convertDataCode.py

import idc
import idaapi
import idautils
import ida_bytes
import ida_kernwin
import string
from nltk.corpus import words
import nltk
import ida_nalt
nltk.download("words")

import re
import ida_segment

try:
    class SelectTop(idaapi.action_handler_t):
        addr_top = 0
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            SelectTop.addr_top = idc.here()
            print ("Select Top: ", hex(SelectTop.addr_top))
            return SelectTop.addr_top

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS


    class SelectBottom(idaapi.action_handler_t):
        addr_bottom = 0
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            SelectBottom.addr_bottom = idc.here()
            print ("Select Bottom: ",  hex(SelectBottom.addr_bottom))
            return SelectBottom.addr_bottom

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class ConvertData(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            addr_bottom = SelectBottom.addr_bottom
            addr_top    = SelectTop.addr_top
            if not addr_bottom or not addr_top:
                print (addr_bottom, addr_top)
                return 0

            offset = addr_bottom % addr_top
            addr_top = addr_top - offset

            while addr_bottom != addr_top:
                ida_bytes.del_items(addr_bottom)
                addr_bottom = addr_bottom - 1

            addr_bottom = SelectBottom.addr_bottom - 3
            while addr_bottom != addr_top:
                if(ida_bytes.create_dword(addr_bottom, 4)):
                    pass
                else:
                    print ("create_dword: failed")
                    return 0
                addr_bottom = addr_bottom - 4
            return 1

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class ConvertArray4byte(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            addr_bottom = SelectBottom.addr_bottom
            addr_top    = SelectTop.addr_top
            if not addr_bottom or not addr_top:
                print (addr_bottom, addr_top)
                return 0

            offset = addr_bottom % addr_top
            addr_top = addr_top - offset

            addr_bottom = SelectBottom.addr_bottom - 3
            while addr_bottom >= addr_top:
                if(ida_bytes.create_dword(addr_bottom, 4)):
                    pass
                else:
                    print ("create_dword: failed")
                    return 0
                addr_bottom = addr_bottom - 4
            return 1

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class ConvertDataTop(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            print ("ConvertDataTop")
            addr_bottom = SelectBottom.addr_bottom
            addr_top    = SelectTop.addr_top
            # if  addr_top % 4 == 0:
            #     print addr_bottom, addr_top
            #     return 0

            offset = addr_bottom % 4
            addr_bottom = addr_bottom - offset

            while addr_bottom > addr_top:
                ida_bytes.del_items(addr_top)
                addr_top = addr_top + 1

            addr_top = SelectTop.addr_top
            while   addr_top <= addr_bottom:
                if(ida_bytes.create_dword(addr_top, 4)):
                    pass
                else:
                    print ("create_dword: failed")
                    return 0
                addr_top = addr_top + 4
            return 1

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS
    
    class undefineData(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            print ("undefineData")
            addr_bottom = SelectBottom.addr_bottom
            addr_top    = SelectTop.addr_top


            while addr_bottom > addr_top:
                ida_bytes.del_items(addr_top)
                addr_top = addr_top + 1


        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class convertCodeThumb(idaapi.action_handler_t):
        CODE = 2
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            print ("convertCode")
            addr_bottom = SelectBottom.addr_bottom
            addr_top    = SelectTop.addr_top
            
            func_count = 0
            code_count = 0

            ea = addr_top

            print ("\nLooking for undefined code starting at: %s:0x%X" % (idc.get_segm_name(ea), ea))
            print ("Test nha")
            print ("Addr TOP    : " + hex(ea))
            print ("Addr Bottom : " + hex(addr_bottom))
            while ea <= addr_bottom:
                try:
                    ida_bytes.del_items(ea)
                    if idc.get_segm_attr(ea, idc.SEGATTR_TYPE) == self.CODE:
                        if idc.get_func_name(ea) != '':
                            ea = idc.find_func_end(ea)
                            continue
                        else:
                            if idc.create_insn(ea):
                                code_count += 1
                            #if idc.MakeFunction(ea):
                            #    print("Creat function success: " + hex(ea))
                            #    func_count += 1
                            #else:
                            #    print("Creat function fail: " + hex(ea))

                except Exception as e: 
                    print(e)

                ea = ea + 2
            print ("Created %d new functions and %d new code blocks\n" % (func_count, code_count))

