def loadPlugins(self): """ Load\Reload all plugins found in the plugin location. """ self.logger.info("Loading Plugins from %s", self.pluginLocation) self.pManager.collectPlugins() all_plugins = self.pManager.getAllPlugins() if len(all_plugins) == 0: idaapi.msg("Warning - No Plugins were loaded!\n") self.logger.error("No plugins were loaded") for pluginInfo in all_plugins: # TODO: Validate plugins! self.logger.info("Loading plugin %s", pluginInfo.name) if pluginInfo.name == "headers": # headers is an illegal plugin name (see get_parser_list) continue # Set a type name normalizing function pluginInfo.plugin_object.initPlugin(self.typeName_norm) self.pManager.activatePluginByName(pluginInfo.name) # Add type to type_parser dict for quick lookups suported_types = pluginInfo.plugin_object.getSupportedTypes() if suported_types is not None: self.addTypeParser(suported_types, pluginInfo.plugin_object)
def show_current_function_meaningful(): try: function = sark.Function(idc.here()) show_meaningful_in_function(function) except sark.exceptions.SarkNoFunction: idaapi.msg("[FunctionStrings] No function at 0x{:08X}.\n".format(idc.here()))
def highlight_item_row(self, item): """ highlight the entire row containing a table item @param item: table item """ try: if not item.index().isValid(): return parent = item.parent() if parent is None: parent = item if not parent.hasChildren(): self.highlight_item(parent) return row = item.row() column_num = parent.columnCount() for column in xrange(0, column_num): if self.valueModel.hasIndex(row, column, parent.index()): cur_index = self.valueModel.index(row, column, parent.index()) self.highlight_item(self.valueModel.itemFromIndex(cur_index)) persistent_index = QtCore.QPersistentModelIndex(cur_index) self.highligthed_items.append(persistent_index) except Exception as ex: idaapi.msg("Error while highlighting item row: %s\n" % ex)
def qsjump_to(self, qs_ea): try: self.qira.jump_to(qs_ea) except AttributeError: idaapi.msg( "[%s] qsjump_to : Addr is not valid (%s)\n" % (self.qira.wanted_name, qs_ea,))
def qs_send_msg(self, qs_msg): try: self.qira.ws_send(qs_msg) except AttributeError: idaapi.msg( "[%s] qs_send_msg : Cannot send message (%s)\n" % (self.qira.wanted_name, qs_msg,))
def run(self, arg): common_value = get_common_value() enum_name = idc.AskStr(self._last_enum, "Enum Name") if enum_name is None: return if not enum_name: enum_name = None self._last_enum = enum_name # Can't ask with negative numbers. if common_value >> ((8 * sark.core.get_native_size()) - 1): common_value = 0 const_value = idc.AskLong(common_value, "Const Value") if const_value is None: return modify = True try: enum = sark.add_enum(enum_name) except sark.exceptions.EnumAlreadyExists: enum = sark.Enum(enum_name) yes_no_cancel = idc.AskYN(idaapi.ASKBTN_NO, "Enum already exists. Modify?\n") if yes_no_cancel == idaapi.ASKBTN_CANCEL: return elif yes_no_cancel == idaapi.ASKBTN_YES: modify = True else: # yes_no_cancel == idaapi.ASKBTN_NO: modify = False member_name = const_name(enum, const_value) if modify: try: enum.members.add(member_name, const_value) except sark.exceptions.SarkErrorAddEnumMemeberFailed as ex: idaapi.msg("[AutoEnum] Adding enum member failed: {}.".format(ex.message)) else: for member in enum.members: if member.value == const_value: member_name = member.name break else: return # Apply the enum apply_enum_by_name(enum, member_name)
def term(self): idaapi.msg("[%s] Terminating tasks...\n" % (self.wanted_name,)) try: self.stop() except AttributeError: pass idaapi.msg("[%s] Uninstalled!\n" % (self.wanted_name,))
