一
下载源码
//1.下载 ida-cmake
cd /path/to/ida/idasdk/plugins && git clone https://github.com/0xeb/ida-cmake
//2.下载 ida-qscripts
cd /path/to/ida/idasdk/plugins && git clone https://github.com/0xeb/ida-qscripts
//3.下载idax
cd /path/to/ida/idasdk/plugins/ida-qscripts &&
git clone https://github.com/0xeb/idax
二
编译
//1.环境变量添加 IDASDK
//mac or linux
export IDASDK=/path/to/ida/idasdk
//2.clion 直接打开 ida-qscripts
//3.clion -- settings -- build,execution,deployment 中 新增配置,并设置 cmake ida插件变量(64位的需要)
//4.将编译出来的 qscripts.dylib qscripts64.dylib or qscripts.so qscripts.so 手动复制到 /path/to/ida/plugins 中,重启ida即生效
//1.设置环境变量
setx IDASDK /path/to/ida/idasdk
//2.使用visual studio打开,测试环境为vs2022,打开后在cmakefile中看情况设置
//3.vs 点击 项目--> qscripts的 CMake设置,在下面设置才能编译64位的dll
//4.将 qscripts.dll qscripts64.dll 复制到 /path/to/ida/plugins
三
运行图
四
pycharm 配置 idapython开发环境
五
clion 配置 idacpp开发环境(这里三个端一样)
选择cpp插件的原因肯定是性能了,毕竟开发起来麻烦,但是c++默认比py快20倍,在某些场景很难不用吧,比如一个混淆代码的块有上千个,测试用python的d810跑这种大型函数+单规则处理,耗时5分多钟,电脑cpu i9了
#include <ida.hpp>
#include <idp.hpp>
#include <loader.hpp>
#include <kernwin.hpp>plugmod_t *idaapi init(void)
{
msg("Plugin initialized!\n");
return PLUGIN_OK;
}void idaapi term(void)
{
msg("Plugin term()\n");
}bool idaapi run(size_t arg)
{
msg("Plugin run()\n");
return true;
}plugin_t PLUGIN =
{
IDP_INTERFACE_VERSION,
PLUGIN_UNL, //需要这个标记,否则不触发qscripts
init,
term,
run,
"",
"",
"Sample plugin",
""
};
//cmakefile 配置
cmake_minimum_required(VERSION 3.26)
project(ByeObf)
set(CMAKE_CXX_STANDARD 20)
#set(CMAKE_RUNTIME_OUTPUT_DIRECTORY /Applications/IDAPro8.3/ida.app/Contents/MacOS/plugins)include_directories(/Applications/IDAPro/ida.app/Contents/MacOS/plugins/hexrays_sdk/include/)
include_directories(/Applications/IDAPro/ida.app/Contents/MacOS/idasdk_pro/include/)#导入idaapi的目录
set(PLUGIN_NAME byeobf)
set(PLUGIN_SOURCES library.h library.cpp)
set(PLUGIN_OUTPUT_NAME ${PLUGIN_NAME})
set(PLUGIN_RUN_ARGS "-t")include($ENV{IDASDK}/ida-cmake/addons.cmake)
编译64位插件定义EA64即可
import time
import idaapi# Give the linker time to finish flushing the binary
time.sleep(1)# Optionally clear the screen:
#idaapi.msg_clear()# Load your plugin and pass any arg value you want
idaapi.load_and_run_plugin('byeobf', 0)# Optionally, do post work, etc.
/triggerfile /keep /Applications/IDAPro/ida.app/Contents/MacOS/plugins/byeobf64.dylib
六
vs 配置 idacpp开发环境 idapython环境
- 这里大差不差都参考上述改动即可
看雪ID:初恒
https://bbs.kanxue.com/user-home-788622.htm
# 往期推荐
2、在Windows平台使用VS2022的MSVC编译LLVM16
3、神挡杀神——揭开世界第一手游保护nProtect的神秘面纱
球分享
球点赞
球在看