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class findStrlit(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)
            self.english_words = set(words.words())

        def make_strlit(self, start_addr, length):
            ida_bytes.del_items(start_addr, length + 1)
            
            if ida_bytes.create_strlit(start_addr, length + 1, ida_nalt.STRTYPE_C):
                return True
            else:
                return False

        def analyze_camel_case(self, text):
            try:
                filtered_words = re.findall(r'[A-Z]?[a-z]+|[A-Z]+(?=[A-Z]|$)', text)
                cnt = sum(1 for word in filtered_words if word.lower() in self.english_words)

                if(cnt >= 1):
                    return True
                else:
                    return False
            except Exception as e:
                return False
            
        def split_words_dp(self, text, word_set):
            dp = [None] * (len(text) + 1)
            dp[0] = []

            for i in range(1, len(text) + 1):
                for j in range(i):
                    if dp[j] is not None and text[j:i] in word_set:
                        dp[i] = dp[j] + [text[j:i]]
                        break

            return dp[-1]

        def detect_format_strings(self, text):
            pattern = r'%(?:\d+\$)?[+\-#0 ]?(?:\d+|\*)?(?:\.(?:\d+|\*))?[hlL]?[diuoxXfFeEgGaAcspn%]'
            matches = re.findall(pattern, text)
            print(matches)
            return matches

        def activate(self, ctx):
            print("Find String")

            addr_bottom = SelectBottom.addr_bottom
            addr_top    = SelectTop.addr_top

            ea = addr_top
            stri = ''
            start_addr = 0x00

            while ea <= addr_bottom:
                c = ida_bytes.get_byte(ea)

                if (c == 0xa or c == 0x9 or c == 0xd or 31 < c < 126):
                    if(stri == ''):
                        # print(f"start 2: {hex(ea)}")
                        start_addr = ea
                    stri = stri + chr(c)
                else:
                    if(c == 0x00):
                        # print(f"[{hex(ea)}]: hex({c}): start: {hex(start_addr)}")
                        if(c == 0x00 and start_addr != 0x00 and len(stri) >= 3):
                            if(len(stri) > 10):
                                self.make_strlit(start_addr, len(stri))
                                print(f"Found: {stri}")
                            elif(self.detect_format_strings(stri)):
                                self.make_strlit(start_addr, len(stri))
                                print(f"Found: {stri}")
                            elif(self.analyze_camel_case(stri)):
                                self.make_strlit(start_addr, len(stri))
                                print(f"Found: {stri}")
                            elif(self.split_words_dp(stri.lower(), self.english_words)):
                                self.make_strlit(start_addr, len(stri))
                                print(f"Found: {stri}")
                            else:
                                text = stri.lower()
                                text = re.sub(r'[@#!,.>=;-_%()/]', ' ', text)
                                text = re.sub(r'[^\w\s]', ' ', text)
                                text = re.sub(r'\s+', ' ', text).strip()
                                text = text.split(' ')
                                filtered_words = [word for word in text if len(word) >= 3]
                                meaningful_count = sum(1 for word in filtered_words if word.lower() in self.english_words)

                                if(meaningful_count >= 1):
                                    self.make_strlit(start_addr, len(stri))
                                    print(f"Found ({meaningful_count}): {filtered_words} {stri}")

                    stri = ''
                ea = ea + 1

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class convertCode(idaapi.action_handler_t):
        mode = 2
        def __init__(self):
            idaapi.action_handler_t.__init__(self)
            self.english_words = set(words.words())

        def activate(self, ctx):
            print ("convertCode")
            addr_bottom = SelectBottom.addr_bottom
            addr_top    = SelectTop.addr_top
            
            func_count = 0
            code_count = 0

            ea = addr_top % self.mode + addr_top

            insn = idaapi.insn_t()

            print ("\nLooking for undefined code starting at: %s:0x%X" % (idc.get_segm_name(ea), ea))
            print ("Test nha")
            print ("Addr TOP    : " + hex(ea))
            print ("Addr Bottom : " + hex(addr_bottom))
            while ea <= addr_bottom:
                try:
                    if(idc.is_code(idc.get_full_flags(ea))):
                        ea = ea + self.mode
                        continue

                    next_ea = idc.get_item_end(ea)
                    print(f'{hex(ea)}')
                    if(idc.is_strlit(idc.get_full_flags(ea))):
                        size = ida_bytes.get_max_strlit_length(ea, ida_nalt.STRTYPE_C)
                        if(size >= 3 and size < 7):
                            text = ida_bytes.get_strlit_contents(ea, 4, ida_nalt.STRTYPE_C)
                            text = text.decode("utf-8")
                            text = text.lower()
                            text = re.sub(r'[@#!,.>=;-_%()/]', ' ', text)
                            text = re.sub(r'[^\w\s]', ' ', text)
                            text = re.sub(r'\s+', ' ', text).strip()
                            text = text.split(' ')
                            filtered_words = [word for word in text if len(word) >= 3]
                            meaningful_count = sum(1 for word in filtered_words if word.lower() in self.english_words)