def find_context_list(self, context_list): """ Find and highlight a list of function contexts @param context_list: list of function contexts (of type dbFunction_Context) """ try: self.clear_highlights() root_index = self.functionModel.index(0, 0) if not root_index.isValid(): return for func_context in context_list: context_id = id(func_context) matched_items = self.functionModel.match(root_index, DIE.UI.ContextId_Role, context_id, -1, QtCore.Qt.MatchFlag.MatchRecursive|QtCore.Qt.MatchFlag.MatchExactly) for index in matched_items: if not index.isValid(): continue # Do not highlight "ea root" items, only occurrences of it. if not index.data().startswith("Occur"): continue item = self.functionModel.itemFromIndex(index) self.functionTreeView.expand(index) self.functionTreeView.scrollTo(index, QtGui.QAbstractItemView.ScrollHint.PositionAtTop) self.highlight_item_row(item) return True except Exception as ex: idaapi.msg("Error while looking up function context in FunctionView: %s\n" % ex) return False
def ws_send(self, msg): if self.wsserver is not None: self.start() if msg is not None: if msg == 'connected': for conn in list(CLIENTS): conn.sendMessage(msg) time.sleep(1) CLIENTS.append(self) elif msg == 'closed': CLIENTS.remove(self) for conn in list(CLIENTS): conn.sendMessage(msg) time.sleep(1) else: # print "Tuple: %s" % (self.wsserver.connections.items(),) # This one still have errors in both items()/CLIENTS for conn in list(self.wsserver.connections.items()): if conn != self: # debugging if DEBUG: idaapi.msg("[%s] ws_send : %s\n" % (self.wanted_name, msg,)) conn.sendMessage(msg) time.sleep(0.1) else: idaapi.msg("[%s] ws_send : Cannot send null\n" % (self.comment,))
def _insert_thread_data(self, item, thread_id): """ Insert thread_id data into a model item. The value found in thread_id argument will be delimited by the _make_thread_id_data function (e.g: thread_id 123 will become 't123t') the delimited value will then be appended to a string of concatenated (unique) child-item thread-ids (for example a item data value can be "a123aa5672aa11112a") for threads 123, 5672 and 111112 @param item: the model item to add the data to @param thread_id: thread_id number @return: True if thread data was successfully added to item, otherwise False """ try: current_thread_id = self._make_thread_id_data(thread_id) thread_data = item.data(role=DIE.UI.ThreadId_Role) if thread_data is None: item.setData(current_thread_id, role=DIE.UI.ThreadId_Role) elif not current_thread_id in thread_data: item.setData(thread_data + current_thread_id, role=DIE.UI.ThreadId_Role) return True except Exception as ex: idaapi.msg("Error while inserting thread data: %s\n" %ex) return False
def __init__(self, is_dbg_log=False, is_dbg_pause=False, is_dbg_profile=False): ### Logging ### log_filename = os.path.join(os.getcwd(), "DIE.log") self._menu = sark.qt.MenuManager() #TODO: Fix logging to include rotating_file_handler \ console_logging if is_dbg_log: logging.basicConfig(filename=log_filename, level=logging.DEBUG, format='[%(asctime)s] [%(levelname)s] [%(name)s][%(filename)s:%(lineno)s] : %(message)s') else: logging.basicConfig(filename=log_filename, level=logging.INFO, format='[%(asctime)s] [%(levelname)s] [%(name)s][%(filename)s:%(lineno)s] : %(message)s') idaapi.msg("Logfile created at %s\n" % log_filename) self.logger = logging.getLogger(__name__) ### DIE Configuration ### self.config_file_name = os.path.join(os.getcwd(), "DIE.cfg") DIE.Lib.DieConfig.initialize() config = DIE.Lib.DieConfig.get_config() try: config.load(self.config_file_name) except IOError: pass except: import traceback idaapi.msg(traceback.format_exc()) self.die_config = config self.addmenu_item_ctxs = [] self.icon_list = {} self.debugAPI = DebugAPI.DebugHooker(is_dbg_pause, is_dbg_profile) DIE.Lib.DIEDb.initialize_db() self.die_db = DIE.Lib.DIEDb.get_db() self.is_marked = False DIE.UI.FunctionViewEx.initialize() DIE.UI.ValueViewEx.initialize() DIE.UI.BPView.initialize() DIE.UI.ParserView.initialize() DIE.UI.Die_Icons.initlialize() self.function_view = DIE.UI.FunctionViewEx.get_view() self.value_view = DIE.UI.ValueViewEx.get_view() self.bp_view = DIE.UI.BPView.get_view() self.parser_view = DIE.UI.ParserView.get_view() self.load_icons() return
