{"id":52,"date":"2026-04-14T15:17:18","date_gmt":"2026-04-14T07:17:18","guid":{"rendered":"https:\/\/www.seekinthevortex.cn\/?p=52"},"modified":"2026-04-14T15:17:18","modified_gmt":"2026-04-14T07:17:18","slug":"ida-python-%e5%ad%a6%e4%b9%a0%e4%bd%bf%e7%94%a8","status":"publish","type":"post","link":"https:\/\/www.seekinthevortex.cn\/index.php\/2026\/04\/14\/ida-python-%e5%ad%a6%e4%b9%a0%e4%bd%bf%e7%94%a8\/","title":{"rendered":"ida python \u5b66\u4e60\u4f7f\u7528"},"content":{"rendered":"<h1>\u73af\u5883\u642d\u5efa<\/h1>\n<p>\u4e3a\u4e86\u65b9\u4fbfida ipython\u811a\u672c\u7b49\u7684\u5b66\u4e60,\u5148\u5728vscode\u4e2d\u642d\u5efa\u4e00\u4e0bida python\u73af\u5883\u65b9\u4fbf\u6211\u4eec\u7f16\u5199\u7a0b\u5e8f.<\/p>\n<ul>\n<li>\u9996\u5148\u5728\u5728vscode\u4e2d\u5b89\u88c5\u63d2\u4ef6IDACode<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"https:\/\/cloud-map-bed-1351541725.cos.ap-nanjing.myqcloud.com\/pic\/20251031134716.png\" alt=\"image.png\"><\/p>\n<ul>\n<li>\u7136\u540e\u4e0b\u8f7dida\u63d2\u4ef6 <a href=\"https:\/\/github.com\/ioncodes\/idacode\">https:\/\/github.com\/ioncodes\/idacode<\/a> \u6839\u636e\u5b98\u65b9\u6587\u6863\u4e2d\u7684\u6559\u7a0b\u628a\u76f8\u5173\u7684\u5185\u5bb9\u62d6\u5230ida\u7684plugin\u76ee\u5f55\u4e2d\u5373\u53ef<\/li>\n<\/ul>\n<p>\u8fd9\u91cc\u53ef\u80fd\u9700\u8981\u4fee\u6539\u4e00\u4e0b\u4e00\u90e8\u5206\u7684\u5185\u5bb9,\u5728idacode_utils\u4e2d\u627e\u5230setting.json\u6587\u4ef6,\u4fee\u6539\u5176\u4e2d\u7684 PYTHON = &quot;\u4f60\u7684idapython\u7a0b\u5e8f\u8def\u5f84&quot;<br \/>\n\u6bd4\u5982\u6211\u7684\u5c31\u662f<code>PYTHON = &quot;D:\/IDA_Pro_v8.3_Portable\/python311\/python.exe&quot;<\/code><\/p>\n<ul>\n<li>\u914d\u7f6evscode<\/li>\n<\/ul>\n<p>\u5728setting.json\u4e2d\u914d\u7f6e\u4e00\u4e0bida python sdk\u7684\u8def\u5f84\u7528\u4e8e\u5bfc\u5165\u6a21\u5757.<\/p>\n<pre><code class=\"language-json\">    &quot;python.autoComplete.extraPaths&quot;: [\n        &quot;D:\\\\IDA Professional 9.0\\\\python&quot;\n    ],\n    &quot;python.analysis.extraPaths&quot;: [\n        &quot;D:\\\\IDA Professional 9.0\\\\python&quot;\n    ],\n    &quot;IDACode.saveOnExecute&quot;: false,\n    &quot;IDACode.executeOnSave&quot;: false,\n<\/code><\/pre>\n<h1>\u6d4b\u8bd5\u4f7f\u7528<\/h1>\n<p>\u5148\u5728ida\u4e2d\u6253\u5f00IDACode\u63d2\u4ef6,\u518d\u5728vscodd\u4e2d\u6253\u5f00 Ctrl-shift p \u6253\u5f00\u63a7\u5236\u9762\u677f\u9009\u62e9 <code>connect to ida<\/code> ,\u5982\u679cida\u4e2d\u6ca1\u6709\u62a5\u9519\u8bf4\u660e\u5c31\u6ca1\u6709\u95ee\u9898\u4e86,\u63a5\u4e0b\u6765\u6211\u4eec\u5c31\u53ef\u4ee5\u5c1d\u8bd5\u7f16\u5199\u4e00\u4e9b\u811a\u672c\u6d4b\u8bd5\u4e86.<\/p>\n<pre><code class=\"language-python\">print(&quot;Hello IDA&quot;)\n<\/code><\/pre>\n<p>\u7136\u540e\u547c\u51fa\u547d\u4ee4\u9762\u677f\u9009\u62e9execute in ida<\/p>\n<pre><code class=\"language-shell\">[IDACode] Executing d:\\My Code\\idapython\\test.py\nHello IDA\n<\/code><\/pre>\n<h1>IDA API\u5b66\u4e60<\/h1>\n<p>\u53c2\u8003\u8fde\u63a5: <a href=\"https:\/\/docs.hex-rays.com\/developer-guide\/idapython\/idapython-getting-started?_gl=1*1cji2b*_ga*Njg1MjI3MzM1LjE3NjE4ODE0NDI.