IDA批量處理VirusShare樣本獲得asm檔案與bytes檔案

最近需要asm檔案和bytes檔案的樣本做分析，在看雪論壇上看到可擁有IDA批量模式！這也太香了吧！

話不多說直接上程式碼

import sys
import os
import subprocess

global idcScriptFileName
global ida32tFilePath
global ida64tFilePath
#global ida32wFilePath
#global ida64wFilePath

# File these feilds with ur own ida file path and the idc file u want to execute!

idcScriptFileName = "batchmod.idc"
ida32tFilePath ='"D:\IDA 7.0\idat.exe"'
ida64tFilePath = "D:\IDA 7.0\idat64.exe"


#the binary file list text
TargetList = "D:\\batch_disassemble\\target_file_list.txt"
TargetFile_object = open(TargetList,"r").readlines()
for eachline in TargetFile_object:
    eachline = eachline.replace('\n','').replace('\r','')
    print(eachline)
    if os.path.exists(eachline):
        tmpExecStr = ida32tFilePath +" -A -c -S" + idcScriptFileName + " " + eachline
        os.system(tmpExecStr) #single process with cmdwindow
print ("All Process have been started!")

注意：大家在用IDA的時候先看一下自己IDA目錄下是什麼exe，網上有些是idaw，比如我就只有idat.exe。

程式碼中用到的idc檔案如下（我是放在同一個目錄的）

//by obaby
#include <idc.idc>

static main()
{
	// turn on coagulation of data in the final pass of analysis
	SetShortPrm(INF_AF2, GetShortPrm(INF_AF2) | AF2_DODATA);
	Message("Waiting for the end of the auto analysis...\n");
	Wait();
	Message("\n\n------ Creating the output file.... --------\n");
	auto path = GetIdbPath()[0:-3] + "asm";  //change the data to the length of the file path 
	auto byteFilePath = GetIdbPath()[0:-3] + "bytes";//change the data to the length of the file path 
	auto file = fopen(path,"w");
	auto byteFile = fopen(byteFilePath,"w");
	GenerateFile(OFILE_LST,file,0,-1,0);
	auto addr = MinEA();
	auto i=0;
	for( addr; addr != BADADDR; addr = NextAddr(addr) ){
    		fprintf(byteFile,"%02X",IdbByte(addr));
    		if (i == 15){
        		fprintf(byteFile,"\n");
        		i=0;
    		} else {
        		fprintf(byteFile," ");
        		i++;
    		}
	}
	fclose(file);
	fclose(byteFile);
	Message("All done, exiting...\n");
	Exit(0); // exit to OS, error code 0 - success
}

程式碼中的檔名是我自己獲取的我的檔案的路徑，程式碼如下

import os
file_path='D:\\traindata_1\\bancos'
file_list=[i for i in os.listdir(file_path)]
fw=open('target_file_list.txt','a')
for file in file_list:
    fw.write('%s\\%s\n'%(file_path,file))
fw.close()