def init(self): self.old_addr = None self.addr = None threading.Thread(target=start_server).start() idaapi.msg("[QIRA Plugin] Ready to go!\n") return idaapi.PLUGIN_KEEP
def activate(self, ctx): try: self._activate(ctx) return 1 except: trace = traceback.format_exc() idaapi.msg("Action {!r} failed to activate. Traceback:\n{}".format(self.get_name(), trace)) return 0
def _activate(self, ctx): clear_func(ctx.cur_ea) mark_exit_nodes(ctx.cur_ea) idaapi.msg("\n" * 2) for block in iter_exit_nodes(ctx.cur_ea): idaapi.msg("Exit at 0x{:08X}\n".format(block.startEA))
def update_address(self, addr_type, addr): if (addr_type is not None) and (addr is not None): self.cmd = "set%s 0x%x" % (addr_type, addr) self.ws_send(self.cmd) else: idaapi.msg( "[%s] Cannot update address: 'None'\n" % (self.wanted_name,))
def term(self): idaapi.msg("Terminating %s\n" % self.wanted_name) try: self.stop() except: pass for ctx in self.ctxs: idaapi.del_menu_item(ctx)
def stop(self, *args): global insref_g idaapi.msg("Stopping IdaRef\n") if(insref_g != None): insref_g.destroy() insref_g = None else: print "IdaRef is not running"
def _add_menu(self, *args): ctx = idaapi.add_menu_item(*args) if ctx is None: idaapi.msg("Add failed!\n") return False else: self.ctxs.append(ctx) return True
def mark_exists(): ea = idaapi.get_screen_ea() clear_func(ea) mark_exit_nodes(ea) idaapi.msg("\n" * 2) for block in iter_exit_nodes(ea): idaapi.msg("Exit at 0x{:08X}\n".format(block.startEA))
def handleMessage(self): #idaapi.msg("[QIRA Plugin] Received from QIRA web: %s\n" % (self.data,)) dat = self.data.split(" ") if dat[0] == "setaddress" and dat[1] != "undefined": try: a = idaapi.toEA(0, int(str(dat[1][2:]),16)) jump_to(a) except e: idaapi.msg("[QIRA Plugin] Error processing the address\n")
def ws_server(self, port): if port is None: port = self.port host = '' self.wsserver = SimpleWebSocketServer(host, port, QiraServer, selectInterval=0.1) if self.wsserver is not None: idaapi.msg("[%s] Starting WS Server\n" % (self.comment,)) self.wsserver.serveforever() else: idaapi.msg("[%s] Cannot Start WS Server\n" % (self.comment,))
def s_send(msg): #idaapi.msg("[i2q Plugin] s_send start\n") try: s = socket.socket() host = "127.0.0.1" port = 3001 s.connect((host, port)) except Exception, e: idaapi.msg("[i2q Plugin] conn failed : %s\n" % e)
def OneProfMakeFuncs(self): fname = idc.AskFile(0, '*.*', 'Select profile file, plz') prof = open(fname, 'rb') binprofile = prof.read().split('\n\n') binprof = self.kern.analyze_callgr_profile(binprofile) idaapi.msg("Tryind add funcs...\n") num = self.kern.make_funcs_from_prof(binprof) idc.Warning("%d funcs was added" % num) return True
def start(self, *args): global insref_g idaapi.msg("Starting IdaRef\n") if(insref_g != None and idaapi.find_tform(insref_g.title) == None): self.stop() if(insref_g == None): insref_g = InstructionReference(self) else: print "IdaRef Already started"
def __init__(self, icons_path="icons"): self.die_config = DieConfig.get_config() self.icons_path = self.die_config.icons_path if not os.path.exists(self.icons_path): idaapi.msg("Error: could not locate DIE icons directory.\n") return self._load_icons()
def init(self): global initialized ret = idaapi.PLUGIN_SKIP if initialized == False: initialized = True self.ctxs = [] insref_g = None ret = self._add_menus() idaapi.msg("IdaRef initialized\n") return ret
def show_highlighted_function_strings(): identifier = idaapi.get_highlighted_identifier() if not identifier: return try: function = sark.Function(name=identifier) show_function_strings(function) except sark.exceptions.SarkNoFunction: idaapi.msg("[FunctionStrings] {!r} is not a function.\n".format(identifier))
