+ types, enums and xrefs examples

+ README.md update

README.md

@@ -33,11 +33,20 @@ It looks like this:
 - Simple transformations in disassembler view [source code](https://github.com/inforion/idapython-cheatsheet/blob/master/listing/disasm_transform.py) 
 - Make comment to function, using it's argument [source code](https://github.com/inforion/idapython-cheatsheet/blob/master/listing/function_arguments.py) 
 
+### Types
+- Apply types to functions and data [source code](https://github.com/inforion/idapython-cheatsheet/blob/master/types/apply_types.py) 
+- Work with enums [source code](https://github.com/inforion/idapython-cheatsheet/blob/master/types/enums.py) 
+
+### Xrefs
+- Add simple code and data cross-references [source code](https://github.com/inforion/idapython-cheatsheet/blob/master/xrefs/simple_xrefs.py) 
+
 ### Miscellaneous
 - Parsing Global Descriptor Table (GDT, x86) [source code](https://github.com/inforion/idapython-cheatsheet/blob/master/misc/parse_gdt.py)
 - Parsing Interrupt Descriptor Table (IDT, x86) [source code](https://github.com/inforion/idapython-cheatsheet/blob/master/misc/parse_idt.py)
 
 ## Links
 
 - ["The Beginner's Guide to IDAPython" by Alexander Hanel](https://leanpub.com/IDAPython-Book)
+- ["Introduction to IDAPython" by Ero Carrera](https://github.com/cyphunk/sectk/blob/master/docs/Software_RE/Ero-Introduction%20to%20IDAPython.pdf)
+- [IDAPyHelper - script that helps writing IDAPython scripts and plugins](https://github.com/patois/IDAPyHelper)
 

types/apply_types.py

@@ -0,0 +1,23 @@
+''' Work with type information (set/change type for object)
+
+
+## T_INFO* constants
+
+idc.TINFO_GUESSED   = 0x0000 # this is a guessed type
+idc.TINFO_DEFINITE  = 0x0001 # this is a definite type
+idc.TINFO_DELAYFUNC = 0x0002 # if type is a function and no function exists at ea,
+                             # schedule its creation and argument renaming to
+                             # auto-analysis otherwise try to create it immediately
+
+ida_typeinf.TINFO_STRICT = _ida_typeinf.TINFO_STRICT
+
+'''
+
+def set_type(ea, type_str):
+    _type = parse_decl(type_str, 0)  
+    apply_type(ea, _type, 0)
+
+
+# Usage:
+# Set type to printf-like function
+# set_type(0x000105E0, "int printf(const char *fmt, ...)")

types/enums.py

@@ -0,0 +1,43 @@
+''' Work with enums
+
+
+'''
+
+import re
+import os
+import sys
+
+def create_enum_from_header(filename, enum_name):
+    ''' Parse C header file with defines, make enum from them:
+
+    #define EPERM            1      /* Operation not permitted */
+
+    '''
+    h_file_data = open(filename).read()
+    defines = re.findall(r'#define\s+(\w+)\s+(\d+)\s+\/\*([\w\s]+)\*\/', h_file_data)
+    enum_id = add_enum(idaapi.BADNODE, enum_name, 0)
+
+    for m_name, m_value, m_comment in defines:
+        add_enum_member(enum_id, m_name, int(m_value), ida_enum.DEFMASK)
+        m_id = get_enum_member_by_name(m_name)
+        set_enum_member_cmt(m_id, m_comment, repeatable=1)
+
+
+def create_linux_errno_enum():
+    path = os.path.dirname(os.path.realpath(__file__))
+    filename = os.path.join(path, 'errno.h')
+    create_enum_from_header(filename, 'LINUX_ERRNO')
+
+
+def make_arg_enum_member(ea, enum_id):
+    ''' Suggest we have instruction like this:
+
+        push    0x18
+
+    Let's make it more pretty:
+        
+        push    EMFILE          ;  Too many open files
+
+    '''
+    op_enum(ea, 0, enum_id, 0)
+

