@@ -0,0 +1,2623 @@
+import idc%0Aimport idautils%0A%0A%0Adef enum_segments():%0A    for segstart in idautils.Segments():%0A        segend = idc.SegEnd(segstart)%0A        segname = idc.SegName(segstart)%0A        yield segstart, segend, segname%0A%0A%0Adef find_pointers(start, end):%0A    for va in range(start, end-0x4):%0A        ptr = idc.Dword(va)%0A        if idc.SegStart(ptr) == idc.BADADDR:%0A            continue%0A%0A        yield va, ptr%0A%0A%0Adef is_head(va):%0A    return idc.isHead(idc.GetFlags(va))%0A%0A%0Adef get_head(va):%0A    if is_head(va):%0A        return va%0A    else:%0A        return idc.PrevHead(va)%0A%0A%0Adef is_code(va):%0A    if is_head(va):%0A        flags = idc.GetFlags(va)%0A        return idc.isCode(flags)%0A    else:%0A        head = get_head(va)%0A        return is_code(head)%0A%0A%0ACACHED_STRINGS = list(idautils.Strings())%0Adef is_in_string(va):%0A    for s in CACHED_STRINGS:%0A        if s.ea %3C= va %3C s.ea + s.length:%0A            return True%0A    return False%0A%0A%0Adef is_defined(va):%0A    pass%0A%0A%0Adef is_unknown(va):%0A    return idc.isUnknown(idc.GetFlags(va))%0A%0A%0Adef main():%0A    for segstart, segend, segname in enum_segments():%0A        if segname not in ('.text', '.data'):%0A            continue%0A%0A        for src, dst in find_pointers(segstart, segend):%0A            if is_code(src):%0A                # ignore instructions like:%0A                #%0A                #     call    ds:__vbaGenerateBoundsError%0A                #print('code pointer: 0x%25x -%3E 0x%25x' %25 (src, dst))%0A                continue%0A%0A            if is_in_string(src):%0A                # for example, the following contains 0x444974 (a common valid offset):%0A                #%0A                #     text:004245B0 aRequestid    db 'requestID',%0A                #%0A                # enable or disable this behavior as you wish%0A                print('string pointer: 0x%25x -%3E 0x%25x' %25 (src, dst))%0A                pass%0A                #continue%0A%0A            print('pointer from 0x%25x to 0x%25x' %25 (src, dst))%0A%0A            if is_unknown(dst):%0A                print('destination unknown, making byte: 0x%25x' %25 (dst))%0A                idc.MakeByte(dst)%0A%0A            elif is_head(dst):%0A                # things are good%0A                pass%0A%0A            else:%0A                # need to undefine head, and make byte%0A                head_va = get_head(dst)%0A                print('destination overlaps with head: 0x%25x' %25 (head_va))%0A                idc.MakeUnkn(head_va, dst - head_va)%0A                idc.MakeByte(head_va)%0A                idc.MakeByte(dst)%0A%0A            idc.MakeUnkn(src, 4)%0A            idc.MakeDword(src)%0A            # this doesn't seem to always work :-(%0A            idc.OpOffset(src, 0)%0A%0A%0Aif __name__ == '__main__':%0A    main()%0A

add ida_find_ptrs.py