首页
社区
课程
招聘
[分享]bohacek hexrays_tools插件(ida pro 6.1编译)
发表于: 2014-8-12 12:33 5520

[分享]bohacek hexrays_tools插件(ida pro 6.1编译)

2014-8-12 12:33
5520
hexrays_tools by Milan Bohacek, Charles University in Prague
This plugin adds dozens of new functions to the decompiler and IDA:

- interactive structure reconstruction using pointer variable accesses across multiple functions
- finding a structure which matches a given pattern of accesses to a pointer variable
- function prototype helpers: remove return type, remove argument, convert to __usercall
- quick propagation of type from one side of assignment to another, or from a function call to the function pointer
- handle C++ classes and virtual function tables, with support for navigation to virtual functions from the decompiler
- structure editor improvements
- show a tree of related structures in a graph
- and several more minor features
Our comments: Milan's plugin is invaluable when dealing with complex, object-oriented code. While structure reconstruction and C++ support are the main highlights, even the smaller features help with many repetitive tasks which are common when dealing with big code bases. It's a clear winner of this year's submissions.

[培训]《安卓高级研修班(网课)》月薪三万计划,掌握调试、分析还原ollvm、vmp的方法,定制art虚拟机自动化脱壳的方法

上传的附件:
收藏
免费 0
支持
分享
最新回复 (4)
雪    币: 237
活跃值: (40)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
2
测试发现改成ida 6.1插件运行有点问题,需要重新调试修改一下。
2014-8-12 16:18
0
雪    币: 237
活跃值: (40)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
3
if (can_be_converted_to_ptr2(vu, vu.item, nullptr) )
                        {
                                add_custom_viewer_popup_item(vu.ct, "scan variable", "S", var_testing, &vu);
                                add_custom_viewer_popup_item(vu.ct, "open structure builder", "", var_testing1_5, &vu);
                                add_custom_viewer_popup_item(vu.ct, "finalize structure", "", var_testing2, &vu); //!!
                        }

//this prints them
static bool idaapi var_testing2(void *ud)
{
        vdui_t &vu = *(vdui_t *)ud;

        qstring name;
        lvar_t * lvar;
        ea_t ea;
        if (!name_for_struct_crawler(vu, name, &lvar, &ea))
                return false;

        typestring type;
        strtype_info_v2_t sti;
        if (!fi.to_type(name, type, &sti)) //!!crash
                return false;
2014-8-13 12:36
0
雪    币: 237
活跃值: (40)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
4
#if IDA_SDK_VERSION <= 610

//v6 0x170C8AA0, ... v61 0x17035E90
extern C<qstring  __cdecl (typestring *a2, int offset), 0x17035E90> create_field_name; //Crash

//v6 0x170C96D0 ... v61 0x17034C50
extern C<typestring  __cdecl (const type_t *), 0x17034C50> dummy_plist_for;

//V6 0x170C95C0 ... V61 17034B00
extern C<typestring __cdecl (int a2), 0x17034B00> make_dt_;
#endif
extern typestring make_dt(int a2);
2014-8-13 13:11
0
雪    币: 237
活跃值: (40)
能力值: ( LV3,RANK:20 )
在线值:
发帖
回帖
粉丝
5
.solution
And this worked, but only for me.
(Every IDA user has private build)

Then I bugged llfak until he exported the functions I wanted.
2014-8-13 14:24
0
游客
登录 | 注册 方可回帖
返回
//