def reload_all_modules():
manager_info_path = os.path.join(os.path.dirname(os.path.abspath(__file__)), MANAGER_INFO_FILENAME)
with open(manager_info_path, "r") as f:
manager_info = json.load(f)
for module_name in manager_info["module_list"]:
idaapi.require(module_name)
def run(self, arg):
idaapi.require('view')
idaapi.require('view.main_view')
main_window = view.main_view.MainView()
if self.windows is None or not self.windows.isVisible():
self.windows = QtWidgets.QMainWindow()
main_window.setupUi(self.windows)
self.windows.showNormal()
pass
def __init__(self, token):
idaapi.require('saramIDAHelpers')
idaapi.require('saramIDAHelpers.saram_py2_scaffold')
self._saram_conf = saramIDAHelpers.saram_py2_scaffold.saram_conf
self._send = saramIDAHelpers.saram_py2_scaffold.saram_py2_new_section
self.token = token
self.command = None
self.output = None
self._comment = None
def run(self, arg):
try:
idaapi.msg("StackStrings run() called with %d!\n" % arg)
idaapi.require('flare')
idaapi.require('flare.stackstrings')
flare.stackstrings.main()
idaapi.msg("StackStrings run() done")
except Exception, err:
idaapi.msg("Exception during run: %s\n" % str(err))
raise
def run(self, arg):
try:
idaapi.msg("StackStrings run() called with %d!\n" % arg)
idaapi.require('flare')
idaapi.require('flare.stackstrings')
flare.stackstrings.main()
idaapi.msg("StackStrings run() done")
except Exception, err:
idaapi.msg("Exception during run: %s\n" % str(err))
raise
def init(self):
"""
初始化方法
"""
idaapi.msg(">>> jack sparrow util plugin starts. {0}\n".format(
datetime.now()))
# 导入python目录下的功能模块
idaapi.require("util")
idaapi.require("util.plugin_util_impl")
return idaapi.PLUGIN_OK # return PLUGIN_KEEP
def run(self, arg):
import traceback
try:
idaapi.msg('devirtualize_plugin:starting\n')
idaapi.require('devirtualize')
idaapi.require('devirtualize.type')
idaapi.require('devirtualize.view')
idaapi.require('devirtualize.graph')
devirtualize.type.build_types()
devirtualize.view.register_vptr_translator()
devirtualize.graph.register_actions()
idaapi.msg('devirtualize_plugin:finished\n')
except:
idaapi.msg(traceback.format_exc())
def init(self):
idaapi.msg("apply_callee_type_plugin:init\n")
idaapi.require("flare")
idaapi.require("flare.apply_callee_type")
idaapi.require("flare.jayutils")
# hack -> stashing a flag under idaapi to prevent multiple menu items from appearing
if hasattr(sys.modules["idaapi"], "_apply_callee_type_plugin_installFlag"):
# print 'Skipping menu install: already present'
pass
else:
self.ex_addmenu_item_ctx = idaapi.add_menu_item(
"Edit/Operand type/Manual", "ApplyCalleeType", "Alt-J", 0, doApplyCallee, tuple("hello world")
)
if self.ex_addmenu_item_ctx is None:
print "Failed to init apply_callee_type_plugin"
setattr(sys.modules["idaapi"], "_apply_callee_type_plugin_installFlag", True)
return idaapi.PLUGIN_OK
def init(self):
idaapi.msg('apply_callee_type_plugin:init\n')
idaapi.require('flare')
idaapi.require('flare.apply_callee_type')
idaapi.require('flare.jayutils')
#hack -> stashing a flag under idaapi to prevent multiple menu items from appearing
if hasattr(sys.modules['idaapi'], '_apply_callee_type_plugin_installFlag'):
#print 'Skipping menu install: already present'
pass
else:
self.ex_addmenu_item_ctx = idaapi.add_menu_item(
"Edit/Operand type/Manual",
"ApplyCalleeType",
"Alt-J",
0,
doApplyCallee,
tuple("hello world")
)
if self.ex_addmenu_item_ctx is None:
print 'Failed to init apply_callee_type_plugin'
setattr(sys.modules['idaapi'], '_apply_callee_type_plugin_installFlag', True)
return idaapi.PLUGIN_OK
def require_package():
idaapi.require('FixTools')
idaapi.require('FixTools.fixTools')
idaapi.require('FixTools.Terminal')
# implied. See the License for the specific language governing
# permissions and limitations under the License.
########################################################################
#
# IDA Plugin wrapper for stack strings search
#
########################################################################
import logging
import idc
import idautils
import idaapi
idaapi.require('flare')
idaapi.require('flare.stackstrings')
PLUGIN_COMMENT = "This is a comment"
PLUGIN_HELP = "This is help"
PLUGIN_NAME = "StackStrings"
PLUGIN_WANTED_HOTKEY = "Alt-0"
# get the IDA version number
ida_major, ida_minor = map(int, idaapi.get_kernel_version().split("."))
