ida 插件编写

来源：互联网发布：钢铁雄心4汉化版mac 编辑：程序博客网时间：2024/05/22 08:23

Ida中的IDC 脚本，python 脚本还有插件功能给我们提供了很强大的扩展性，我们在分析二进制代码的时候总会有些时候需要写些脚本来给我们提供自动化的分析来释放我们的双手。

脚本已经很方便了，但有些时候为了效率我们还是需要编写下插件的。现在就来介绍下ida 插件的编写：

#include <ida.hpp>#include <idp.hpp>#include <search.hpp>#include <loader.hpp>#include <Windows.h>#include "Search_arm_syscall.h"int IDAP_init(void){// Do checks here to ensure your plug-in is being used within// an environment it was written for. Return PLUGIN_SKIP if the // checks fail, otherwise return PLUGIN_KEEP.return PLUGIN_KEEP;}void IDAP_term(void){// Stuff to do when exiting, generally you'd put any sort// of clean-up jobs here.return;}// The plugin can be passed an integer argument from the plugins.cfg// file. This can be useful when you want the one plug-in to do// something different depending on the hot-key pressed or menu// item selected.void IDAP_run(int arg){// The "meat" of your plug-inmsg("search arm syscall start %x end %x\n",getnseg(0)->startEA,getnseg(0)->endEA);search_svc_call(getnseg(0)->startEA,getnseg(0)->endEA);return;}// There isn't much use for these yet, but I set them anyway.char IDAP_comment[] = "This is my test plug-in";char IDAP_help[] = "My plugin";// The name of the plug-in displayed in the Edit->Plugins menu. It can // be overridden in the user's plugins.cfg file.char IDAP_name[] = "My plugin";// The hot-key the user can use to run your plug-in.char IDAP_hotkey[] = "Alt-X";// The all-important exported PLUGIN objectplugin_t PLUGIN ={IDP_INTERFACE_VERSION,// IDA version plug-in is written for0,// Flags (see below)IDAP_init,// Initialisation functionIDAP_term,// Clean-up functionIDAP_run,// Main plug-in bodyIDAP_comment,// Comment �unusedIDAP_help,// As above �unusedIDAP_name,// Plug-in name shown in // Edit->Plugins menuIDAP_hotkey// Hot key to run the plug-in};

下面写一个arm elf 中遍历 svc call

int search_svc_call(ea_t start,ea_t end){ea_t i;ea_t addrA;addrA = 0;for(i = start ; i < (end - 8) ; i += 2){addrA = find_binary(i,i + 8,"?? 70 A0 E3 00 00 00 EF",getDefaultRadix(),SEARCH_DOWN);if(addrA != 0xFFFFFFFF){msg("svc CALL :%x %s\n",addrA,arm_syscall_table[get_full_byte(addrA)]);if (get_func(addrA)){set_name(get_func(addrA)->startEA,arm_syscall_table[get_full_byte(addrA)]);}}}return 0;}

这里面只遍历出了这总类型的系统调用，应该还有别的类型的svc，不过现在也够用了比一个个自己去填写方便多了：

0 0