用法:
1假设dede导出的map文件名为pbkiller.map
2将pbkiller.map放到dede_map2idc.pl的同一目录下
3编辑dede_map2idc.pl如下行:
#######################
my $map_file="pbkiller.map";
my $idc_file=">pbkiller.idc";
#######################
4双击运行dede_map2idc.pl
5同一目录下pbkiller.idc为生成文件,可用ida导入
注:a ">pbkiller.idc"中的">"不要去掉,在perl中表示写文件
b 需要安装perl
由于不能上传附件:贴出dede_map2idc.pl中的内容:
======================================
#!/usr/bin/perl
use strict;
sub dump_idc;
#######################
my $map_file="pbkiller.map";
my $idc_file=">pbkiller.idc";
#######################
my $hex_pat = "[0-9A-Fa-f]+";
my $start;
my @entries;
my $line;
my $head;
my $detail;
my $tail;
open(INFILE,$map_file) or die "Can't open the map file:$!";
while ($line=<INFILE>) {
chop($line);
if($line eq '')
{
next;
}
if ($start eq '--fetch-next') {
# start, length, name, class
$start=$line;
$start=~m/^\s*$hex_pat:($hex_pat)\s+($hex_pat)H\s+(\w+)\s+(\w+)$/;
if (!$start) {
print STDERR "Invalid .map file format!";
exit -1;
}
$start = hex($1);
next;
}
$head=$line;
if ($head=~m/^\s+Start\s+Length\s+Name\s+Class/) {
$start = '--fetch-next';
next;
}
$detail=$line;
if ($detail=~m/^\s*$hex_pat:($hex_pat)\s*(.*)$/) {
my ($offset, $entry) = (hex($1), $2);
my $rva = $offset + $start;
push @entries, [$rva, $entry];
}
$tail=$line;
if ($tail=~m/^\s*Program entry point at $hex_pat:($hex_pat)\s*$/) {
print "end analysis"
}
}
close(INFILE);
@entries = sort { $a->[0] cmp $b->[0] } @entries;
&dump_idc;
sub dump_idc {
open(OUTFILE,$idc_file) or die "Can't open the idc file:$!";
print OUTFILE "#include <idc.idc>\n";
print OUTFILE "static main() {\n";
foreach (@entries) {
my ($rva, $entry) = @$_;
#$rva = hex($rva);
$entry =~ s/^\*/\$/;
$entry =~ s/^[<>\-]*//;
$entry =~ s/\(.*$//;
$entry =~ s/:.*$//;
$entry =~ s/\./?/;
$entry =~ s/\[([0-9]+)\]/_$1/g;
$entry =~ s/\[.*$/_$rva/;
$entry =~ s/;.*$//;
$entry =~ s/^\s *//;
next if !$entry;
printf OUTFILE "MakeName(0x%x, \"$entry\");\n", $rva, $entry;
}
print OUTFILE "}\n";
close(OUTFILE);
}
1;
======================================
[培训]科锐逆向工程师培训第53期2025年7月8日开班!