                            if(meaningful_count < 1):
                                if idaapi.decode_insn(insn, ea) == 4:
                                    ida_bytes.del_items(ea)
                                    idaapi.split_sreg_range(ea, idaapi.str2reg("T"), 1, idaapi.SR_user)

                                ida_bytes.del_items(ea)
                                if idc.create_insn(ea):
                                    code_count += 1
                                    ea = ea + self.mode
                                    continue
                        
                        print(f"[{hex(ea)}]: ")
                        ea = next_ea + 1
                        continue

                    if idc.get_segm_attr(ea, idc.SEGATTR_TYPE) == ida_segment.SEG_CODE:
                        if idc.get_func_name(ea) != '':
                            ea = idc.find_func_end(ea)
                            continue
                    
                    if (ea % self.mode != 0):
                        ea = ea + 1
                        continue
                            
                    if idaapi.decode_insn(insn, ea) == 4:
                        ida_bytes.del_items(ea)
                        idaapi.split_sreg_range(ea, idaapi.str2reg("T"), 1, idaapi.SR_user)
                        

                    ida_bytes.del_items(ea)
                    if idc.create_insn(ea):
                        code_count += 1

                except Exception as e: 
                    ida_bytes.create_data(ea, idc.FF_WORD, self.mode, idc.BADADDR)
                    print(e)

                ea = ea + self.mode
            print ("Created %d new functions and %d new code blocks\n" % (func_count, code_count))

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class convertStructData(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            print ("convertStructData")
            i =  SelectTop.addr_top
            while i <= SelectBottom.addr_bottom:
                ida_bytes.create_dword(i, 16)
                i = i + 16

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class CopyDatatoSeg(idaapi.action_handler_t):
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            print ("CopyDatatoSeg")
            addr_top =  SelectTop.addr_top
            addr_bottom = SelectBottom.addr_bottom
            addr_save_seg = SelectPointSave.addr_save_seg
            ida_kernwin.jumpto(addr_save_seg)
            while  addr_top < addr_bottom:
                ida_bytes.patch_byte(addr_save_seg, ida_bytes.get_byte(addr_top))
                addr_save_seg += 1
                addr_top += 1

            print ("Success")
        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

    class SelectPointSave(idaapi.action_handler_t):
        addr_save_seg = 0
        def __init__(self):
            idaapi.action_handler_t.__init__(self)

        def activate(self, ctx):
            SelectPointSave.addr_save_seg = idc.here()
            print ("Select Point Save Seg: ",  hex(SelectPointSave.addr_save_seg))
            return SelectPointSave.addr_save_seg

        def update(self, ctx):
            return idaapi.AST_ENABLE_ALWAYS

except AttributeError:
    pass

class convertDataCode_t(idaapi.plugin_t, idaapi.UI_Hooks):
    flags = 0
    comment = ""
    help = ""
    wanted_name             = "Convert Data or Code"
    wanted_hotkey           = ""

    select_point_top        = 'selecttop:action'
    select_point_bottom     = 'selectbottom:action'
    convert_data            = 'convertdata:action'
    convert_data_top        = 'convertdatatop:action'
    undefine_data           = 'undefinedata:action'
    convert_code_top        = 'convertcode:action'
    find_string             = 'find_string:action'
    convert_code_thumb_top  = 'convertcodethumb:action'
    convert_struct_data     = 'convertstructdata:action'
    copy_data_to_segment    = 'copydatatoseg:action'
    select_point_save_seg   = 'selectpointsave:action'

    top_hotkey              = 'Ctrl+['
    bottom_hotkey           = 'Ctrl+]'
    convertdata_hotkey      = 'Ctrl+;'
    convertdata_hotkey_top  = 'Ctrl+\''
    undefinedata_hotkey     = 'Ctrl+-'
    convert_code_top_hotkey = 'Ctrl+='
    find_string_top_hotkey = 'Ctrl+s'
    convert_code_top_thumb_hotkey = 'Ctrl+=='
    convert_struct_data_hotkey  = 'Ctrl+\\'
    copy_data_to_segment_hotkey = 'Ctrl+>'
    select_point_save_hotkey    = 'Ctrl+<'

    menu_tab = 'Options/SlConvert/'
    addr_top = 0
    addr_bottom = 0
    def init(self):
        super(convertDataCode_t, self).__init__()
        top_desc = idaapi.action_desc_t(
            self.select_point_top,  # action name uniqure
            'Select Top',           # show text
             SelectTop(),      # function exceute
             self.top_hotkey,
             'Select Top',
             198)