using_ida7api = (ida_major > 6)
ex_addmenu_item_ctx = None
class stackstrings_plugin_t(idaapi.plugin_t):
flags = idaapi.PLUGIN_KEEP
try:
from PySide import QtCore, QtGui
except:
from PyQt5 import QtCore, QtWidgets
import idaapi
import idc
import tempfile
try:
import hrdev_plugin.include.syntax
import hrdev_plugin.include.gui
import hrdev_plugin.include.helper
idaapi.require('hrdev_plugin.include.syntax')
idaapi.require('hrdev_plugin.include.gui')
idaapi.require('hrdev_plugin.include.helper')
except Exception, e:
print e
class Plugin(object):
'''Implements the main plugin class, entry point.'''
def __init__(self):
super(Plugin, self).__init__()
self.tools = hrdev_plugin.include.helper.Tools(self)
self.config_main = ConfigParser.ConfigParser()
self.config_theme = ConfigParser.ConfigParser()
import idc
import idautils
import idaapi
idaapi.require("AddBP")
idaapi.require("vtableAddress")
def get_all_functions():
for func in idautils.Functions():
print hex(func), idc.GetFunctionName(func)
def get_xref_code_to_func(func_addr):
a = idautils.XrefsTo(func_addr, 1)
addr = {}
for xref in a:
frm = xref.frm # ea in func
start = idc.GetFunctionAttr(frm,
idc.FUNCATTR_START) # to_xref func addr
func_name = idc.GetFunctionName(start) # to_xref func name
addr[func_name] = [xref.iscode, start]
return addr
def add_bp_to_virtual_calls(cur_addr, end):
while cur_addr < end:
if cur_addr == idc.BADADDR:
break
elif idc.GetMnem(cur_addr) == 'call':
if True in [
# Copyright (C) 2020 Alibaba Group Holding Limited
import idaapi
from idaapi import *
from idc import *
from HelperUtils import *
idaapi.require("HelperUtils")
# Stunned panda face icon data.
icon_data = "".join([
"\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x00\x00\x00\x10\x00\x00\x00\x10\x08\x06\x00\x00\x00\x1F\xF3\xFF\x61\x00\x00\x02\xCA\x49\x44\x41\x54\x78\x5E\x65",
"\x53\x6D\x48\x53\x6F\x14\x3F\xBA\xB5\xB7\xA0\x8D\x20\x41\xF2\xBA\x5D\xB6\x0F\x56\xF4\x41\xA2\xC0\x9C\xE9\xB4\x29\x4A\x7D\xB0\x22\x7A\x11\x02\x23\x48\x2A\xD4\x74\x53\x33\x3F\xD4",
"\x3E\x4A\x50\x19\xE4\xB0\xD0\x22\xCD\x44\x45\x4A\x31\x8C\x92\xA2\x3E\x65\x0A\x4D\xCB\x96\x7E\xE8\xD5\x97\xCC\xFE\xFE\x37\xA7\x77\xDB\xBD\xA7\xE7\x3C\xBE\x05\x9E\xED\xB7\xB3\xF3",
"\x7B\x39\xF7\xEE\x19\x17\xA8\xAC\x56\xDB\x54\x82\x60\x41\xB3\x59\xBC\xFF\xAC\xF9\xCA\xB5\xAE\x86\xCA\xF9\x4E\xAF\x1B\x3B\xEA\x5D\x48\x9D\x66\xE2\x49\x27\x9F\xD5\x66\x9B\xA2\x1C",
"\x22\x02\xD0\x40\xE4\x81\x6C\x3B\x76\x37\x56\xE3\x37\x5F\x2F\x62\xE8\x0B\xD3\x66\x19\x7E\x53\xA7\x99\x78\xAE\x1F\x64\x3E\x21\x71\x69\x09\x5F\x20\x98\x2D\x58\x70\x24\x07\x07\x7B",
"\x6F\xB0\x79\x82\x61\x81\x21\xCC\xDE\x21\x54\x16\x02\xD4\x69\x26\x9E\x74\xEE\xCB\xCF\x4D\xC7\x44\xB3\x88\x7C\x81\xC5\x22\xFE\x6C\xB9\xE9\x46\x67\x46\x1A\x8A\x16\x2B\x0A\x5B\x05",