types/errno.h

@@ -0,0 +1,152 @@
+
+#ifndef _ASM_GENERIC_ERRNO_BASE_H
+#define _ASM_GENERIC_ERRNO_BASE_H
+
+#define EPERM            1      /* Operation not permitted */
+#define ENOENT           2      /* No such file or directory */
+#define ESRCH            3      /* No such process */
+#define EINTR            4      /* Interrupted system call */
+#define EIO              5      /* I/O error */
+#define ENXIO            6      /* No such device or address */
+#define E2BIG            7      /* Argument list too long */
+#define ENOEXEC          8      /* Exec format error */
+#define EBADF            9      /* Bad file number */
+#define ECHILD          10      /* No child processes */
+#define EAGAIN          11      /* Try again */
+#define ENOMEM          12      /* Out of memory */
+#define EACCES          13      /* Permission denied */
+#define EFAULT          14      /* Bad address */
+#define ENOTBLK         15      /* Block device required */
+#define EBUSY           16      /* Device or resource busy */
+#define EEXIST          17      /* File exists */
+#define EXDEV           18      /* Cross-device link */
+#define ENODEV          19      /* No such device */
+#define ENOTDIR         20      /* Not a directory */
+#define EISDIR          21      /* Is a directory */
+#define EINVAL          22      /* Invalid argument */
+#define ENFILE          23      /* File table overflow */
+#define EMFILE          24      /* Too many open files */
+#define ENOTTY          25      /* Not a typewriter */
+#define ETXTBSY         26      /* Text file busy */
+#define EFBIG           27      /* File too large */
+#define ENOSPC          28      /* No space left on device */
+#define ESPIPE          29      /* Illegal seek */
+#define EROFS           30      /* Read-only file system */
+#define EMLINK          31      /* Too many links */
+#define EPIPE           32      /* Broken pipe */
+#define EDOM            33      /* Math argument out of domain of func */
+#define ERANGE          34      /* Math result not representable */
+
+#endif
+
+
+#ifndef _ASM_GENERIC_ERRNO_H
+#define _ASM_GENERIC_ERRNO_H
+
+
+#define	EDEADLK		35	/* Resource deadlock would occur */
+#define	ENAMETOOLONG	36	/* File name too long */
+#define	ENOLCK		37	/* No record locks available */
+#define	ENOSYS		38	/* Function not implemented */
+#define	ENOTEMPTY	39	/* Directory not empty */
+#define	ELOOP		40	/* Too many symbolic links encountered */
+#define	EWOULDBLOCK	EAGAIN	/* Operation would block */
+#define	ENOMSG		42	/* No message of desired type */
+#define	EIDRM		43	/* Identifier removed */
+#define	ECHRNG		44	/* Channel number out of range */
+#define	EL2NSYNC	45	/* Level 2 not synchronized */
+#define	EL3HLT		46	/* Level 3 halted */
+#define	EL3RST		47	/* Level 3 reset */
+#define	ELNRNG		48	/* Link number out of range */
+#define	EUNATCH		49	/* Protocol driver not attached */
+#define	ENOCSI		50	/* No CSI structure available */
+#define	EL2HLT		51	/* Level 2 halted */
+#define	EBADE		52	/* Invalid exchange */
+#define	EBADR		53	/* Invalid request descriptor */
+#define	EXFULL		54	/* Exchange full */
+#define	ENOANO		55	/* No anode */
+#define	EBADRQC		56	/* Invalid request code */
+#define	EBADSLT		57	/* Invalid slot */
+
+#define	EDEADLOCK	EDEADLK
+
+#define	EBFONT		59	/* Bad font file format */
+#define	ENOSTR		60	/* Device not a stream */
+#define	ENODATA		61	/* No data available */
+#define	ETIME		62	/* Timer expired */
+#define	ENOSR		63	/* Out of streams resources */
+#define	ENONET		64	/* Machine is not on the network */
+#define	ENOPKG		65	/* Package not installed */
+#define	EREMOTE		66	/* Object is remote */
+#define	ENOLINK		67	/* Link has been severed */
+#define	EADV		68	/* Advertise error */
+#define	ESRMNT		69	/* Srmount error */
+#define	ECOMM		70	/* Communication error on send */
+#define	EPROTO		71	/* Protocol error */
+#define	EMULTIHOP	72	/* Multihop attempted */
+#define	EDOTDOT		73	/* RFS specific error */
+#define	EBADMSG		74	/* Not a data message */
+#define	EOVERFLOW	75	/* Value too large for defined data type */
+#define	ENOTUNIQ	76	/* Name not unique on network */
+#define	EBADFD		77	/* File descriptor in bad state */
+#define	EREMCHG		78	/* Remote address changed */
+#define	ELIBACC		79	/* Can not access a needed shared library */
+#define	ELIBBAD		80	/* Accessing a corrupted shared library */
+#define	ELIBSCN		81	/* .lib section in a.out corrupted */
+#define	ELIBMAX		82	/* Attempting to link in too many shared libraries */
+#define	ELIBEXEC	83	/* Cannot exec a shared library directly */
+#define	EILSEQ		84	/* Illegal byte sequence */
+#define	ERESTART	85	/* Interrupted system call should be restarted */
+#define	ESTRPIPE	86	/* Streams pipe error */
+#define	EUSERS		87	/* Too many users */
+#define	ENOTSOCK	88	/* Socket operation on non-socket */
+#define	EDESTADDRREQ	89	/* Destination address required */
+#define	EMSGSIZE	90	/* Message too long */
+#define	EPROTOTYPE	91	/* Protocol wrong type for socket */
+#define	ENOPROTOOPT	92	/* Protocol not available */
+#define	EPROTONOSUPPORT	93	/* Protocol not supported */
+#define	ESOCKTNOSUPPORT	94	/* Socket type not supported */
+#define	EOPNOTSUPP	95	/* Operation not supported on transport endpoint */
+#define	EPFNOSUPPORT	96	/* Protocol family not supported */
+#define	EAFNOSUPPORT	97	/* Address family not supported by protocol */
+#define	EADDRINUSE	98	/* Address already in use */
+#define	EADDRNOTAVAIL	99	/* Cannot assign requested address */
+#define	ENETDOWN	100	/* Network is down */
+#define	ENETUNREACH	101	/* Network is unreachable */
+#define	ENETRESET	102	/* Network dropped connection because of reset */
+#define	ECONNABORTED	103	/* Software caused connection abort */
+#define	ECONNRESET	104	/* Connection reset by peer */
+#define	ENOBUFS		105	/* No buffer space available */
+#define	EISCONN		106	/* Transport endpoint is already connected */
+#define	ENOTCONN	107	/* Transport endpoint is not connected */
+#define	ESHUTDOWN	108	/* Cannot send after transport endpoint shutdown */
+#define	ETOOMANYREFS	109	/* Too many references: cannot splice */
+#define	ETIMEDOUT	110	/* Connection timed out */
+#define	ECONNREFUSED	111	/* Connection refused */
+#define	EHOSTDOWN	112	/* Host is down */
+#define	EHOSTUNREACH	113	/* No route to host */
+#define	EALREADY	114	/* Operation already in progress */
+#define	EINPROGRESS	115	/* Operation now in progress */
+#define	ESTALE		116	/* Stale NFS file handle */
+#define	EUCLEAN		117	/* Structure needs cleaning */
+#define	ENOTNAM		118	/* Not a XENIX named type file */
+#define	ENAVAIL		119	/* No XENIX semaphores available */
+#define	EISNAM		120	/* Is a named type file */
+#define	EREMOTEIO	121	/* Remote I/O error */
+#define	EDQUOT		122	/* Quota exceeded */
+
+#define	ENOMEDIUM	123	/* No medium found */
+#define	EMEDIUMTYPE	124	/* Wrong medium type */
+#define	ECANCELED	125	/* Operation Canceled */
+#define	ENOKEY		126	/* Required key not available */
+#define	EKEYEXPIRED	127	/* Key has expired */
+#define	EKEYREVOKED	128	/* Key has been revoked */
+#define	EKEYREJECTED	129	/* Key was rejected by service */
+
+/* for robust mutexes */
+#define	EOWNERDEAD	130	/* Owner died */
+#define	ENOTRECOVERABLE	131	/* State not recoverable */
+
+#define ERFKILL		132	/* Operation not possible due to RF-kill */
+
+#endif