        bottom_desc = idaapi.action_desc_t(
            self.select_point_bottom,
            'Select Bottom',
            SelectBottom(),
            self.bottom_hotkey,
            'Select Bottom',
            198,
            )

        convert_data_desc = idaapi.action_desc_t(
            self.convert_data,
            'Convert Data',
            ConvertData(),
            self.convertdata_hotkey,
            'Convert Data',
            198,
            )

        convert_data_top_desc = idaapi.action_desc_t(
            self.convert_data_top,
            'Convert Data Top',
            ConvertDataTop(),
            self.convertdata_hotkey_top,
            'Convert Data Top',
            198,
            )

        undefine_data_top_desc = idaapi.action_desc_t(
            self.undefine_data,
            'undefine Data',
            undefineData(),
            self.undefinedata_hotkey,
            'undefine Data',
            198,
            )

        convert_code_top_desc = idaapi.action_desc_t(
            self.convert_code_top,
            'convert code',
            convertCode(),
            self.convert_code_top_hotkey,
            'convert code',
            198,
            )

        convert_code_thumb_top_desc = idaapi.action_desc_t(
            self.convert_code_thumb_top,
            'convert code thumb',
            convertCodeThumb(),
            self.convert_code_top_thumb_hotkey,
            'convert code',
            198,
            )

        convert_struct_data_top_desc = idaapi.action_desc_t(
            self.convert_struct_data,
            'convert struct data',
            convertStructData(),
            self.convert_struct_data_hotkey,
            'convert struct data',
            198,
            )

        copy_data_to_seg_desc = idaapi.action_desc_t(
            self.copy_data_to_segment,
            'copy data to seg',
            CopyDatatoSeg(),
            self.copy_data_to_segment_hotkey,
            'copy data to seg',
            198,
            )

        select_point_save_seg_desc = idaapi.action_desc_t(
            self.select_point_save_seg,
            'select point save',
            SelectPointSave(),
            self.select_point_save_hotkey,
            'select point save',
            198,
            )
        
        find_string_top_desc = idaapi.action_desc_t(
            self.find_string,
            'Find String',
            findStrlit(),
            self.find_string_top_hotkey,
            'Find String',
            198,
            )

        idaapi.register_action(top_desc)
        idaapi.register_action(bottom_desc)
        idaapi.register_action(convert_data_desc)
        idaapi.register_action(convert_data_top_desc)
        idaapi.register_action(undefine_data_top_desc)
        idaapi.register_action(convert_code_top_desc)
        idaapi.register_action(find_string_top_desc)
        idaapi.register_action(convert_code_thumb_top_desc)
        idaapi.register_action(convert_struct_data_top_desc)
        idaapi.register_action(copy_data_to_seg_desc)
        idaapi.register_action(select_point_save_seg_desc)

        idaapi.attach_action_to_menu(self.menu_tab, self.select_point_top,    idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.select_point_bottom, idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.convert_data,        idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.convert_data_top,        idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.undefine_data,        idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.convert_code_top,        idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.convert_code_thumb_top,        idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.convert_struct_data,        idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.copy_data_to_segment,        idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.select_point_save_seg,        idaapi.SETMENU_APP)
        idaapi.attach_action_to_menu(self.menu_tab, self.find_string,        idaapi.SETMENU_APP)

        return idaapi.PLUGIN_KEEP

    def term(self):
        idaapi.detach_action_from_menu(self.menu_tab, self.select_point_top)
        idaapi.detach_action_from_menu(self.menu_tab, self.select_point_bottom)
        idaapi.detach_action_from_menu(self.menu_tab, self.convert_data)
        idaapi.detach_action_from_menu(self.menu_tab, self.convert_data_top)
        idaapi.detach_action_from_menu(self.menu_tab, self.undefine_data)
        idaapi.detach_action_from_menu(self.menu_tab, self.convert_code_top)
        idaapi.detach_action_from_menu(self.menu_tab, self.convert_code_thumb_top)
        idaapi.detach_action_from_menu(self.menu_tab, self.find_string)
        idaapi.detach_action_from_menu(self.menu_tab, self.convert_struct_data)
        idaapi.detach_action_from_menu(self.menu_tab, self.copy_data_to_segment)
        idaapi.detach_action_from_menu(self.menu_tab, self.select_point_save_seg)
        
        return None

    def run(self, arg):
        pass


def PLUGIN_ENTRY():
    return convertDataCode_t()