编写OD插件将IDA中分析出来的函数名导入到OD中-白红宇

编写OD插件将IDA中分析出来的函数名导入到OD中

阅读量：6590 次

发布时间：2019-06-24

本文共 7116 字，大约阅读时间需要 23 分钟。

逆向程序的时候，喜欢用IDA静态分析，用OD动态调试，如果把IDA分析出来的函数名称都导入到OD中，调试的时候就知道哪些函数不需要再看了。以前我一直用GODUP的map loader，但是有些时候感觉它有点问题，还有一个插件叫MapConv也有这个功能，不过我还是打算自己写一个，主要是为了学习如何编写OD插件

首先我用一个IDC脚本将idb中所有函数的名称都导出到一个文件当中

//CamelLu.idc #include 
     
       static CamelLu() {     auto addr,path,file,imagebase;     Message("Functions' Names Dumper - CamelLu(2011.7.19)\n");     file = fopen(GetInputFilePath(),"rb");     if (0 == file)     {         Warning("open INPUTFILE failed!");         return;     }     if (0 != fseek(file,0x3c,0))     {         Warning("seek e_lfanew failed!");         fclose(file);         return;     }     imagebase = readlong(file,0);     if (0 != fseek(file,imagebase + 0x34,0))     {         Warning("seek imagebase failed!");         fclose(file);         return;             }     imagebase = readlong(file,0);     fclose(file);     path = AskFile(1,"*.lu","Please enter output file name");     if (BADADDR == path)     {         Warning("AskFile failed!");         return;     }     file = fopen(path,"w");     if (0 == file)     {         Warning("fopen failed!");         return;     }     addr = MinEA();     if ("" != GetFunctionName(addr))         fprintf(file,"%X---%s\n",addr,GetFunctionName(addr));     for(addr = NextFunction(addr);BADADDR != addr;addr = NextFunction(addr))              fprintf(file,"%X-%s\n",addr - imagebase,GetFunctionName(addr));     fclose(file);     Message("output functions' names finished!"); }

这个idc脚本文件没有main函数，因为我要使用快捷键来调用它

使用方法：

在IDA的安装目录下面找到idc这个目录，把上面这个脚本保存到这个目录中，然后idc目录下找到

ida.idc这个文件，打开它，在#include<idc.idc>的下面加入#include<CamelLu.idc>，然后在它的main函数里面加入AddHotkey("Alt-9","CamelLu");

接下来你就可以在IDA中按Alt+9来调用这个脚本了（

为脚本选择热键的时候要注意，如果这个热键已经被其他脚本或者插件使用的话，AddHotKey会失败，IDA不会给你提示的噢）

接下来再写一个OD插件来解析上面输出的文件，用Quickinsertname和Mergequicknames函数把函数名加到相应的地址就OK。我对插件框架的几个函数用途都写了简单的注释，相信大家看过之后都能自己写OD插件了

VS环境设置为 Use Multi-Byte Character Set

如果提示“Please set default char type to unsigned (option /J)” 解决方案如下：

In Solution Explorer, open the shortcut menu for the project and then chooseProperties.

In the project Property Pages dialog box, in the left pane underConfiguration Properties, expand C/C++ and then selectCommand Line.

In the Additional Options pane, specify the/J compiler option.

需要注意的是如果是用VS2012编译在XP上OD启动加在这个插件会报错，找不到“msvcr110.dll” 但是XP上最多支持msvcr100.dll 即便找来了msvcr110.dll注册它也是要出错的所以如果需要在XP上的OD运行该插件用VS2010编译该插件就行 VS2012编译只能在WIN7 WIN8的OD上运行

