ida block search script add x64_86(mac binary) support

tobefuturer · Feb 9, 2017 · 23dd400 · 23dd400
1 parent 4a942a6
commit 23dd400
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/search_oc_block/ida_search_block.py b/search_oc_block/ida_search_block.py
@@ -11,6 +11,9 @@
 
 IS32BIT = not idaapi.get_inf_structure().is_64bit()
 
+IS_MAC = 'X86_64' in idaapi.get_file_type_name()
+
+print "Start analyze binary for " + ("Mac" if IS_MAC else "iOS")
 
 
 def isInText(x):
@@ -84,7 +87,10 @@ def superFuncForStackBlock(block_func):
     if len(superFuncs) != 1:
         return None
     super_func_addr = superFuncs[0]
-    return super_func_addr | GetReg(super_func_addr, "T") # thumb
+    if IS_MAC:
+        return super_func_addr
+    else:
+        return super_func_addr | GetReg(super_func_addr, "T") # thumb
 
 
 def superFuncForBlockFunc(block_func):
@@ -110,8 +116,9 @@ def findBlockName(block_func):
     superBlockFuncAddr = superFuncForBlockFunc(block_func)
     if superBlockFuncAddr == None:
         return "";
-
-    superBlockFuncAddr = superBlockFuncAddr | GetReg(superBlockFuncAddr, "T") # thumb
+    if not IS_MAC:
+        superBlockFuncAddr = superBlockFuncAddr | GetReg(superBlockFuncAddr, "T") # thumb
+
     superBlockName = findBlockName(superBlockFuncAddr)
 
     if len(superBlockName) == 0: