IDAPython-Malware-Scripts/PLAY/API_resolve.py at master · cdong1012/IDAPython-Malware-Scripts · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
import json
import idaapi
import idc
import idautils
import xxhash


def hash_API(API_name):
    return (int.from_bytes(xxhash.xxh32(API_name, seed=1).digest(), 'big') + 0x4E986790) & 0xFFFFFFFF


def setup(json_file):
    global export_hashes
    exports_json = json.loads(open(json_file, 'rb').read())
    exports_list = exports_json['exports']
    for export in exports_list:
        api_hash = hash_API(export)
        export_hashes[api_hash] = export


def resolve_all_APIs(resolve_ea):
    global export_hashes
    if resolve_ea is None:
        print('resolve fails..')
        return

    for ref in idautils.CodeRefsTo(resolve_ea, 1):
        curr_ea = ref

        API_hash = 0

        while True:
            prev_instruction_ea = idc.prev_head(curr_ea)
            instruction = idc.generate_disasm_line(prev_instruction_ea, 1)
            if 'mov' in instruction and 'edx' in instruction:
                API_hash = idc.get_operand_value(
                    prev_instruction_ea, 1)
                print('API hash', hex(prev_instruction_ea),
                      hex(API_hash), export_hashes[API_hash])

                if API_hash in export_hashes:
                    idc.set_cmt(ref, export_hashes[API_hash], 0)
                break
            curr_ea = prev_instruction_ea

        curr_ea = ref
        for _ in range(4):
            next_instruction_ea = idc.next_head(curr_ea)
            instruction = idc.generate_disasm_line(next_instruction_ea, 1)
            if 'mov' in instruction and 'eax' in instruction:
                API_string = instruction[instruction.find(
                    'dword'):instruction.find(',')].replace('dword_', '')

                if len(API_string) == 0:
                    break
                API_address = int(API_string, 16)
                idc.set_name(API_address,
                             export_hashes[API_hash], idaapi.SN_FORCE)
                break
            curr_ea = next_instruction_ea


export_hashes = {}
setup('C:\\Users\\chuon\\Desktop\\MalwareCave\\PLAY-ransomware-analysis\\exports.json')

# change the address in the parameter to the address of the function resolving the API
resolve_all_APIs(0x40C4D0)