#include 
     
       #include 
      
       	//for GetOpenFileName function. #include 
       
        		//for _tcscpy_s ... function. #include 
        
         		//for _countof ... function. #include 
         
          	//for String function of windows. #include 
          
            //for StringCchPrintf ... function. #include "plugin.h" #pragma comment(lib,"OLLYDBG.LIB") static HWND hwnd = NULL; BOOL APIENTRY DllMain( HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved ) { switch (ul_reason_for_call) { case DLL_PROCESS_ATTACH: case DLL_THREAD_ATTACH: case DLL_THREAD_DETACH: case DLL_PROCESS_DETACH: break; } return TRUE; } //下面四个函数全都是插件回调函数，只有前两个函数是编写OD插件必须有的！！！ //ODBG_PluginData这个函数是必须有的，作用就是设置插件的名字(在OD的Plugin) extc int _export cdecl ODBG_Plugindata(TCHAR shortname[32]) { strcpy_s(shortname, 32, "IDA2OD"); return PLUGIN_VERSION; } //ODBG_Plugininit这个函数也是必须有的，看名字就知道是用来做一些初始化工作啦 //ollydbgversion参数可以用来检查当前OD的版本，确保插件运行在兼容的OD版本上，hw是OD主窗口的句柄 extc int _export cdecl ODBG_Plugininit(int ollydbgversion, HWND hw, DWORD *features) { if (ollydbgversion < PLUGIN_VERSION) { MessageBox(hw, TEXT("CamelLu is not compatible with your Ollydbg version!"), 0, 0); return -1; } hwnd = hw; return 0; } //ODBG_Pluginmenu这个函数是用来添加菜单的，每个菜单项之间用'|'字符隔开 extc int _export cdecl ODBG_Pluginmenu(int origin, TCHAR data[4096], VOID *item) { if (origin == PM_MAIN) { strcpy_s(data, 4096, "0&Load functions\' names|1&About"); } return 1; } //ODBG_Pluginaction函数用于添加响应ODBG_Pluginmenu函数添加的菜单，很简单，看看下面的代码就明白了 extc void _export cdecl ODBG_Pluginaction(int origin, int action, VOID *item) { OPENFILENAME ofn; TCHAR wszFile[MAX_PATH]; PTSTR pBuffer = NULL; PTSTR pLocate = NULL; PTSTR pDellimiter = NULL; PTSTR pTemp = NULL; DWORD dwFileSize = 0; DWORD dwBytesRead = 0; DWORD dwImageBase = 0; DWORD dwAddr = 0; int nSize; t_table *table = NULL; t_sorted *sorted = NULL; t_module *module = NULL; HANDLE hFile = INVALID_HANDLE_VALUE; int nIndex = 0; if (origin == PM_MAIN) if (action == 0) { ZeroMemory(&ofn, sizeof(ofn)); ofn.lStructSize = sizeof(ofn); ofn.hwndOwner = hwnd; ofn.lpstrFile = wszFile; ofn.lpstrFile[0] = '\0'; ofn.nMaxFile = _countof(wszFile); ofn.lpstrFilter = TEXT(".lu\0*.lu\0"); ofn.nFilterIndex = 1; ofn.lpstrFileTitle = NULL; ofn.nMaxFileTitle = 0; ofn.lpstrInitialDir = NULL; ofn.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST; if (GetOpenFileName(&ofn)==TRUE) { if (STAT_NONE == _Getstatus()) { MessageBox(hwnd, TEXT("No debugee now!!!"), 0, 0); return; } hFile = CreateFile( wszFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL); if (INVALID_HANDLE_VALUE == hFile) { MessageBox(hwnd, TEXT("Failed to open .lu file!"), 0, 0); return; } dwFileSize = GetFileSize(hFile,NULL); if (INVALID_FILE_SIZE == dwFileSize) { MessageBox(hwnd, TEXT("GetFileSize failed!"), 0, 0); CloseHandle(hFile); return; } pBuffer = (PTSTR)VirtualAlloc( NULL, dwFileSize + sizeof(TCHAR), MEM_COMMIT, PAGE_READWRITE ); if (NULL == pBuffer) { MessageBox(hwnd, TEXT("VirtualAlloc failed!"), 0, 0); CloseHandle(hFile); return; } if (!ReadFile( hFile, pBuffer, dwFileSize, &dwBytesRead, NULL) ) { MessageBox(hwnd, TEXT("ReadFile failed!"), 0, 0); VirtualFree(pBuffer, 0, MEM_RELEASE); CloseHandle(hFile); return; } CloseHandle(hFile); table = (t_table*)_Plugingetvalue(VAL_MODULES); if (NULL == table) { MessageBox(hwnd, TEXT("Get modules failed!"), 0, 0); VirtualFree(pBuffer, 0, MEM_RELEASE); CloseHandle(hFile); return; } sorted = &table->data; for (nIndex = 0;nIndex < sorted->n;++nIndex) { module = (t_module *)((DWORD)sorted->data + nIndex * sorted->itemsize); if (0 == strcmp(module->path, (char *)_Plugingetvalue(VAL_EXEFILENAME))) { dwImageBase = module->base; break; } } pLocate = pBuffer; pDellimiter = strstr(pLocate, "\r\n"); while (*(pDellimiter + 2) != 0) { nSize = pDellimiter - pLocate + sizeof(TCHAR); pTemp = (PTSTR)VirtualAlloc(NULL, nSize, MEM_COMMIT,PAGE_READWRITE); if (NULL == pTemp) { MessageBox(hwnd, TEXT("VirtualAlloc in loop failed!"), 0, 0); VirtualFree(pBuffer, 0, MEM_RELEASE); return; } strncpy_s(pTemp, nSize, pLocate, pDellimiter - pLocate); sscanf_s(pTemp,"%X-",&dwAddr); _Quickinsertname(dwImageBase + dwAddr, NM_LABEL, strchr(pTemp,'-') + sizeof(TCHAR)); VirtualFree(pTemp, 0, MEM_RELEASE); pLocate = pDellimiter + 2; pDellimiter = strstr (pLocate, "\r\n"); } _Mergequicknames(); VirtualFree(pBuffer,0,MEM_RELEASE); MessageBox(hwnd, TEXT("I am done^ ^"), TEXT("CamelLu"), MB_OK); } } else if (action == 1) { MessageBox(hwnd, TEXT("CamelLu Functions\' Names Importer\r\nWritten by CamelLu 2011.7.19\r\n"), TEXT("Camellu"), MB_ICONINFORMATION); } }

OD插件的使用方法：

如果是原版的OD，直接把编译好的DLL放到od主程序的目录就可以了，看雪版的OD把DLL放到plugin目录下。

转载于:https://blog.51cto.com/whatday/1382484

你可能感兴趣的文章