"\x74\x66\x65\xE1\x98\x6F\x00\x31\x32\x87\x9F\x59\x77\x66\x66\x61\x42\xBC\xC0\xF5\x6C\x47\x1A\x36\xD7\xB9\x51\x14\xC5\x1E\xBE\xA0\xC3\x5B\xD9\x98\x99\xE1\xC0\xCE\xBE\x57\x48\xD7",
"\x9A\x63\x68\xEA\x7C\x8A\xF6\x14\x3B\x9F\xF6\xA6\xA4\x60\xEB\xE3\x3E\x9C\x5F\xD6\x5A\x7A\xFA\x71\xBF\xC3\x81\x3D\x4D\x35\x0D\x7C\xC1\xF3\x87\x57\x43\xF9\x87\x8F\x21\x95\x5E\xAB",
"\x41\x83\x4E\x83\x54\xDB\x92\x76\x20\xCA\xBF\xD0\x99\x9D\xBB\x4E\xDB\xBD\xC7\x8E\x2F\x5A\x3D\x74\x3D\x50\x03\x80\x7E\x7A\x7A\x06\x46\x47\xFD\xA0\x33\x6C\x84\x18\x46\x0C\xBD\x1F",
"\x86\x2D\x71\x71\x00\x52\x10\x16\x17\xE6\xC1\xE7\x1B\x61\x9A\x81\x69\x31\x30\xFC\x61\x14\xB4\x3A\x3D\x20\x82\x1E\x58\xA9\x15\x05\x41\x14\x05\xB8\x58\xEE\x82\x7D\xE9\x99\x20\xCB",
"\x32\x94\x95\x95\xC3\xA5\xD2\x53\x00\x51\x09\xAA\x4B\x0B\xA1\xB8\xA4\x0C\x52\x53\x33\x40\xA5\x52\x81\xDB\x5D\x01\xA2\x45\x00\x45\x51\x80\x2A\x36\x12\x8D\x42\x49\x51\x01\x44\xE5",
"\x18\x90\x22\x0A\x98\x8C\x46\xF0\x54\x14\x42\x6D\x7D\x3B\xE4\x1C\x75\x41\xAD\xB7\x1D\x3C\x55\x85\x60\x32\x19\x41\x8A\x2A\xDC\x57\x5C\x74\x12\x28\x47\xA5\x8E\x44\xE4\xF0\x76\x5B",
"\x82\xA6\xCD\x5B\x0D\xB2\x12\xE6\xE4\x06\xB5\x1A\x66\xA7\x26\x41\x92\xC2\xA0\xD5\x6A\x60\x67\x92\x19\xAE\x7B\xCE\x70\x4D\x15\xAB\x01\xAD\xC1\x08\x3F\x46\x64\x6E\x8E\x9D\xF9\x13",
"\xE8\x1A\xFF\xE4\x63\x8A\x0E\xE6\x02\x41\xF8\x3F\x18\x82\x40\x28\x04\xFD\xDD\x75\xF0\xB6\xFF\x2E\x75\x9A\x89\x27\x9D\xFB\xC8\x4F\x39\xBE\xE0\xB4\xAB\xCE\x35\xFE\x71\x00\x16\x17",
"\x25\x76\x50\x26\x76\x6B\x61\x86\x08\xE4\x1D\xAF\x81\xBC\x13\x97\xA9\xD3\x4C\x3C\xE9\xDC\x47\x7E\xCA\xF1\x05\x0C\x5F\x7D\xFE\xEF\x35\x03\xAF\x9F\x00\xB0\x73\x30\x9A\xE2\x81\x0E",
"\xF6\xC1\xED\x52\xB8\x77\xAB\x98\x3A\xCD\xC4\x73\x9D\x7C\x6F\xDE\xF9\xCF\x53\x0E\xFE\xA9\xCD\xAE\xB3\x87\xCE\x75\x35\x54\xE1\xD0\xCB\x47\x38\x39\x36\x88\xFF\x4D\xF8\x57\x41\x33",
"\xF1\xA4\x93\x0F\x00\x36\xAD\x3E\x4C\x6B\xC5\xC9\x5D\x77\x6A\x2F\xB4\x31\xA3\xC4\x40\x4F\x21\x0F\xD1\x4C\x3C\xE9\x2B\xE1\xF5\x0B\xD6\x90\xC8\x90\x4C\xE6\x35\xD0\xCC\x79\x5E\xFF",
"\x2E\xF8\x0B\x2F\x3D\xE5\xC3\x97\x06\xCF\xCF\x00\x00\x00\x00\x49\x45\x4E\x44\xAE\x42\x60\x82"
])
from PySide import QtCore, QtGui
from PySide.QtCore import QRect
from PySide.QtCore import Qt
from PySide.QtGui import QFrame
from PySide.QtGui import QHBoxLayout
from PySide.QtGui import QPainter
from PySide.QtGui import QPlainTextEdit
from PySide.QtGui import QTextFormat
from PySide.QtGui import QWidget
from PySide.QtGui import QTextEdit
import idaapi
import include.syntax
import include.helper
idaapi.require('include.syntax')
idaapi.require('include.helper')
class LNTextEdit(QFrame):
'''Redefined QPLainTextEditor with additional features.'''
class NumberBar(QWidget):
'''Number bar class.'''
def __init__(self, config_theme, edit):
QWidget.__init__(self, edit)
self.config_theme = config_theme
self.edit = edit
information check out github: https://github.com/ax330d/hrdev/.
'''
import re
import os
import ConfigParser
from PySide import QtGui
import idaapi
import idc
import include.syntax
import include.gui
import include.helper
idaapi.require('include.syntax')
idaapi.require('include.gui')
idaapi.require('include.helper')
__author__ = 'Arthur Gerkis'
__version__ = '0.0.1 (beta)'
class Plugin(object):
'''Implements the main plugin class, entry point.'''
def __init__(self, real_dir):
super(Plugin, self).__init__()
self.tools = include.helper.Tools(self)
self.config_main = ConfigParser.ConfigParser()
self.config_theme = ConfigParser.ConfigParser()
import idaapi
idaapi.require('installer')
from installer import Installer
installer = Installer()
installer.start()
from PySide import QtCore, QtGui
from PySide.QtCore import QRect
from PySide.QtCore import Qt
from PySide.QtGui import QFrame
from PySide.QtGui import QHBoxLayout
from PySide.QtGui import QPainter
from PySide.QtGui import QPlainTextEdit
from PySide.QtGui import QTextFormat
from PySide.QtGui import QWidget
from PySide.QtGui import QTextEdit
import idaapi
import hrdev_plugin.include.syntax
import hrdev_plugin.include.helper
idaapi.require('hrdev_plugin.include.syntax')
idaapi.require('hrdev_plugin.include.helper')
class LNTextEdit(QFrame):
'''Redefined QPLainTextEditor with additional features.'''
class NumberBar(QWidget):
'''Number bar class.'''
def __init__(self, config_theme, edit):
QWidget.__init__(self, edit)
self.config_theme = config_theme
self.edit = edit
if encoding == codec_info.name:
return codec_info
codecs.register(sark_search_function)
# Register the hex-bytes codec.
register_sark_codecs()
# Since some of our code can be used outside of IDA, namely the `plumbing` module
# when used in the codecs proxy, we want to allow importing specific modules outside
# IDA.
try:
import idaapi
idaapi.require('sark.code')
idaapi.require('sark.core')
idaapi.require('sark.exceptions')
idaapi.require('sark.graph')
idaapi.require('sark.structure')
idaapi.require('sark.codeblocks')
idaapi.require('sark.data')
idaapi.require('sark.debug')
idaapi.require('sark.enum')
idaapi.require('sark.ui')
from .code import *
from .codeblocks import CodeBlock, get_nx_graph, get_block_start, FlowChart
from .data import read_ascii_string, get_string
from .core import set_name, is_function
from .enum import Enum, enums, add_enum, remove_enum
import idaapi
idaapi.require('sark.code.base')
idaapi.require('sark.code.xref')
idaapi.require('sark.code.location')
idaapi.require('sark.code.function')
idaapi.require('sark.code.switch')
idaapi.require('sark.code.instruction')
idaapi.require('sark.code.segment')
from .base import *
from .location import Location, locations
from .function import Function, functions
from .switch import Switch, is_switch
from .segment import Segment, segments
def run(self, arg):
#idaapi.msg("Shellcode Hashes run() called with %d!\n" % arg)
idaapi.require('flare')
idaapi.require('flare.shellcode_hash_search')
flare.shellcode_hash_search.main()
import idaapi
idaapi.require('idabuddy')
idaapi.require('sequences')
import sequences
from sark.qt import QtCore, form_to_widget, get_widget, QtWidgets, connect_method_to_signal
from idabuddy import AutoPopup
def get_idaview(title=None, form=None, widget=None):
if form is not None:
ida_widget = form_to_widget(form)
elif widget is not None:
ida_widget = widget
else:
ida_widget = get_widget(title)
ida_holder = ida_widget.children()[0]
idaview = ida_holder.children()[0]
return idaview
# Get all ida views in <6.7
#
def iter_all_idaviews():
'''Does return duplicates!'''
for widget in QtWidgets.qApp.allWidgets():
window_title = widget.windowTitle()
if not window_title.startswith(u'IDA View-'):
continue
idaview = get_idaview(title=str(window_title))
#!c:\\python27\python.exe
# -*- coding: utf-8 -*-
# pylint: disable=E1101
# pylint: disable=F0401
# pylint: disable=C0103
"""This file contains all classes related to parsing and highlighting."""
from PySide import QtGui, QtCore
import clang.cindex
import idaapi
import hrdev_plugin.include.helper
idaapi.require("hrdev_plugin.include.helper")
class Parser(object):
"""Implements parser to parse Hex-Rays decompiler output."""
def __init__(self, plugin):
super(Parser, self).__init__()
self.plugin = plugin
self.config_main = self.plugin.config_main
self.gui = self.plugin.gui
self.tools = self.plugin.tools
self._token_kinds = hrdev_plugin.include.helper.AttributeDict()
self._token_kinds.punctiation = []
self._token_kinds.kkeyword = []
self._token_kinds.identifier = []
self._token_kinds.literal = []
'''
__author__ = "JiaYu"
__license__ = "MIT"
__version__ = "1.0"
__email__ = ["*****@*****.**"]
#import common, strings, pclntbl, moduledata, types_builder, itab
import idautils, idc, idaapi
import sys
import string
sys.setrecursionlimit(10000)
idaapi.require("common")
idaapi.require("strings")
idaapi.require("pclntbl")
idaapi.require("moduledata")
idaapi.require("types_builder")
idaapi.require("itab")
idaapi.require("idc")
def main():
# find and parsefirfst moduledata
firstmoddata_addr = moduledata.find_first_moduledata_addr()
firstmoddata = moduledata.ModuleData(firstmoddata_addr)
firstmoddata.parse()
common._info("pclntbl addr: 0x%x\n" % firstmoddata.pclntbl_addr)
# parse pclntab(functions/srcfiles and function pointers)
#!c:\\python27\python.exe
# -*- coding: utf-8 -*-
'''IDA PDB Loader.'''
