IDA Pro 插件记录

IDA Pro 插件记录

version: 7.5

BinaryAI

pip install --upgrade binaryai
# then you can add the binaryai plugin into $IDAUSR
binaryai install_ida_plugin

flare-emu

import flare_emu

def decrypt(argv):
    myEH = flare_emu.EmuHelper()
    myEH.emulateRange(myEH.analysisHelper.getNameAddr("decryptString"), registers = {"arg1":argv[0], "arg2":argv[1], 
                           "arg3":argv[2], "arg4":argv[3]})
    return myEH.getEmuString(argv[0])

def iterateCallback(eh, address, argv, userData):
    s = decrypt(argv)
    print("%s: %s" % (eh.hexString(address), s))
    eh.analysisHelper.setComment(address, s, False)

if __name__ == '__main__':   
    eh = flare_emu.EmuHelper()
    eh.iterate(eh.analysisHelper.getNameAddr("decryptString"), iterateCallback)

x64dbgida

官方插件

VT-IDA Plugin

官方插件,还在开发,极其不稳定

LazyIDA

shortcuts:

  • Disasm Window:
    • w: Copy address of current line into clipboard
  • Hex-rays Window:
    • w: Copy address of current item into clipboard
    • c: Copy name of current item into clipboard
    • v: Remove return type of current item

Ponce

符号执行+污点传播

Karta

Lighthouse

A Code Coverage Explorer