能力值:
( LV13,RANK:385 )
|
-
-
2 楼
谢谢分享优质插件,还有论坛有人发过类似插件. 我根据它的代码改了一下. 输出更贴合自己使用.
跟你的类似. 你的可以在右键菜单提供菜单项,另一个哥们开发的直接使用快捷键即可. (我只是把输出改成更贴合自己使用的) 原始文件好像叫做 PatternGen 论坛链接:PatternGen 这个快捷键是ALT+Z 原本是一个输出特征码的插件.提取特征码. 我依据它的代码做了少许修改,可以直接获取 VA RVA X64Dbg跳转.(不输出特征码) 插件快捷键 ALT+/.
下面是我魔改过的输出, X64DBG CTRL+G 支持 模块名.0 + 偏移 方式,跟你写的XCOPY 一样, 也支持 $ 当做前缀符号跳转. 更多X64dbg小技巧可以看下我博客. X64dbg使用小技巧 希望能帮到大家. 下列是我魔改过的输出.
下列代码直接复制下来,改为`.py`后缀. 然后放到`plugin`里面即可. 快捷键 `alt+z` 兼容性 支持最新`IDA8.2` # -*- coding: utf-8 -*-
import math
import idaapi
import idc
#import clipboard
try:
class Kp_Menu_Context(idaapi.action_handler_t):
def __init__(self):
idaapi.action_handler_t.__init__(self)
@classmethod
def get_name(self):
return self.__name__
@classmethod
def get_label(self):
return self.label
@classmethod
def register(self, plugin, label):
self.plugin = plugin
self.label = label
instance = self()
return idaapi.register_action(idaapi.action_desc_t(
self.get_name(), # Name. Acts as an ID. Must be unique.
instance.get_label(), # Label. That's what users see.
instance # Handler. Called when activated, and for updating
))
@classmethod
def unregister(self):
"""Unregister the action.
After unregistering the class cannot be used.
"""
idaapi.unregister_action(self.get_name())
@classmethod
def activate(self, ctx):
# dummy method
return 1
@classmethod
def update(self, ctx):
if ctx.form_type == idaapi.BWN_DISASM:
return idaapi.AST_ENABLE_FOR_FORM
return idaapi.AST_DISABLE_FOR_FORM
class Searcher(Kp_Menu_Context):
def activate(self, ctx):
self.plugin.search()
return 1
except:
pass
class GetOffsetInfo_Plugin_t(idaapi.plugin_t):
comment = "GetOffset By IBinary"
help = "todo"
wanted_name = "GetOffset"
wanted_hotkey = "ALT+/"
flags = idaapi.PLUGIN_KEEP
def init(self):
try:
print ("GetOffset By IBinary")
Searcher.register(self, "GetOffset")
except:
pass
return idaapi.PLUGIN_KEEP
def term(self):
pass
def printAvd(slef):
print (100* "-")
def formatByte(self,ea):
return " "+"{:02X}".format(idc.get_wide_byte(ea))
def calcStr(self,ea, endcount):
hstr = ""
firstByte = self.formatByte(ea)
hstr += self.formatByte(ea)
hstr = hstr + self.formatByte(ea + 1) if (firstByte == "FF" or firstByte == "66" or firstByte == "67") else hstr
#print(math.ceil(endcount - len(hstr) / 2))
hstr = hstr + math.ceil(endcount - len(hstr) / 2) * " ??" if endcount >= 2 else hstr
return hstr
def extractCode(self):
self.printAvd()
result = ""
szIdbName = idc.get_idb_path();
szIdbName = szIdbName[szIdbName.rfind("\\")+1:-4];
base = idaapi.get_imagebase();
here = idc.here();
offset = here - base;
functionName = idc.get_func_name(here);
print ("functionName %s Address:0x%x Offset:0x%x ImageBase:0x%x " % (functionName,here, offset,base))
print ("Rva = %s+0x%x x64dbgCtrl+G = %s.0+0x%x " % (szIdbName,offset,szIdbName,offset))
self.printAvd()
# print result
return result
def run(self, arg):
if (idc.BADADDR != idc.here()):
copyContent = self.extractCode();
print(copyContent)
# clipboard.copy(copyContent)
# register IDA plugin
def PLUGIN_ENTRY():
return GetOffsetInfo_Plugin_t();
最后于 2022-12-29 10:21
被TkBinary编辑
,原因: 增加X64dbg小技巧
|
能力值:
( LV12,RANK:290 )
|
-
-
3 楼
感谢分享 IDA8.2…… 我酸了
|
能力值:
( LV9,RANK:172 )
|
-
-
4 楼
x64dbg 还有一个 :#文件偏移 可以支持一下
|
能力值:
( LV17,RANK:797 )
|
-
-
5 楼
https://github.com/P4nda0s/LazyIDA 这个可以复制RVA
|
能力值:
( LV2,RANK:10 )
|
-
-
6 楼
缺8.2
|
能力值:
( LV9,RANK:195 )
|
-
-
7 楼
缺8.2
|
能力值:
( LV2,RANK:10 )
|
-
-
8 楼
GetOffset By IBinary .text:0000000182D4FE4C: Too many lines
这什么意思
|
|
|