MAX_SEARCH_DEPTH = 10# 定义递归函数，用于查找两个函数之间的交叉引用关系def find_cross_refs(func: sark.Function, target_func, G, max_depth, include_data_xref):    if max_depth == 0:        return False    max_depth -= 1     # 获取函数的所有引用    if include_data_xref:        refs = list(func.xrefs_from)    else:        refs = list(func.calls_from)    # 遍历函数的每一个引用    for ref in refs:        # 获取引用的地址        ref_addr = ref.to  # type: ignore         # 判断引用是否指向目标函数        if ref_addr == target_func.start_ea:            # 如果指向目标函数，则找到了交叉引用关系            # 在图中添加一条边表示函数之间的引用关系            # G.add_node(func, name=func.demangled)            # G.add_node(target_func, name=target_func.demangled)            G.add_edge(func.ea, target_func.ea)            return True         # 如果引用指向另一个函数，则递归调用find_cross_refs函数，查找两个函数之间的交叉引用关系         seg = sark.Segment(ea=ref_addr)        if seg.name != "__text":            #是 external Function            continue        else:            try:                ref_func = sark.Function(ea=ref_addr)            except Exception as e:                print(e)                continue        if find_cross_refs(ref_func, target_func, G, max_depth, include_data_xref):            # 如果找到了交叉引用关系，则在图中添加一条边表示函数之间的引用关系            # G.add_node(func, name=func.demangled)            # G.add_node(ref_func, name=ref_func.demangled)            G.add_edge(func.ea, ref_func.ea)            return True     # 如果遍历完所有引用后仍然没有找到交叉引用关系，则返回False    return False

# 1) Create the handler class    class MyHandler(idaapi.action_handler_t):        def __init__(self):            idaapi.action_handler_t.__init__(self)        # Say hello when invoked.        def activate(self, ctx):            print "Hello!"            return 1        # This action is always available.        def update(self, ctx):            return idaapi.AST_ENABLE_ALWAYS    # 2) Describe the action    action_desc = idaapi.action_desc_t(        'my:action',   # The action name. This acts like an ID and must be unique        'Say hello!',  # The action text.        MyHandler(),   # The action handler.        'Ctrl+H',      # Optional: the action shortcut        'Says hello',  # Optional: the action tooltip (available in menus/toolbar)        199)           # Optional: the action icon (shows when in menus/toolbars)    # 3) Register the action    idaapi.register_action(action_desc)

# 将 action 放到菜单中idaapi.attach_action_to_menu(        'Edit/Other/Manual instruction...', # The relative path of where to add the action        'my:action',                        # The action ID (see above)        idaapi.SETMENU_APP)                 # We want to append the action after the 'Manual instruction...'# 将 action 放到 toolbar 中idaapi.attach_action_to_toolbar(        "AnalysisToolBar",  # The toolbar name        'my:action')        # The action ID # 将 action 永久的放到某个 widget 的上下文菜单中# Create a widget, or retrieve a pointer to it.    form = idaapi.get_current_tform()    idaapi.attach_action_to_popup(form, None, "my:action", None)

import idaapi from .hookers import global_hooker_managerfrom typing import Optional class ActionManager(object):    def __init__(self):        self.__actions = []     def register(self, action):        self.__actions.append(action)        idaapi.register_action(                idaapi.action_desc_t(action.name, action.description, action, action.hotkey)            )        if isinstance(action, HexRaysPopupAction):            global_hooker_manager.register(HexRaysPopupRequestHandler(action))     def initialize(self):        pass     def finalize(self):        for action in self.__actions:            idaapi.unregister_action(action.name)  action_manager = ActionManager() class Action(idaapi.action_handler_t):    """    Convenience wrapper with name property allowing to be registered in IDA using ActionManager    """    description: Optional[str] = None    hotkey: Optional[str] = None     def __init__(self):        super(Action, self).__init__()     @property    def name(self):        return "HexRaysPyTools:" + type(self).__name__     def activate(self, ctx: idaapi.action_ctx_base_t):        raise NotImplementedError     def update(self, ctx: idaapi.action_ctx_base_t):        # return idaapi.AST_XXX        # 通常会根据  ctx.widget_type == idaapi.BWN_XXX 来判断当前是在哪个窗口        raise NotImplementedError  class HexRaysPopupAction(Action):    """    Wrapper around Action. Represents Action which can be added to menu after right-clicking in Decompile window.    Has `check` method that should tell whether Action should be added to popup menu when different items    are right-clicked.    Children of this class can also be fired by hot-key without right-clicking if one provided in `hotkey`    static member.    """     def __init__(self):        super(HexRaysPopupAction, self).__init__()     def activate(self, ctx: idaapi.action_ctx_base_t):        raise NotImplementedError     def check(self, hx_view):        # type: (idaapi.vdui_t) -> bool        raise NotImplementedError     def update(self, ctx: idaapi.action_ctx_base_t):        if ctx.widget_type == idaapi.BWN_PSEUDOCODE:            return idaapi.AST_ENABLE_FOR_WIDGET        return idaapi.AST_DISABLE_FOR_WIDGET  class HexRaysPopupRequestHandler(idaapi.Hexrays_Hooks):    def __init__(self, action):        super().__init__()        self.__action = action     def populating_popup(self, widget, popup_handle, vu):        if self.__action.check(vu):            idaapi.attach_action_to_popup(widget, popup_handle, self.__action.name, None)        return 0