# FIXME: fails to find non-mangled names, pdbparse bug?
import traceback
import idautils
import idaapi
import idc
import pdbparse.symlookup
idaapi.require('pdbparse.symlookup')
__author__ = 'Arthur Gerkis'
__version__ = '0.0.2'
class Plugin(object):
'''IDA Pro Plugin'''
def __init__(self):
super(Plugin, self).__init__()
self.symbol_path = ''
self.image_base = 0
self.PDBLookup = None
def run(self):
'''Public function.'''
self.symbol_path = idc.AskFile(0, '*.pdb', 'Choose PDB file...')
#!c:\\python27\python.exe
# -*- coding: utf-8 -*-
# pylint: disable=E1101
# pylint: disable=F0401
# pylint: disable=C0103
'''This file contains all classes related to parsing and highlighting.'''
from PySide import QtGui, QtCore
import clang.cindex
import idaapi
import include.helper
idaapi.require('include.helper')
class Parser(object):
'''Implements parser to parse Hex-Rays decompiler output.'''
def __init__(self, plugin):
super(Parser, self).__init__()
self.plugin = plugin
self.config_main = self.plugin.config_main
self.gui = self.plugin.gui
self.tools = self.plugin.tools
self._token_kinds = include.helper.AttributeDict()
self._token_kinds.punctiation = []
self._token_kinds.kkeyword = []
self._token_kinds.identifier = []
self._token_kinds.literal = []
self._token_kinds.comment = []
self._replacer_literal = None
def run(self, arg):
idaapi.msg("StructTyper run() called with %d!\n" % arg)
idaapi.require('flare')
idaapi.require('flare.struct_typer')
flare.struct_typer.main()
# @file srchUtils
# utilities for searching for things in the IDB, as well as in binaries (and against the IDB) go here!
import idaapi
import idautils
idaapi.require("IDAItems.Data")
idaapi.require("IDAItems.Function")
idaapi.require("TerminalModule")
from Definitions import Architecture, Paths
import idc
from IDAItems import Function, Data
import TerminalModule
class srch(TerminalModule.TerminalModule, object):
def __init__(self, fmt='[+] srch (IDB/binary searching utils)'):
"""
This module is responsible for printing disassemblies and necessary compoents
of disassemblies
"""
super(srch, self).__init__(fmt)
self.registerCommand(self, self.nextarm, "nextarm", "<search_ea> [ui=True]")
self.registerCommand(self, self.nextascii, "nextascii", "<search_ea> [ui=True]")
self.registerCommand(self, self.nextfakeinst, "nextfakeinst", "<search_ea> [ui=True]")
self.registerCommand(self, self.nextname, "nextname", "<search_ea> [ui=True]")
self.registerCommand(self, self.nextknown, "nextknown", "<search_ea> [ui=True]")
self.registerCommand(self, self.nextbin, "nextbin", "<search_ea> [ui=True]")
self.registerCommand(self, self.nextred, "nextred", "<search_ea> [ui=True]")
# -*- coding: utf-8 -*-
import ctypes
import sys
import re
import importlib
import idaapi
idaapi.require("Patterns")
idaapi.require("Matcher")
idaapi.require("ast_helper")
idaapi.require("traverse")
import ready_patterns
EVENTS_HEXR = {
0: 'hxe_flowchart',
1: 'hxe_prolog',
2: 'hxe_preoptimized',
3: 'hxe_locopt',
4: 'hxe_prealloc',
5: 'hxe_glbopt',
6: 'hxe_structural',
7: 'hxe_maturity',
8: 'hxe_interr',
9: 'hxe_combine',
10: 'hxe_print_func',
11: 'hxe_func_printed',
12: 'hxe_resolve_stkaddrs',
100: 'hxe_open_pseudocode',
101: 'hxe_switch_pseudocode',
102: 'hxe_refresh_pseudocode',
103: 'hxe_close_pseudocode',
import time
import idaapi
import idaversion
import idc
import idautils
import bpUtils
import gdbProt
#import okTextForm
import waitDialog
import functionSig
#import reHooks
#import dbgHooks
import regFu
import menuMod
idaapi.require("idaSIM")
idaapi.require("stackTrace")
idaapi.require("dataWatch")
idaapi.require("branchNotTaken")
idaapi.require("writeWatch")
idaapi.require("bookmarkView")
idaapi.require("reHooks")
idaapi.require("dbgHooks")
idaapi.require("menuMod")
idaapi.require("colorBlocks")
from idaapi import Choose
'''
Ida script to reverse execution of Simics to the next breakpoint.
Since Ida does not know about reverse exectution, the general approach is to
tell Simics to reverse and then tell Ida to continue forward.