*_ga_Y2G1VBHRDB*czE3NjE4ODE0NDIkbzEkZzEkdDE3NjE4ODI1MjAkajU3JGwwJGgw\">Getting Started | Hex-Rays Docs<\/a><\/p>\n<h2>\u5730\u5740\u548c\u540d\u79f0<\/h2>\n<pre><code class=\"language-python\">import idc, idautils, ida_name\n\n# \u83b7\u53d6\u5f53\u524d\u5149\u6807\u4f4d\u7f6e\u5904\u7684\u5730\u5740\nea = idc.here()\nprint(f&quot;current addr is: {ea:x}&quot;)\nprint(&quot;current addr is: &quot; + hex(idc.get_screen_ea()))\n\n# \u8bbe\u7f6e\u5f53\u524d\u5149\u6807\u7684\u5730\u5740 \njump_addr = 0x40136d\nidc.jumpto(jump_addr)\n\n# \u83b7\u53d6\u6240\u6709\u7684\u6307\u4ee4\u5730\u5740\u5e76\u9644\u52a0\u4e0a\u6240\u6709\u7684\u540d\u79f0\u4fe1\u606f\nwith open(&quot;D:\\\\My Code\\\\out.txt&quot;, &quot;wt&quot;) as file:\n    for ea in idautils.Heads():\n        name = ida_name.get_name(ea)\n\n        try:\n            file.write(hex(ea) + f&quot; Option name is: {name}\\n&quot;)\n        except Exception as e:\n            print(f&quot;Error is: {e}&quot;)\n\n# \u83b7\u53d6\u548c\u7ed9\u5b9a\u540d\u79f0\u5173\u8054\u7684\u5730\u5740\nprint(hex(ida_name.get_name_ea(0, &quot;printf&quot;)))\n<\/code><\/pre>\n<h2>\u8bfb\u53d6\u548c\u5199\u5165\u6570\u636e<\/h2>\n<p>TODO &#8230;&#8230;<\/p>\n<h1>\u4e00\u4e9b\u4f8b\u5b50<\/h1>\n<h2>RCTF Chaos<\/h2>\n<p>\u867d\u7136\u8fd9\u9053\u9898\u76ee\u88ab\u53c2\u8d5b\u65b9\u5f53\u6210\u7b7e\u5230\u9898\u76ee\u76f4\u63a5\u7ed9\u51faflag\u4e86,\u4f46\u662f\u6211\u4eec\u8fd8\u662f\u80fd\u591f\u770b\u5230\u5728\u7a0b\u5e8f\u91cc\u9762\u53ef\u4ee5\u770b\u5230\u5b58\u5728\u4e00\u4e9b\u82b1\u6307\u4ee4\u7684.<br \/>\n\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u5199\u4e00\u4e2a\u7b80\u5355\u7684frida\u811a\u672c\u6765\u8fd8\u539f\u539f\u6765\u7684\u51fd\u6570<\/p>\n<p>\u82b1\u6307\u4ee4 1<\/p>\n<pre><code class=\"language-cpp\">.text:00B71490 83 C4 04                add     esp, 4\n.text:00B71493 75 02                   jnz     short loc_B71497\n.text:00B71493                         ; ---------------------------------------------------------------------------\n.text:00B71495 E9                      db 0E9h\n.text:00B71496 ED                      db 0EDh\n.text:00B71497                         ; ---------------------------------------------------------------------------\n.text:00B71497\n.text:00B71497                         loc_B71497:                             ; CODE XREF: .text:00B71493\u2191j\n.text:00B71497 E8 00 00 00 00          call    $+5\n.text:00B7149C 58                      pop     eax\n.text:00B7149D 89 85 78 FF FF FF       mov     [ebp-88h], eax\n<\/code><\/pre>\n<p>\u82b1\u6307\u4ee4 2<\/p>\n<pre><code class=\"language-cpp\">db 0EAh\ndb 0EBh, 9 --&gt; JMP ...\n<\/code><\/pre>\n<p>\u7136\u540e\u6211\u4eec\u5206\u6790\u5bf9\u5e94\u7684\u7279\u5f81,\u5c31\u53ef\u4ee5\u7f16\u5199\u5bf9\u5e94\u7684patch\u811a\u672c\u4e86<\/p>\n<pre><code class=\"language-python\">import idc\n\nstart_addr = 0x00401000\nend_addr = 0x004914BE\n\n&quot;&quot;&quot;\n.text:00B71490 83 C4 04                add     esp, 4\n.text:00B71493 75 02                   jnz     short loc_B71497\n.text:00B71493                         ; ---------------------------------------------------------------------------\n.text:00B71495 E9                      db 0E9h\n.text:00B71496 ED                      db 0EDh\n.text:00B71497                         ; ---------------------------------------------------------------------------\n.text:00B71497\n.text:00B71497                         loc_B71497:                             ; CODE XREF: .text:00B71493\u2191j\n.text:00B71497 E8 00 00 00 00          call    $+5\n.text:00B7149C 58                      pop     eax\n.text:00B7149D 89 85 78 FF FF FF       mov     [ebp-88h], eax\n&quot;&quot;&quot;\n\n# \u6bcf\u6b21\u8bfb\u53d6\u5230\u4e00\u6bb5\u76f8\u540c\u7684\u6570\u636e\u540e,patch\u5176\u4e2d\u7684\u82b1\u6307\u4ee4\u4e3a NOP\n# 75 02 e9 ed 08 -&gt; \u628a\u4e2d\u95f4\u7684 e9 ed \u66ff\u6362\u4e3a 90 90\ncur_addr = start_addr\nwhile cur_addr &lt; end_addr:\n    byte_val = idc.get_wide_word(cur_addr)\n    if byte_val == 0x0275:\n        next_next_word = idc.get_wide_word(cur_addr + 4)\n        if next_next_word == 0x00e8:\n            print(f&quot;Find flower instruction at {cur_addr + 2:08x}, patching...&quot;)\n            idc.patch_byte(cur_addr + 2, 0x90)\n            idc.patch_byte(cur_addr + 3, 0x90)\n    cur_addr += 1\nprint(&quot;First pass done.&quot;)\n\n&quot;&quot;&quot;\n  db 0EAh, 0EBh, 9\n&quot;&quot;&quot;\ncur_addr = start_addr\nwhile cur_addr &lt; end_addr:\n    byte_fir = idc.get_wide_byte(cur_addr)\n    byte_sec = idc.get_wide_byte(cur_addr + 1)\n    byte_thi = idc.get_wide_byte(cur_addr + 2)\n    if byte_fir == 0xEA and byte_sec == 0xEB and byte_thi == 0x09:\n        print(f&quot;Find flower instruction at {cur_addr:08x}, patching...&quot;)\n        idc.patch_byte(cur_addr, 0x90)\n    cur_addr += 1\nprint(&quot;Second pass done.&quot;)\n<\/code><\/pre>\n<p>\u7136\u540e\u5728ida\u4e2d\u5c31\u53ef\u4ee5\u770b\u5230\u7ed3\u679c\u4e86<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cloud-map-bed-1351541725.cos.ap-nanjing.myqcloud.com\/pic\/20251124190832.png\" alt=\"image.png|500\"><\/p>\n<p>\u4f46\u662f\u6211\u7684\u5df2\u7ecfpatch\u8fc7\u4e86,\u6240\u4ee5\u6ca1\u6709\u663e\u793a\u51fapatch\u7684\u5730\u5740,\u5982\u679c\u662f\u6ca1\u6709patch\u8fc7\u7684\u7a0b\u5e8f\u4f1a\u663e\u793a\u51fa\u5730\u5740,\u53cc\u51fb\u53ef\u4ee5\u8df3\u8f6c\u5230\u5730\u5740\u5904\u67e5\u770b\u662f\u5426patch\u9519\u4e86\u4f4d\u7f6e.<\/p>\n<p>\u63a5\u4e0b\u6765\u5c31\u53ef\u4ee5\u5220\u9664i64,\u4fdd\u5b58patch,\u8ba9ida\u91cd\u65b0\u5206\u6790\u4e86<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cloud-map-bed-1351541725.cos.ap-nanjing.myqcloud.com\/pic\/20251124191152.png\" alt=\"image.png\"><\/p>\n<p>\u53ef\u4ee5\u770b\u5230\u5df2\u7ecf\u80fd\u8fd8\u539f\u539f\u6765\u7684\u903b\u8f91\u4e86.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u73af\u5883\u642d\u5efa \u4e3a\u4e86\u65b9\u4fbfida ipython\u811a\u672c\u7b49\u7684\u5b66\u4e60,\u5148\u5728vscode\u4e2d\u642d\u5efa\u4e00\u4e0bida python\u73af\u5883\u65b9\u4fbf\u6211 [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-52","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/52","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/comments?post=52"}],"version-history":[{"count":1,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/52\/revisions"}],"predecessor-version":[{"id":53,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/posts\/52\/revisions\/53"}],"wp:attachment":[{"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/media?parent=52"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/categories?post=52"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.seekinthevortex.cn\/index.php\/wp-json\/wp\/v2\/tags?post=52"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}