# gen_fcg. Py
# - * - coding: utf-8 - * -
# python 2
The import pickled
The import idaapi
The import of logging
The import sys
Logging. BasicConfig (level=logging. The INFO format='% (asctime) s - % (filename) s/line: % d (lineno) - % (levelname) s - % (the message) s')
Def gen (out_name) :
Text_addr=ScreenEA ()
FCG=dict ()
For callee_addr Functions provides in () :
Callee_name=GetFunctionName (callee_addr)
For caller_addr in CodeRefsTo (callee_addr, 0) :
Caller_name=GetFunctionName (caller_addr)
Logging. The info (callee_name + '-' + caller_name)
FCG [caller_name]=FCG. Get (caller_name, set ())
FCG [caller_name]. Add (callee_name)
Pickle. Dump (FCG, open (out_name, 'w'))
Print FCG
If __name__=="__main__ ':
Logging. The info (' sys. Argv '+ STR (sys. Argv))
Idaapi. AutoWait ()
Logging. The info (' start analyse... ')
Gen (' D: \ \ Lab \ \ data_win \ \ FCG \ \ FCG PKL ')
Idc. Exit (0)
Command line to invoke the command, for PE file parsing:
% % IDAQ_PATH - l./analysis. The log - c - A - s./gen_cfg py./CRACKME. EXE
Environment: IDA6.8, Windows 10, python2.7
But this method of FCG figure, remove the sub opening method (IDA identification code written by a programmer), for a lot of files, the rest API function of system is obtained only three: [' DialogFunc ', 'start', 'StartAddress], the result of the proportion of the total file is close to 50%, is this normal?
If it is not normal, what other ways to get a PE file FCG figure?