class XrefRoadMapAction(HexRaysPopupAction):    """    Convenience wrapper with name property allowing to be registered in IDA using ActionManager    """    description: Optional[str] = "Find Xref Road map between A and B"    hotkey: Optional[str] = "Alt-F3"     def __init__(self):        super(Action, self).__init__()     def check(self, hx_view: idaapi.vdui_t) -> bool:        return True     def activate(self, ctx: idaapi.action_ctx_base_t):        # 获取光标所在的函数地址        cur_ea = idaapi.get_screen_ea()        try:            cur_func = sark.Function(ea=cur_ea)        except Exception as e:            traceback.print_exc()            # 如果光标不在函数中，则提示错误            print("Error: cursor is not in a function!")            return         # 获取用户输入的目标函数的地址        target_func_addr = idaapi.ask_addr(defval=0, format="Enter target function address:")        if target_func_addr == idaapi.BADADDR or target_func_addr is None:            # 如果用户输入的是无效的地址，则提示错误            print("Error: invalid target function address!")            return         # 获取目标函数的函数对象        try:            s = sark.Segment(ea=target_func_addr)            if s.name == "UNDEF":                target_func = sark.ExternFunction(ea=target_func_addr)            else:                target_func = sark.Function(ea=target_func_addr)  # type: ignore        except Exception as e:            # 如果目标函数不存在，则提示错误            traceback.print_exc()            print("Error: target function does not exist!")            return          import networkx as nx        # 创建有向图        G = nx.DiGraph()         # 在这里实现查找两个函数之间交叉引用关系的代码...        print(f"find a path between func {cur_func.demangled} and {target_func.demangled}, max search depth is {MAX_SEARCH_DEPTH}")        btn_selected = idaapi.ask_yn(idaapi.ASKBTN_NO, "是否包括 data xrefs?")        if btn_selected == idaapi.ASKBTN_CANCEL:            return        ret = find_cross_refs(cur_func, target_func, G, MAX_SEARCH_DEPTH, include_data_xref=True if btn_selected == idaapi.ASKBTN_YES else False)        if ret == False:            assert len(G.nodes()) == 0, "find_cross_refs 返回 False，但是 G 中有节点"         if len(G.nodes()) > 0:            # 绘制图             G.nodes[cur_func.ea][sark.ui.NXGraph.BG_COLOR] = 0x80             title = f"Path from `{cur_func.demangled}` to `{target_func.demangled}`"             # Create an NXGraph viewer            viewer = sark.ui.NXGraph(G, handler=sark.ui.AddressNodeHandler(), title=title)             # Show the graph            viewer.Show()        else:            idaapi.warning("Cannot find a path!!!")     def update(self, ctx: idaapi.action_ctx_base_t):         # 获取当前窗口的类型        widget_type = ctx.widget_type         # 如果当前窗口是反汇编或者反编译窗口，则菜单项可用        if widget_type == idaapi.BWN_DISASM or widget_type == idaapi.BWN_PSEUDOCODE:            return idaapi.AST_ENABLE_FOR_WIDGET        else:            return idaapi.AST_DISABLE_FOR_WIDGET

# 往期推荐

1、在 Windows下搭建LLVM 使用环境

2、深入学习smali语法

3、安卓加固脱壳分享

4、Flutter 逆向初探

5、一个简单实践理解栈空间转移

6、记一次某盾手游加固的脱壳与修复