def send_names(self): qira_names = idaapi.get_nlist_size() for i in range(0, qira_names): self.cmd = "setname 0x%x %s" % ( idaapi.get_nlist_ea(i), idaapi.get_nlist_name(i)) # debugging if DEBUG: idaapi.msg( "[%s] send_names: EA [0x%x], Name [%s]\n" % (self.wanted_name, idaapi.get_nlist_ea(i), idaapi.get_nlist_name(i),)) self.ws_send(self.cmd)
def _get_handler(self, node_id): """Get the handler of a given node.""" handler = self._get_attrs(node_id).get(self.HANDLER, self._default_handler) # Here we make sure the handler is an instance of `BasicNodeHandler` or inherited # types. While generally being bad Python practice, we still need it here as an # invalid handler can cause IDA to crash. if not isinstance(handler, BasicNodeHandler): idaapi.msg(("Invalid handler for node {}: {}. All handlers must inherit from" "`BasicNodeHandler`.").format(node_id, handler)) handler = self._default_handler return handler
def init(self): try: self._install_plugin() idaapi.msg("RECLASSIFY load complete.\n") # failed to initialize or integrate the plugin, log and skip loading except Exception as e: form = idaapi.get_current_tform() print e return idaapi.PLUGIN_KEEP
def main(): idaapi.msg("Loading IDASEC\n") global IDASEC try: IDASEC IDASEC.OnClose(IDASEC) idaapi.msg("reloading IDASec\n") IDASEC = IDASecForm() return except Exception: IDASEC = IDASecForm() IDASEC.Show("Idasec")
def handle_message_queue(): global msg_queue while len(msg_queue) > 0: dat = msg_queue[0].split(" ") msg_queue = msg_queue[1:] if dat[0] == "setaddress" and dat[1] != "undefined": try: a = idaapi.toEA(0, int(str(dat[1][2:]),16)) jump_to(a) except e: idaapi.msg("[QIRA Plugin] Error processing the address\n")
def init(self): idaapi.msg("Sunrace init [ . ]\n") self.menus = list() self.kern = Kernel() self.ColorFuncsView = None self.is_reanalyse = False self.is_singleprofile = False self.is_twoprofile = False self.singlname = '' self.fname = '' self.sname = '' return idaapi.PLUGIN_KEEP
def init(self): """ 初始化方法 """ idaapi.msg(">>> jack sparrow util plugin starts. {0}\n".format( datetime.now())) # 导入python目录下的功能模块 idaapi.require("util") idaapi.require("util.plugin_util_impl") return idaapi.PLUGIN_OK # return PLUGIN_KEEP
def init(self): self.vds5_hooks = None if not ida_hexrays.init_hexrays_plugin(): idaapi.msg("hexrays-graph: hexrays is not available.") return idaapi.PLUGIN_SKIP ida_kernwin.register_action( ida_kernwin.action_desc_t(ACTION_NAME, "Hex-Rays show C graph (IDAPython)", display_graph_ah_t(), ACTION_SHORTCUT)) self.vds5_hooks = vds5_hooks_t() self.vds5_hooks.hook() return idaapi.PLUGIN_KEEP
def term(self): """ This is called by IDA when it is unloading the plugin. """ # unhook our plugin hooks self._hooks.unhook() # unregister our actions & free their resources self._del_action_google_search() # done idaapi.msg("%s terminated...\n" % self.wanted_name)
def run(self, arg): try: idaapi.msg("StackStrings run() called with %d!\n" % arg) if is_py2: flare.stackstrings.main() idaapi.msg("StackStrings run() done") else: idaapi.msg("WARNING: stackstrings only works under python2 due to vivisect dependency\n") except Exception as err: idaapi.msg("Exception during run: %s\n" % str(err)) raise idaapi.msg("StackStrings run() complete!\n")
def initPlugin(self, type_norm_callback=None): """ Plguin Initialization @param type_norm_callback: a type name normalization callback function """ idaapi.msg("Initializing plugin %s\n" % self.__class__) # Set type name normalization callback function if type_norm_callback is not None: self.typeName_norm_cb = type_norm_callback # Register supported types self.registerSupportedTypes()