The script installs its functions as a hotkeys.
from __future__ import print_function
import idc
import idautils
import ida_frame
import ida_struct
import idaapi
import sys, os
idaapi.require("AddBP")
REGISTERS = [
'eax', 'ebx', 'ecx', 'edx', 'rax', 'rbx', 'rcx', 'rdx', 'r9', 'r10', 'r8'
]
def get_processor_architecture():
info = idaapi.get_inf_structure()
if info.is_64bit():
return "64"
elif info.is_32bit():
return ""
else:
return "Error"
def get_local_var_value_64(loc_var_name):
frame = ida_frame.get_frame(idc.here())
loc_var = ida_struct.get_member_by_name(frame, loc_var_name)
loc_var_start = loc_var.soff
loc_var_ea = loc_var_start + idc.GetRegValue("RSP")
loc_var_value = idc.read_dbg_qword(
loc_var_ea
#place this file in get_user_idadir()
#the next line is set by install.cmd
CUSTOM_SCRIPT_DIR = 'F:/NOTES/re/ida_python'
#don't touch the previous line
import sys
sys.path.append(CUSTOM_SCRIPT_DIR)
import idaapi
idaapi.require('hexnum')
idaapi.enable_extlang_python(True)
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
# implied. See the License for the specific language governing
# permissions and limitations under the License.
########################################################################
#
# IDA Plugin wrapper for shellcode hash search.
#
########################################################################
import idc
import idautils
import idaapi
idaapi.require('flare')
idaapi.require('flare.shellcode_hash_search')
class shellcode_search_plugin_t(idaapi.plugin_t):
flags = idaapi.PLUGIN_UNL
comment = "This is a comment"
help = "This is help"
wanted_name = "Shellcode Hashes"
wanted_hotkey = ""
def init(self):
return idaapi.PLUGIN_OK
def run(self, arg):
flare.shellcode_hash_search.main()
#!/usr/bin/env python
# -*- coding: UTF-8 -*-
'''
go_parser.py:
IDA Plugin for Golang Executable file parsing.
'''
__author__ = "JiaYu"
__license__ = "MIT"
__version__ = "1.0"
__email__ = ["*****@*****.**"]
import idc, idaapi
idaapi.require("common")
#ADDR_SZ = 8
START_EA = 0x98C710
END_EA = 0x990F58
curr_addr = START_EA
while curr_addr <= END_EA:
curr_str_addr = common.read_mem(curr_addr)
curr_str_len = common.read_mem(curr_addr + common.ADDR_SZ)
if curr_str_addr > 0 and curr_str_addr != idc.BADADDR and curr_str_len > 1:
if idc.MakeStr(curr_str_addr, curr_str_addr + curr_str_len):
idaapi.autoWait()
curr_str = str(idc.GetManyBytes(curr_str_addr, curr_str_len))
print("@ 0x%x: %s" % (curr_str_addr, curr_str))
curr_addr += 2 * common.ADDR_SZ
import idaapi
from idaapi import Form, Choose2, plugin_t # for gui stuff
import idc
import idautils
import inspect
import struct
import binascii
"""Help with analyzing binary and bootrom libraries for various CPU architectures
This module wraps IDA Pro's IDAAPI, IDC, and IDAUTILS python libraries to
provide useful and (hopefully) easy-to-use search functions for a disassembly.
The base BinAnalyze class provides some very basic search and function
creation funcionality, while processor-specific analyzers are expected to
increase its usefulness.
Note: please import this module using:
idaapi.require()
Especially while testing and modifying it
(see http://www.hexblog.com/?p=749 for information on why)
"""
class BinAnalyze():
def __init__(self):
return
"""
The 'get' mnemonics are meant to be implemented in a derived class.
# ClassInformer python
# Nicolas Guigo / NCC Group
# Tyler Colgan / NCC Group
# 03/2017
import idaapi
from idc import *
from idc_bc695 import *
idaapi.require("utils")
idaapi.require("msvc")
idaapi.require("gcc")
idaapi.require("classdiagram")
from idaapi import autoIsOk
from msvc import run_msvc
from gcc import run_gcc
from classdiagram import ClassDiagram
def show_classes(classes):
c = ClassDiagram("Class Diagram", classes)
c.Show()
def isGcc():
gcc_info = FindText(0x0, SEARCH_CASE|SEARCH_DOWN, 0, 0, "N10__cxxabiv117__class_type_infoE")
return gcc_info != BADADDR
def main():
print("Starting ClassInformerPython")
if autoIsOk():
classes = run_gcc() if isGcc() else run_msvc()
print(classes)
#!/usr/bin/python
# coding: utf-8
#
# HeapViewer - by @danigargu
#
import idaapi
import os
import sys
PLUGIN_DIR = idaapi.idadir(os.path.join("plugins", "heap_viewer"))
sys.path.append(PLUGIN_DIR)
idaapi.require('plugin_gui')
#------------------------------------------------------------------------
from plugin_gui import HeapPluginForm, PLUGNAME
# -----------------------------------------------------------------------
class HeapViewPlugin(idaapi.plugin_t):
flags = 0
comment = ""
help = ""
wanted_name = PLUGNAME
wanted_hotkey = "Ctrl-H"
def init(self):
self.icon_id = 0
return idaapi.PLUGIN_KEEP
import ida_ua, idc, idaapi, ida_funcs
idaapi.require("maze_deobf_utils")
#import maze_deobf_utils as mdu
class RecursiveDescent(object):
'''
@brief Recurse descent disassembly for a single function (no calls followed)
'''
def __init__(self, Start_ea, Approach):
self.deferred_targets = []
self.instructions_walked = []
self.wrong_functions = []
self.entry_point = Start_ea
self.deferred_targets.append(Start_ea)
self.emulators = Eumulators()
self.deobf_approach = Approach
def GetInstuctionTargetAddress(self, Target_insn):
'''
@brief Return the operand value for a unirary instruction that contains a target
address (JMP, JNZ, JZ, push, call, etc).
