- UID
- 2
- 精华
- 76
- 积分
- 7343
- 威望
- 291 点
- 宅币
- 5593 个
- 贡献
- 253 次
- 宅之契约
- 0 份
- 最后登录
- 2024-4-24
- 在线时间
- 948 小时
- QQ
用户组: 真·技术宅
- UID
- 2
- 精华
- 76
- 威望
- 291 点
- 宅币
- 5593 个
- 贡献
- 253 次
- 宅之契约
- 0 份
- 在线时间
- 948 小时
- 注册时间
- 2014-1-25
|
本帖最后由 元始天尊 于 2015-11-7 16:05 编辑
给ida用的,处于实际需要,临时编写的代码:编程实现查找“貌似相同”的函数,纯字节码对比,用了散列
- map={}
- #scale/256 即为要比对的字节数大小 offset:离函数头偏移
- scale=0x1000
- offset=5
- i=0
- while(i<scale):
- map[i]=[0,""]
- i=i+1
- addr=NextFunction(0)
- while(addr<0xffffffff):
- sum=0
- i=0
- #确保函数足够大
- if(GetFunctionName(addr)==GetFunctionName(addr+0x20)):
- while(i<(scale/256)):
- #越过push ebp;mov ebp,esp
- sum=sum+Byte(addr+offset+i)
- i=i+1
- if(map[sum][0]==0):
- map[sum][1]=GetFunctionName(addr)
- else:
- map[sum][1]=map[sum][1]+" "+GetFunctionName(addr)
- map[sum][0]=map[sum][0]+1
- addr=NextFunction(addr)
- i=0
- while(i<scale):
- if(map[i][0]>=2):
- print map[i][1]
- i=i+1
复制代码
效果:
sub_204B0 sub_21270
FreeWritablePage sub_180E0 sub_193A0 sub_21180
__SEH_prolog4 __SEH_prolog4_GS
sub_111CF sub_151E0 sub_173B0 sub_1F630 sub_20330
sub_20400 sub_211D0
sub_16910 sub_17D50 sub_19010 sub_20B40
sub_16150 sub_198C0 sub_1FF00 sub_1FFD0 sub_200A0
GetProcessFileObjectName sub_17DB0 sub_19070 sub_1AA50 sub_1B5B0 sub_20BA0
sub_21770 sub_21BC0
GetSysModules GetRegVal sub_17840 sub_17F20 sub_18A40 sub_191E0 sub_1A690 sub_20D10 sub_20E60 sub_21D90
sub_165D0 sub_20900
sub_12599 sub_1D980
sub_10730 sub_26A40
sub_106D0 sub_14A2A
sub_153A0 sub_15510
sub_1CA70 sub_1D400
sub_17270 sub_183F0 sub_19C70 sub_1FBD0 sub_21680
sub_223C0 sub_22460
sub_19730 sub_1C0C0 sub_1C9B0 sub_1DEC0 CsqPeekNextIrp sub_22B20
sub_14B10 sub_1C000 sub_213D0
__aulldiv sub_18C50
sub_22190 sub_22210
sub_177D0 sub_203C0
sub_15440 sub_22860
FreeBuffer sub_17EF0 sub_191B0 sub_20CE0 sub_222D0
sub_1EED0 sub_20540 sub_206E0
sub_1DB20 sub_22070
sub_1AAF0 sub_1E6D0 sub_1EAA0 sub_225E0
sub_19F30 sub_1EFF0
sub_10620 sub_1F990
sub_105A0 sub_105E0
StartRoutine sub_182C0 sub_19B40 sub_21550 sub_229F0
sub_1E820 sub_1E980
sub_179F0 sub_18BF0 sub_1A840 sub_21F40
sub_1C1B0 sub_1C280 sub_1D3B0
sub_201F0 sub_22570
GetTimeDateStamp1 GetTimeDateStamp2 sub_184E0 sub_18640 GetTimeDateStamp3 GetTimeDateStamp4
sub_141A2 sub_1D000
sub_1C2E0 sub_1C330
sub_17A50 sub_18CA0 sub_19580 sub_1A8A0 sub_21FA0
sub_10530 sub_167B0 sub_17BF0 sub_18EB0 sub_209E0
sub_103E0 sub_17360
sub_1DA40 __alldiv
sub_18110 sub_19990 sub_20170
memcpy sub_10DF0
sub_13A77 sub_15DB0
sub_15330 sub_1CB80
sub_193D0 DriverEntry sub_22910
sub_16710 sub_17B50 sub_18E10 sub_20860
sub_1F660 sub_1FCD0
sub_17530 sub_187A0 sub_1A3F0 sub_21920
sub_17810 sub_1D910
sub_128B7 sub_138FD
sub_13C65 sub_1D7D0 |
|