def s_send(msg): idaapi.msg("[q2i]s_send start\n") s = socket.socket() #host = socket.gethostname() host = "127.0.0.1" port = 3001 s.connect((host, port)) #idaapi.msg("[q2i Plugin]send msg : " + msg + "\n") s.send(msg) result = s.recv(1024) #idaapi.msg("[q2i Plugin]recv msg " + result + "\n" ) parse_msg(result) s.close
def move_segm(frm, to, sz, fileformatname): idaapi.msg("move_segm(from=%s, to=%s, sz=%d, formatname=%s" % (hex(frm), hex(to), sz, fileformatname)) gNode = idaapi.netnode() gNode.create(NETNODE_NAME) dBlob = gNode.getblob(0, 'D') dwords = [ struct.unpack_from("<l", dBlob, x) for x in xrange(0, len(dBlob), 4) ] do_relocs(dwords, frm, to) return 1
def init(self): """ This is called by IDA when it is loading the plugin. """ # initialize the menu actions our plugin will inject self._init_action_google_search() # initialize plugin hooks self._init_hooks() idaapi.msg("%s %s initialized...\n" % (self.wanted_name, VERSION)) return idaapi.PLUGIN_KEEP
def highlight_item(self, item): """ Highlight a single item @param item: module item """ try: item.setBackground(QtGui.QColor('yellow')) cur_font = item.font() cur_font.setBold(True) item.setFont(cur_font) except Exception as ex: idaapi.msg("Error while highlighting item: %s\n" % ex)
def init(self): idaapi.msg('[%s] init. press CTRL+ALT+S in a function.' % (self.plg_name)) act_desc = idaapi.action_desc_t(self.act_name, self.plg_name, STLCommentHandler(), None, self.act_tooltip) idaapi.register_action(act_desc) idaapi.attach_action_to_menu(self.menu_category, self.act_name, idaapi.SETMENU_APP) return self.flags
def term(self): if not hasattr(self, '_hooks'): return # unhook our plugin hooks self._hooks.unhook() # unregister our actions & free their resources self._del_action_bulk() self._del_action_copy() # done idaapi.msg("%s terminated...\n" % self.wanted_name)
def OnSelectLine(self, n): self.selcount += 1 func_addr = int(self.items[n][0], 16) func_name = self.items[n][1] t_addrs = self.function_to_addrs[func_addr] idaapi.msg("%d tainted instructions in %s\n" % \ (len(t_addrs), func_name)) for tainted_addr in t_addrs: idaapi.set_item_color(tainted_addr, TAINTED) idaapi.jumpto(func_addr)
def run(self, arg): idaapi.msg("[i2q Plugin] Syncing ...\n") self.addr = idaapi.get_screen_ea() if (self.old_addr != self.addr): if (idaapi.isCode(idaapi.getFlags(self.addr))): #idaapi.msg("[i2q Plugin] update instrunction address\n") update_address("iaddr", self.addr) else: # Data Address #idaapi.msg("[i2q Plugin] update data address\n") update_address("daddr", self.addr) self.old_addr = self.addr
def prepare_debug_ui(self): wd = WaitDialog() idaapi.msg("[%s] waiting...\n" % (PLUGNAME)) wd.thread.start() wd.exec_() target_pid = wd.get_target_pid() if target_pid != -1: ida_dbg.attach_process(target_pid, -1) idc.GetDebuggerEvent(idc.WFNE_SUSP, -1) ida_dbg.continue_process() else: idaapi.msg("[%s] exit waiting\n" % (PLUGNAME))
def main(): idaapi.msg("Loading AFL_Node_Extract\n") global g_num_edge global g_dict_func_edge global g_off_set_random global g_size_ins_block global g_off_random dict_func_edge = {} if idc.__EA64__: # 64bit g_off_set_random = 0x16 g_size_ins_block = 0x38 g_off_random = 3 else: # 32bit g_off_set_random = 3 g_size_ins_block = 0x10 g_off_random = 1 #func = 0x80E3440 #print('%d %d') % (func, idc.GetFunctionAttr(func, idc.FUNCATTR_END)) #HandleFunc(func) #for func in idautils.Functions(): # g_num_edge = 0 # HandleFunc(func) # dict_func_edge[func] = g_num_edge g_dict_func_edge = dict_func_edge for func in idautils.Functions(): if IsSanFunc(func): continue print('%d %s') % (func, idc.GetFunctionName(func)) HandleFunc(func) try: #for func in idautils.Functions(): # Find__afl_maybe_log(func, idc.GetFunctionAttr(func, idc.FUNCATTR_END)) #print hex(func), idc.GetFunctionName(func) #func = 0x804F2A0 #print('%d %d') % (func, idc.GetFunctionAttr(func, idc.FUNCATTR_END)) #HandleFunc(func) pass except Exception: pass g_f.write('analyse time: ' + str(time.time() - g_time_start) + 's\n') g_f.close() print('analyse time: ' + str(time.time() - g_time_start) + 's\n')
