[原创]Python在逆向中应用一例(LIB自动签名idapro.sig脚本)

继前面一帖Python在逆向中应用一例(自制MFC映射消息识别ida插件)
作用：根据lib文件生成一个idapro签名识别文件,用来识别已知的函数.
用法：把lib放在提供的附件目录下,运行此脚本,会自动签名并且分类存放相关目标文件.

#!/usr/bin/env python

# -*- coding: utf-8 -*-

import os,shutil

from subprocess import call

class IDAProLibSig():

	def __init__(self,lib_name):

		self.target = ""

		if not lib_name:

			return

		self.set_target(lib_name)

		self.SignatureLIB(self.target)

	def set_target(self,name):

		self.Cleanup()

		self.target = name

	def SignatureLIB(self,name):

		call(["pcf", name + ".lib" , name])

		call(["sigmake", "-n", name , name])

	def ReMakeSignature(self):

		if os.path.isfile(self.target + ".exc"):

			lines = open(self.target + ".exc").readlines()

			open(self.target + ".exc", 'w').writelines(lines[1:-1])

	def Cleanup(self):

		if not self.target:

			return

		if os.path.isfile(self.target + ".err"):

			os.remove(self.target + ".err")

		if os.path.isfile(self.target + ".exc"):

			os.remove(self.target + ".exc")

		if os.path.isfile(self.target + ".pat"):

			os.remove(self.target + ".pat")

	def __del__(self):

		self.Cleanup()

def CallSigFormIDAProLibSig(lib_sig,lib):

	lib_sig.set_target(lib)

	lib_sig.SignatureLIB(lib_sig.target)

	lib_sig.ReMakeSignature()

	lib_sig.SignatureLIB(lib_sig.target)

def MakeCopySig(lib):

	if not os.path.exists("sig"):

		os.makedirs("sig")

	if not os.path.exists("lib"):

		os.makedirs("lib")

	shutil.move(lib + ".lib", "./lib/" + lib + ".lib")

	shutil.move(lib + ".sig","./sig/" + lib + ".sig")

if __name__ == "__main__":

	lib_sig = IDAProLibSig("")

	for lib in [f for f in os.listdir('.') if os.path.isfile(f)]:

		if os.path.splitext(lib)[1] == '.lib':

			CallSigFormIDAProLibSig(lib_sig,lib[0:-4])

			MakeCopySig(lib[0:-4])

		elif os.path.splitext(lib)[1] == '.a':

			CallSigFormIDAProLibSig(lib_sig,lib[0:-2])

			MakeCopySig(lib[0:-2])

上传的附件

idapro_sig.7z