IDA Unicode String Anylist and comment maker

早在很久之前就写过一个导入Unicode字符串注释的脚本,但是脚本操作还是有自己的局限性。每次都要通过其他的分析工具搜索定位到字符串,然后导出,在然后倒入。这是多么蛋疼的时间事情啊。 😎


(关于插图
Augusta Ada King, Countess of Lovelace (10 December 1815 – 27 November 1852), born Augusta Ada Byron, was an English writer chiefly known for her work on Charles Babbage’s early mechanical general-purpose computer, the analytical engine. Her notes on the engine include what is recognised as the first algorithm intended to be processed by a machine; thanks to this, she is sometimes considered the “World’s First Computer Programmer”
She was the only legitimate child of the poet Lord Byron (with Anne Isabella Milbanke). She had no relationship with her father, who died when she was nine. As a young adult, she took an interest in mathematics, and in particular Babbage’s work on the analytical engine. Between 1842 and 1843, she translated an article by Italian mathematician Luigi Menabrea on the engine, which she supplemented with a set of notes of her own. These notes contain what is considered the first computer programme — that is, an algorithm encoded for processing by a machine. Though Babbage’s engine has never been built, Lovelace’s notes are important in the early history of computers. She also foresaw the capability of computers to go beyond mere calculating or number-crunching while others, including Babbage himself, focused only on these capabilities.
)
到网上随便搜了搜发现hexrays曾经发布过一个处理unicode字符串的插件,猛击此处访问插件页面。插件的名字叫做unispector。并且在插件页面提供了相关的源代码下载,但是偶下载编译之后在新版的ida下无法成功加载,并且没有出现应有的效果。

Continue Reading

IDA Binary Copy & Paste


Seeing there isn’t any binary copy-and-paste functionality in IDA, this plug-in will take care of both
copy and paste operations allowing you to take a chunk of binary from one place and overwrite
another with it. You need to modify your plugins.cfg file as this is a multi-function plug-in, needing
one invocation for copy and another for paste. Obviously it only supports copying and pasting
within IDA, however it could probably be extended to go beyond that.

Continue Reading

Ida Plugin Wizard For VS2010

 
安装说明:
1.请按照提示信息进行操作,如果选择错误目录将会导致模板无法正常加载或者无法正常创建工程;
2.请确认安装目录为VS的vc根目录:如果是Win7 + vs2010则默认目录如下所示:
C:Program Files (x86)Microsoft Visual Studio 10.0VC

3.本工具的修改版本去除了插件自动复制功能,如果需要开启该功能请手工编辑
appwizIDA ProScripts1033default.js文件,去掉如下几行的注释:

否则会导致无法找到include目录或文件,或者无法生成plw文件。
4.部分错误目前尚未修正,将在未来版本进行修正。

393行 //PostBuildTool.Description = 'Copying "$(TargetFileName)" to "' + strCopyToFolder + '"...';
397行 //PostBuildTool.CommandLine = 'copy /b /y "$(TargetDir)$(TargetFileName)" "' + strCopyToFolder + '"';
Continue Reading

Windows 7 Eric4 PySide环境配置

详细的配置看这里,配置好后主要是编写的ide看起来比较舒服一些。其余的没发现什么用处。而至于pyside的问题,还是和上一篇文章中提到的一样。只能在ida中使用,这个也是目前看起来比较糟糕的地方,但是比较幸运的是如果在eric中使用可以使用pyqt代替。 smile
Hello world:

import  sys  
from PyQt4.QtCore import *  
from PyQt4.QtGui import  *  
app = QApplication(sys.argv)  
label = QLabel("Hello World From PyQt4")  
label.show()  
app.exec_()  
sys.exit()  

Ida PySide

PySide这个鸟东西听起来很牛b的样子,但是折腾起来很蛋疼。其实折腾这个东西主要还是看了hexblog上的一篇文章之后才想折腾的。看别人的文章感觉很简单,但是自己折腾就是折腾死也搞不定。后来又仔细看了下文章才发现原来ida中用的那个pyside是一个修改版本,并不是直接从源码编译过来的。并且提供了一个源码的patch包(http://hex-rays.com/idapro/freefiles/pyside_patch_20110328.zip),但是这个包只是针对 03/28/2011发布的版本。

Continue Reading

IDA python.plw: can’t load file

完整的错误提示是下面的样子:


LoadLibrary(F:\Crackl@b\Hex-Rays.IDA.Pro.Advanced.v6.1\ida61\plugins\python.plw) error: 找不到指定的模块。

F:\Crackl@b\Hex-Rays.IDA.Pro.Advanced.v6.1\ida61\plugins\python.plw: can't load file

00:12:07 zynamics BinDiff 4.0.1 15146 (Dec 21 2011) - (c)2004-2011 Google Inc.

00:12:07 zynamics BinExport 5 15136 (Dec 21 2011) - (c)2004-2011 Google Inc.

LoadLibrary(F:\Crackl@b\Hex-Rays.IDA.Pro.Advanced.v6.1\ida61\plugins\python.plw) error: 找不到指定的模块。

F:\Crackl@b\Hex-Rays.IDA.Pro.Advanced.v6.1\ida61\plugins\python.plw: can't load file
Continue Reading

VS2010 + IDASDK6.2搭建IDA Plugin开发环境

这里使用的开发环境是vs2010,不过几乎所有的设置在早期版本的vs中基本是一致的。启动vs之后关闭其他的项目和解决方案,然后按照下面的流程创作工程即可。

  1. 执行菜单的File->New->Project… (Ctrl-Shift-N)打开新建工程窗口。
  2. 展开左侧的Visual C++项目模板分支,然后选择右侧的Win32 Project条目,输入工程名称,然后点击确定。

Continue Reading