'''
target_ea = 0
import os
import random
import idaapi
import sark
import yaml
idaapi.require('interaction')
from interaction import ask_next, ask_ok, Link, use_defaults, Span, embed_images
SAYINGS = yaml.load(open(os.path.join(os.path.dirname(__file__), 'sayings.yml'), 'rb'))
BASIC_SAYINGS = SAYINGS['basic']
ADDRESS_SAYINGS = SAYINGS['address']
def go_cancel():
go = Link('Go', href='go', color='green', text_decoration='underscore')
cancel = Link('Cancel', href='cancel', color='red', text_decoration='underscore')
return '{go} {cancel}'.format(cancel=cancel, go=go)
def ask_go_cancel(query):
return '{query}{br}{gocancel}'.format(**use_defaults(query=query, gocancel=go_cancel()))
def say_multiple(buddy, *text):
last_text = text[-1]
text = iter(text[:-1])
def _messenger(*args, **kwargs):
# permissions and limitations under the License.
########################################################################
#
# Mostly a glorified wrapper around the apply_callee_tinfo() idasdk function.
# Useful for when IDA doesn't apply stack analysis to an indirect call,
# and you can identify the function prototype during reverse engineering.
#
########################################################################
import sys
import idc
import idautils
import idaapi
idaapi.require('flare')
idaapi.require('flare.apply_callee_type')
idaapi.require('flare.jayutils')
PLUGIN_HELP = "This is help"
PLUGIN_NAME = "ApplyCalleeType"
PREFERRED_SHORTCUT = "Alt-J"
PLUGIN_COMMENT = "Apply callee type to indirect call location"
ACTION_NAME = 'flare:apply_callee_type'
MENU_PATH = "Edit/Operand type/Manual"
# get the IDA version number
ida_major, ida_minor = list(map(int, idaapi.get_kernel_version().split(".")))
using_ida7api = (ida_major > 6)
ex_addmenu_item_ctx = None
# -*- coding: utf-8 -*-
import ctypes
import sys
import re
import importlib
import idaapi
idaapi.require("Patterns.__init__")
idaapi.require("Patterns.Instructions")
idaapi.require("Patterns.Expressions")
idaapi.require("Patterns.Pattern")
idaapi.require("Matcher")
idaapi.require("ast_helper")
from Matcher import *
from ast_helper import *
from Patterns.Instructions import *
from Patterns.Expressions import *
from traverse import *
import ready_patterns
EVENTS_HEXR = {
0: 'hxe_flowchart',
1: 'hxe_prolog',
2: 'hxe_preoptimized',
3: 'hxe_locopt',
4: 'hxe_prealloc',
5: 'hxe_glbopt',
6: 'hxe_structural',
7: 'hxe_maturity',
8: 'hxe_interr',
9: 'hxe_combine',
##
# @Author Lan
# This represents the concept of modulized functions/data. A set of functions may be related, or were belonging to
# A single file or set of files when compiled together.
# This encapsulates all Names that begin with <ModuleName> and count them as belonging to the same module.
##
import idaapi
import idautils
import idc_bc695
idaapi.require('BinarySearcher')
idaapi.require('Definitions.Architecture')
idaapi.require('IDAItems.GameFile')
idaapi.require('IDAItems.Function')
from BinarySearcher import BinarySearcher
from Definitions.Architecture import ROM_SEG
from IDAItems.GameFile import GameFile
from IDAItems import Function
class ModuleException(Exception):
def __init__(self, s):
super(Exception, self).__init__(s)
class Module:
def __init__(self, *args):
"""
Creates a module with the name moduleName. This could be exported from the database, or it could be a new
module to include in the database!