xrefs/simple_xrefs.py

@@ -0,0 +1,34 @@
+''' Work with cross-references (add, delete, iterate)
+
+
+#      Flow types (combine with XREF_USER!):
+fl_CF   = 16              # Call Far
+fl_CN   = 17              # Call Near
+fl_JF   = 18              # jumpto Far
+fl_JN   = 19              # jumpto Near
+fl_F    = 21              # Ordinary flow
+
+XREF_USER = 32            # All user-specified xref types
+                          # must be combined with this bit
+
+
+# Data reference types (combine with XREF_USER!):
+dr_O    = ida_xref.dr_O  # Offset
+dr_W    = ida_xref.dr_W  # Write
+dr_R    = ida_xref.dr_R  # Read
+dr_T    = ida_xref.dr_T  # Text (names in manual operands)
+dr_I    = ida_xref.dr_I  # Informational
+
+
+'''
+
+
+def add_data_xref(from_ea, to_ea):
+    ''' Add simple xref from `from_ea` address to data at `to_ea` address '''
+    add_dref(from_ea, to_ea, XREF_USER | dr_O)
+
+
+def add_code_xref(from_ea, to_ea):
+    ''' Add simple xref from `from_ea` address to code at `to_ea` address '''
+    add_cref(from_ea, to_ea, XREF_USER | fl_CF)
+