def run(self): '''Start the plugin.''' if not idaapi.init_hexrays_plugin(): print "HRDEV Error: Failed to initialise Hex-Rays plugin." return function_name = idaapi.get_func_name(idaapi.get_screen_ea()) demangled_name = self.tools.demangle_name(function_name) src = idaapi.decompile(idaapi.get_screen_ea()) file_name = '{}.cpp'.format(self.tools.to_file_name(demangled_name)) cache_path = os.path.sep.join( [tempfile.gettempdir(), 'hrdev_cache', self._bin_name]) # Create required directories if they dont exist tmp_dir_path = os.path.sep.join([tempfile.gettempdir(), 'hrdev_cache']) if not os.path.isdir(tmp_dir_path): os.mkdir(tmp_dir_path) if not os.path.isdir(cache_path): os.mkdir(cache_path) complete_path = os.path.sep.join([cache_path, file_name]) idaapi.msg("HRDEV cache path: {}\n".format(complete_path)) # Check if file is already in cache if not os.path.isfile(complete_path) or \ self.config_main.getboolean('etc', 'disable_cache'): self.tools.save_file(complete_path, str(src)) self.tools.set_file_path(complete_path) lvars = {} for v in src.lvars: _type = idaapi.print_tinfo('', 0, 0, idaapi.PRTYPE_1LINE, v.tif, '', '') lvars[str(v.name)] = "{} {} {}".\ format(_type, str(v.name), str(v.cmt)) max_title = self.config_main.getint('etc', 'max_title') self.gui = hrdev_plugin.include.gui.Canvas(self.config_main, self.config_theme, self.tools, lvars, demangled_name[:max_title]) self.gui.Show('HRDEV') self.parser = hrdev_plugin.include.syntax.Parser(self, lvars) self.parser.run(complete_path) return
def dbg_bpt(self, tid, ea): """ 'Hit Debug Breakpoint' Callback - this callback gets called once a breakpoint has been reached - this means we can either be in a CALL or a RET instruction. """ try: # If final breakpoint has been reached. skip all further breakpoints. if self.end_bp is not None and ea == self.end_bp: self.logger.info("Final breakpoint reached at %s. context logging is stopped.", hex(ea)) self.bp_handler.unsetBPs() request_continue_process() run_requests() return 0 # If required, update IAT if self.update_imports: self.update_iat() # Set current call-stack if tid not in self.callStack: idaapi.msg("Creating new callstack for thread %d\n" % tid) self.callStack[tid] = CallStack() self.current_callstack = self.callStack[tid] # Did we just return from a function call? if self.bp_handler.isRetBP(ea): try: self.current_callstack.pop() except DieCallStackPopError: self.logger.exception("Error while popping function from callstack") self.bp_handler.removeRetBP(ea) if not is_call(ea): request_continue_process() run_requests() # Is this a CALL instruction? if is_call(ea): self.prev_bp_ea = ea # Set prev ea self.bp_handler.addRetBP(ea) if not self.is_dbg_pause: request_step_into() # Great, step into the called function run_requests() # Execute dbg_step_into callback. return 0 except Exception as ex: self.logger.exception("Failed while handling breakpoint at %s:", ea, ex) return 1
def do_dll_imports(dll, iatCurr, hashes): idaapi.msg("%lx: processing import hashes for dll %s\n" % (iatCurr, dll)) hash2name = HashExportNames(dll) for h in hashes: if h in hash2name: idaapi.create_dword(iatCurr, 4) idaapi.set_name( iatCurr, hash2name[h], idaapi.SN_NOWARN | idaapi.SN_NOLIST | idaapi.SN_NOCHECK) else: idaapi.msg( "%lx: hash value %lx for dll %s could not be found\n" % iatCurr, h, dll) iatCurr += 4
def startServer(self): if self.server != None: idaapi.msg(">>> There is a running server\n") return i = 0 while True: try: server = TCPServer(("", RI_BASE_PORT + i), MainTCPHandler) self.server = threading.Thread(target=server.serve_forever) self.server.start() break except socket.error: i += 1 idaapi.msg(">>> Start server at port " + str(RI_BASE_PORT + i) + '\n')
