %d import(s)..."%nimps

for i in xrange(0, nimps):
    name = idaapi.get_import_module_name(i)
    if name:
        if name.lower() == "kernel32":
            print "kernel32.dll found!"
            idaapi.enum_import_names(i, imp_cb)

WinDbg and IDA to Improved Code Flow Analysis

First of all, may I copy some pieces of others' blog post:

IDA is hands down the best tool for static analysis. Its debugger on the other hand, when compared to the power of WinDbg is certainly lacking, IMHO. As such, I find myself wasting too much time switching between windows and manually highlighting and commenting instructions in IDA as I trace through them in WinDbg. Fortunately, the power of IDApython can be unleashed to reduce this tedium.

I was reading an older TippingPoint MindshaRE article from Cody Pierce entitled “Hit Tracing in WinDbg” and was inspired by his ideas to implement my own IDApython script to better integrate WinDbg with IDA. While, I may be recreating many of his efforts, my primary intent was to get better at scripting in IDApython while improving upon my static/dynamic analysis workflow.

The purpose of my script is to parse WinDbg log files for module base addresses, instruction addresses, references to register values, and pointer dereferences. Then, for every instruction you hit in your debug session, the corresponding instructions will be colored and commented accordingly and in a module base address-agnostic fashion.

Yes, I have the some thought. But when I test the idc file, I found a problem. This IDC script can not support the randomized address. Then I find the Matthew Graeber's script. This script is good, but cann't suite for some program that we don't have symbols. So I rewrite the script, hope can give you some help XD.