#!/usr/bin/env python
# -*- coding: UTF-8 -*-
import idc, idaapi
idaapi.require("moduledata")
idaapi.require("common")
from common import read_mem, ADDR_SZ
from common import _debug, _error, _info
import sys
sys.setrecursionlimit(10000)
STANDARD_PACKAGES = ['archive/tar', 'archive/zip', 'bufio', 'builtin', 'bytes', 'compress/bzip2', 'compress/flate', 'compress/gzip', 'compress/lzw', 'compress/zlib', 'container/heap', 'container/list', 'container/ring', 'context', 'crypto', 'crypto/aes', 'crypto/cipher', 'crypto/des', 'crypto/dsa', 'crypto/ecdsa', 'crypto/ed25519', 'crypto/elliptic', 'crypto/hmac', 'crypto/md5', 'crypto/rand', 'crypto/rc4', 'crypto/rsa', 'crypto/sha1', 'crypto/sha256', 'crypto/sha512', 'crypto/subtle', 'crypto/tls', 'crypto/x509', 'crypto/x509/pkix', 'database/sql', 'database/sql/driver', 'debug/dwarf', 'debug/elf', 'debug/gosym', 'debug/macho', 'debug/pe', 'debug/plan9obj', 'encoding', 'encoding/ascii85', 'encoding/asn1', 'encoding/base32', 'encoding/base64', 'encoding/binary', 'encoding/csv', 'encoding/gob', 'encoding/hex', 'encoding/json', 'encoding/pem', 'encoding/xml', 'errors', 'expvar', 'flag', 'fmt', 'go/ast', 'go/build', 'go/constant', 'go/doc', 'go/format', 'go/importer', 'go/parser', 'go/printer', 'go/scanner', 'go/token', 'go/types', 'hash', 'hash/adler32', 'hash/crc32', 'hash/crc64', 'hash/fnv', 'html', 'html/template', 'image', 'image/color', 'image/color/palette', 'image/draw', 'image/gif', 'image/jpeg', 'image/png', 'index/suffixarray', 'io', 'io/ioutil', 'log', 'log/syslog', 'math', 'math/big', 'math/bits', 'math/cmplx', 'math/rand', 'mime', 'mime/multipart', 'mime/quotedprintable', 'net', 'net/http', 'net/http/cgi', 'net/http/cookiejar', 'net/http/fcgi', 'net/http/httptest', 'net/http/httptrace', 'net/http/httputil', 'net/http/pprof', 'net/mail', 'net/rpc', 'net/rpc/jsonrpc', 'net/smtp', 'net/textproto', 'net/url', 'os', 'os/exec', 'os/signal', 'os/user', 'path', 'path/filepath', 'plugin', 'reflect', 'regexp', 'regexp/syntax', 'runtime', 'runtime/cgo', 'runtime/debug', 'runtime/pprof', 'runtime/race', 'runtime/trace', 'sort', 'strconv', 'strings', 'sync', 'sync/atomic', 'syscall', 'syscall/js', 'testing', 'testing/iotest', 'testing/quick', 'text/scanner', 'text/tabwriter', 'text/template', 'text/template/parse', 'time', 'unicode', 'unicode/utf16', 'unicode/utf8', 'unsafe']
class TypesParser():
'''
Parse and construct all the types
'''
RAW_TYPES = ['Bool','Int','Int8','Int16','Int32','Int64','Uint','Uint8','Uint16','Uint32','Uint64','Uintptr','Float32','Float64','Complex64','Complex128', 'UnsafePointer', 'String']
def __init__(self, firstmoduledata):
self.moddata = firstmoduledata
self.parsed_types = dict()
self.itabs = list()
def is_raw_type(self, kind):
return kind in self.RAW_TYPES
def build_all_types(self, depth=1):
_info("Building all types...")
import functionSig
#import reHooks
#import dbgHooks
import regFu
import menuMod
import bookmarkView
import idaSIM
import stackTrace
import dataWatch
import branchNotTaken
import writeWatch
import reHooks
import dbgHooks
import ida_dbg
import menuMod
'''
idaapi.require("idaSIM")
idaapi.require("stackTrace")
idaapi.require("dataWatch")
idaapi.require("branchNotTaken")
idaapi.require("writeWatch")
idaapi.require("bookmarkView")
idaapi.require("reHooks")
idaapi.require("dbgHooks")
idaapi.require("menuMod")
'''
from idaapi import Choose
'''
Ida script to reverse execution of Simics to the next breakpoint.
Since Ida does not know about reverse exectution, the general approach is to
tell Simics to reverse and then tell Ida to continue forward.
#!c:\\python27\python.exe
# -*- coding: utf-8 -*-
# pylint: disable=E1101
# pylint: disable=F0401
# pylint: disable=C0103
'''This file contains all classes related to parsing and highlighting.'''
from PySide import QtGui, QtCore
import clang.cindex
import idaapi
import hrdev_plugin.include.helper
idaapi.require('hrdev_plugin.include.helper')
class Parser(object):
'''Implements parser to parse Hex-Rays decompiler output.'''
def __init__(self, plugin):
super(Parser, self).__init__()
self.plugin = plugin
self.config_main = self.plugin.config_main
self.gui = self.plugin.gui
self.tools = self.plugin.tools
self._token_kinds = hrdev_plugin.include.helper.AttributeDict()
self._token_kinds.punctiation = []
self._token_kinds.kkeyword = []
self._token_kinds.identifier = []
self._token_kinds.literal = []
self._token_kinds.comment = []
self._token_kinds.imported_functions = []
self._token_kinds.banned_functions = []
