|
|
|
|
|
|
|
|
|
|
|
|
|
|
[原创]编写OD插件将IDA中分析出来的函数名导入到OD中（CamelLu Functions' Names Importer）
不知道cntrump和FishSeeWater是不是看不懂汉字  [QUOTE=CamelLu;982531]以前我一直用GODUP的map loader，但是有些时候感觉它有点问题，还有一个插件叫MapConv也有这个功能，不过我还是打算自己写一个，主要是为了学习如何编写OD插件  [/QUOTE]
|
|
|
[原创]编写OD插件将IDA中分析出来的函数名导入到OD中（CamelLu Functions' Names Importer）
#include <windows.h>
#include <string.h>
#include "plugin.h"
#pragma comment(lib,"OLLYDBG.LIB")
static HINSTANCE hinst = NULL;
static HWND hwnd = NULL;
BOOL WINAPI DllEntryPoint(HINSTANCE hinstance,DWORD dwreason,LPVOID lpvreserved)
{
if (dwreason==DLL_PROCESS_ATTACH)
hinst=hinstance;
return 1;
}
//下面四个函数全都是插件回调函数，只有前两个函数是编写OD插件必须有的！！！
//ODBG_PluginData这个函数是必须有的，作用就是设置插件的名字(在OD的Plugin)
extc int _export cdecl ODBG_Plugindata(char shortname[32])
{
strcpy(shortname,"CamelLu");
return PLUGIN_VERSION;
}
//ODBG_Plugininit这个函数也是必须有的，看名字就知道是用来做一些初始化工作啦
//ollydbgversion参数可以用来检查当前OD的版本，确保插件运行在兼容的OD版本上，hw是OD主窗口的句柄
extc int _export cdecl ODBG_Plugininit(int ollydbgversion,HWND hw,ulong *features)
{
if (ollydbgversion < PLUGIN_VERSION)
{
MessageBoxW(hw,L"CamelLu is not compatible with your Ollydbg version!",0,0);
return -1;
}
hwnd = hw;
return 0;
}
//ODBG_Pluginmenu这个函数是用来添加菜单的，每个菜单项之间用'|'字符隔开
extc int _export cdecl ODBG_Pluginmenu(int origin,char data[4096],void *item)
{
if (origin == PM_MAIN)
strcpy(data,"0&Load functions\' names|1&About");
return 1;
}
//ODBG_Pluginaction函数用于添加响应ODBG_Pluginmenu函数添加的菜单，很简单，看看下面的代码就明白了
extc void _export cdecl ODBG_Pluginaction(int origin,int action,void *item)
{
OPENFILENAME ofn;
wchar_t wszFile[MAX_PATH];
unsigned char *pBuffer = NULL;
unsigned char *pLocate = NULL;
unsigned char *pDellimiter = NULL;
unsigned char *pTemp = NULL;
DWORD dwFileSize = 0;
DWORD dwBytesRead = 0;
DWORD dwImageBase = 0;
DWORD dwAddr = 0;
char szBuffer[10];
t_table *table = NULL;
t_sorted *sorted = NULL;
t_module *module = NULL;
HANDLE hFile = INVALID_HANDLE_VALUE;
int nIndex = 0;
if (origin == PM_MAIN)
if (action == 0)
{
ZeroMemory(&ofn, sizeof(ofn));
ofn.lStructSize = sizeof(ofn);
ofn.hwndOwner = hwnd;
ofn.lpstrFile = wszFile;
ofn.lpstrFile[0] = L'\0';
ofn.nMaxFile = sizeof(wszFile);
ofn.lpstrFilter = L".lu\0*.lu\0";
ofn.nFilterIndex = 1;
ofn.lpstrFileTitle = NULL;
ofn.nMaxFileTitle = 0;
ofn.lpstrInitialDir = NULL;
ofn.Flags = OFN_PATHMUSTEXIST | OFN_FILEMUSTEXIST;
if (GetOpenFileName(&ofn)==TRUE)
{
if (STAT_NONE == _Getstatus())
{
MessageBoxW(hwnd,L"No debugee now!!!",0,0);
return;
}
hFile = CreateFileW(
wszFile,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL);
if (INVALID_HANDLE_VALUE == hFile)
{
MessageBoxW(hwnd,L"Failed to open .lu file!",0,0);
return;
}
dwFileSize = GetFileSize(hFile,NULL);
if (INVALID_FILE_SIZE == dwFileSize)
{
MessageBoxW(hwnd,L"GetFileSize failed!",0,0);
CloseHandle(hFile);
return;
}
pBuffer = VirtualAlloc(
NULL,
dwFileSize + 1 * sizeof(unsigned char),
MEM_COMMIT,
PAGE_READWRITE
);
if (NULL == pBuffer)
{
MessageBoxW(hwnd,L"VirtualAlloc failed!",0,0);
CloseHandle(hFile);
return;
}
if (!ReadFile(
hFile,
pBuffer,
dwFileSize,
&dwBytesRead,
NULL)
)
{
MessageBoxW(hwnd,L"ReadFile failed!",0,0);
VirtualFree(pBuffer,0,MEM_RELEASE);
CloseHandle(hFile);
return;
}
CloseHandle(hFile);
table = (t_table*)_Plugingetvalue(VAL_MODULES);
if (NULL == table)
{
MessageBoxW(hwnd,L"Get modules failed!",0,0);
VirtualFree(pBuffer,0,MEM_RELEASE);
CloseHandle(hFile);
return;
}
sorted = &table->data;
for (nIndex = 0;nIndex < sorted->n;++nIndex)
{
module = (t_module *)((DWORD)sorted->data + nIndex * sorted->itemsize);
if (0 == strcmp(module->path,_Plugingetvalue(VAL_EXEFILENAME)))
{
dwImageBase = module->base;
break;
}
}
pLocate = pBuffer;
pDellimiter = strstr(pLocate,"\r\n");
while (*(pDellimiter + 2) != 0)
{
pTemp = VirtualAlloc(NULL,pDellimiter - pLocate + 1 * sizeof(unsigned char),MEM_COMMIT,PAGE_READWRITE);
if (NULL == pTemp)
{
MessageBoxW(hwnd,L"VirtualAlloc in loop failed!",0,0);
VirtualFree(pBuffer,0,MEM_RELEASE);
return;
}
strncpy(pTemp,pLocate,pDellimiter - pLocate);
sscanf(pTemp,"%X-",&dwAddr);
_Quickinsertname(dwImageBase + dwAddr,NM_LABEL,strchr(pTemp,'-') + 1 * sizeof(unsigned char));
VirtualFree(pTemp,0,MEM_RELEASE);
pLocate = pDellimiter + 2;
pDellimiter = strstr(pLocate,"\r\n");
}
_Mergequicknames();
VirtualFree(pBuffer,0,MEM_RELEASE);
MessageBoxW(hwnd,L"I am done^ ^",L"CamelLu",MB_OK);
}
}
else if (action == 1)
{
MessageBoxW(hwnd,L"CamelLu Functions\' Names Importer\r\nWritten by CamelLu 2011.7.19\r\n",L"Camellu",MB_ICONINFORMATION);
}
}
请下载本楼层的附件吧 
|
|
|
|
|
|
|
|
|
|
|
|
[求助]tElock 1.0 (private) -> tE!脱壳后修复输入表仍无法运行
脱壳后的主程序，经测试可用，到下面的地址下载吧 http://u.115.com/file/bhbl13dk# |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
能力排名：
等 级：
活跃值：
在线值：
浏览人数：236
最近活跃：2024-4-7 23:17
注册时间：2009-07-22