def run(self, arg): idaapi.msg("ESigPlugin run") e_main_ea = get_E_main() if e_main_ea != 0: e_sig = E_Sigs(e_main_ea) e_sig.set_E_main_name() e_sig.load_flirt_sigs() e_sig.handle_dll_calls() idaapi.jumpto(e_main_ea) print("e sig finish") else: idaapi.msg( "Can not find E language main function, the file may not be compiled by E compiler." )
def run(self, arg): idaapi.msg("[QIRA Plugin] Syncing with Qira\n") self.addr = idaapi.get_screen_ea() if (self.old_addr != self.addr): if (idaapi.isCode(idaapi.getFlags(self.addr))): # don't update the address if it's already the qira address if (self.addr != qira_address): # Instruction Address set_qira_address(self.addr) update_address("iaddr", self.addr) else: # Data Address update_address("daddr", self.addr) self.old_addr = self.addr
def show_local_xrefs(arg=None): delim = '-' * 86 + '\n' header = '\nXrefs to %s from %s:\n' global localxrefs fmt = '' r = LocalXrefs() localxrefs = r offsets = r.xrefs.keys() offsets.sort() if r.highlighted: idaapi.msg(header % (r.highlighted, r.function)) idaapi.msg(delim) for ea in offsets: info = r.xrefs[ea] if not fmt: fmt = "%%s %%s %%-%ds %%s\n" % (len(info['offset']) + 15) idaapi.msg(fmt % (info['direction'], info['type'], info['offset'], info['text'])) idaapi.msg(delim)
def run(self, arg): global localxrefs fmt = '' r = LocalXrefs() localxrefs = r offsets = r.xrefs.keys() offsets.sort() if r.highlighted: idaapi.msg(self.HEADER % (r.highlighted, r.function)) idaapi.msg(self.DELIM) for ea in offsets: info = r.xrefs[ea] if not fmt: fmt = "%%s %%s 0x%%08X %%-%ds %%s\n" % ( len(info['offset']) + 15) idaapi.msg(fmt % (info['direction'], info['type'], info['ea'], info['offset'], info['text'])) idaapi.msg(self.DELIM)
def run(self, arg): try: for ea in idautils.Heads(): #print(idc.print_operand(ea, 0)) mnem = idc.print_insn_mnem(ea) # color call instructions if mnem == 'call': idaapi.set_item_color(ea, self.COLOR_CALL) continue # color lea instructions if mnem == 'lea': idaapi.set_item_color(ea, self.COLOR_POINTER) continue # color suspected crypto instructions # xor that does not zero out the register if mnem == 'xor' and (idc.print_operand(ea, 0) != idc.print_operand(ea, 1)): idaapi.set_item_color(ea, self.COLOR_CRYPTO) continue # common RC4 instructions if mnem == 'cmp' and idc.get_operand_type( ea, 0) == ida_ua.o_reg and idc.print_operand( ea, 1) == '0x100': idaapi.set_item_color(ea, self.COLOR_CRYPTO) continue # misc math operations mathInstrList = [ 'sar', 'sal', 'shr', 'shl', 'ror', 'rol', 'idiv', 'div', 'imul', 'mul', 'not' ] if mnem in mathInstrList: idaapi.set_item_color(ea, self.COLOR_CRYPTO) continue # color string operations # skip instructions that start with 'c' to exclude conditional moves, e.g. cmovs if (mnem.startswith('c') == False) and (mnem.endswith('x') == False) and \ (('scas' in mnem) or ('movs' in mnem) or ('stos' in mnem)): idaapi.set_item_color(ea, self.COLOR_STRING_OPERATION) continue except Exception as err: idaapi.msg("Exception during run: %s\n" % str(err)) raise
def init(self): # just go when we have hexrays if not idaapi.init_hexrays_plugin(): return idaapi.PLUGIN_SKIP # initialize the menu actions our plugin will inject self._init_action_bulk() self._init_action_copy() # initialize plugin hooks self._init_hooks() # done idaapi.msg("%s %s initialized...\n" % (self.wanted_name, VERSION)) return idaapi.PLUGIN_KEEP
def init(self): try: # For Debugging: #self.die_manager = DieManager(is_dbg_log=True, is_dbg_pause=False, is_dbg_profile=True) self.die_manager = DieManager() self.die_manager.add_menu_items() self.die_manager.show_logo() return idaapi.PLUGIN_KEEP except Exception as ex: idaapi.msg("Failed to initialize DIE. {}\n".format(ex)) self.die_manager.del_menu_items() del self.die_manager idaapi.msg("Errors and fun!\n") return idaapi.PLUGIN_SKIP