IDA Pro是玩逆向工程必不可少的工具，但是很遗憾IDA Pro好像不支持直接导入map文件（如果有谁知道可以，请告诉我）。前几天分析一个程序，很奇怪提供了MAP却没提供PDB。不悦，顺手写了一段把map文件转换成IDA Pro的idc脚本的Python小程序：
# -*- coding:utf-8 -*-
from __future__ import with_statement
import sys
import os
def map2idc(in_file, out_file):
with open(out_file, 'w') as fout:
fout.write('#include <idc.idc>\n')
fout.write('static main()\n{\n')
with open(in_file) as fin:
for line in fin:
list = line.split()
if len(list) >= 3 and len(str(list[2])) == 8 and str(list[2]).isalnum():
fout.write('\tMakeName(0x%s, "%s");\n' % (list[2], list[1]))
fout.write('}\n')
def main():
from optparse import OptionParser
parser = OptionParser(usage='usage: %prog <map filename>')
(options, args) = parser.parse_args()
if len(args) < 1:
parser.error('incorrect number of arguments')
return map2idc(args[0], os.path.splitext(args[0])[0]+'.idc')
if __name__=="__main__":
sys.exit(main())
from __future__ import with_statement
import sys
import os
def map2idc(in_file, out_file):
with open(out_file, 'w') as fout:
fout.write('#include <idc.idc>\n')
fout.write('static main()\n{\n')
with open(in_file) as fin:
for line in fin:
list = line.split()
if len(list) >= 3 and len(str(list[2])) == 8 and str(list[2]).isalnum():
fout.write('\tMakeName(0x%s, "%s");\n' % (list[2], list[1]))
fout.write('}\n')
def main():
from optparse import OptionParser
parser = OptionParser(usage='usage: %prog <map filename>')
(options, args) = parser.parse_args()
if len(args) < 1:
parser.error('incorrect number of arguments')
return map2idc(args[0], os.path.splitext(args[0])[0]+'.idc')
if __name__=="__main__":
sys.exit(main())
使用方法：
python map2idc.py /path/to/mapfile
在IDA Pro中，加载待分析程序后，File-->IDC file...，选生成的IDC文件。