首页
社区
课程
招聘
问答 CTF 排行榜 知识库 工具下载 峰会 看雪商城 证书查询
  1. 社区
  2. 逆向工程
    3. 发新帖
[分享][分享]ida9.0 keypatch 插件报错修复
发表于: 2024-8-11 13:40 12942

[分享][分享]ida9.0 keypatch 插件报错修复

奋斗小菜鸟 活跃值
2024-8-11 13:40
12942

ida9.0 python api 删除了

打开ida后报错

原始代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
@staticmethod
def get_hardware_mode():
    (arch, mode) = (None, None)
 
    # heuristically detect hardware setup
    info = idaapi.get_inf_structure()
    try:
        cpuname = info.procname.lower()
    except:
        cpuname = info.procName.lower()
 
    try:
        # since IDA7 beta 3 (170724) renamed inf.mf -> is_be()/set_be()
        is_be = idaapi.cvar.inf.is_be()
    except:
        # older IDA versions
        is_be = idaapi.cvar.inf.mf
    # print("Keypatch BIG_ENDIAN = %s" %is_be)
 
    if cpuname == "metapc":
        arch = KS_ARCH_X86
        if info.is_64bit():
            mode = KS_MODE_64
        elif info.is_32bit():
            mode = KS_MODE_32
        else:
            mode = KS_MODE_16
    elif cpuname.startswith("arm"):
        # ARM or ARM64
        if info.is_64bit():
            arch = KS_ARCH_ARM64
            if is_be:
                mode = KS_MODE_BIG_ENDIAN
            else:
                mode = KS_MODE_LITTLE_ENDIAN
        else:
            arch = KS_ARCH_ARM
            # either big-endian or little-endian
            if is_be:
                mode = KS_MODE_ARM | KS_MODE_BIG_ENDIAN
            else:
                mode = KS_MODE_ARM | KS_MODE_LITTLE_ENDIAN
    elif cpuname.startswith("sparc"):
        arch = KS_ARCH_SPARC
        if info.is_64bit():
            mode = KS_MODE_SPARC64
        else:
            mode = KS_MODE_SPARC32
        if is_be:
            mode |= KS_MODE_BIG_ENDIAN
        else:
            mode |= KS_MODE_LITTLE_ENDIAN
    elif cpuname.startswith("ppc"):
        arch = KS_ARCH_PPC
        if info.is_64bit():
            mode = KS_MODE_PPC64
        else:
            mode = KS_MODE_PPC32
        if cpuname == "ppc":
            # do not support Little Endian mode for PPC
            mode += KS_MODE_BIG_ENDIAN
    elif cpuname.startswith("mips"):
        arch = KS_ARCH_MIPS
        if info.is_64bit():
            mode = KS_MODE_MIPS64
        else:
            mode = KS_MODE_MIPS32
        if is_be:
            mode |= KS_MODE_BIG_ENDIAN
        else:
            mode |= KS_MODE_LITTLE_ENDIAN
    elif cpuname.startswith("systemz") or cpuname.startswith("s390x"):
        arch = KS_ARCH_SYSTEMZ
        mode = KS_MODE_BIG_ENDIAN
 
    return (arch, mode)

修复后

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
@staticmethod
def get_hardware_mode():
    (arch, mode) = (None, None)
 
    cpuname = ida_ida.inf_get_procname().lower()
    is_be = ida_ida.inf_is_be()
    if cpuname == "metapc":
        arch = KS_ARCH_X86
        if ida_ida.inf_is_64bit():
            mode = KS_MODE_64
        elif ida_ida.inf_is_16bit():
            mode = KS_MODE_16
        else:
            mode = KS_MODE_32
    elif cpuname.startswith("arm"):
        # ARM or ARM64
        if ida_ida.inf_is_64bit():
            arch = KS_ARCH_ARM64
            if is_be:
                mode = KS_MODE_BIG_ENDIAN
            else:
                mode = KS_MODE_LITTLE_ENDIAN
        else:
            arch = KS_ARCH_ARM
            # either big-endian or little-endian
            if is_be:
                mode = KS_MODE_ARM | KS_MODE_BIG_ENDIAN
            else:
                mode = KS_MODE_ARM | KS_MODE_LITTLE_ENDIAN
    elif cpuname.startswith("sparc"):
        arch = KS_ARCH_SPARC
        if ida_ida.inf_is_64bit():
            mode = KS_MODE_SPARC64
        else:
            mode = KS_MODE_SPARC32
        if is_be:
            mode |= KS_MODE_BIG_ENDIAN
        else:
            mode |= KS_MODE_LITTLE_ENDIAN
    elif cpuname.startswith("ppc"):
        arch = KS_ARCH_PPC
        if ida_ida.inf_is_64bit():
            mode = KS_MODE_PPC64
        else:
            mode = KS_MODE_PPC32
        if cpuname == "ppc":
            # do not support Little Endian mode for PPC
            mode += KS_MODE_BIG_ENDIAN
    elif cpuname.startswith("mips"):
        arch = KS_ARCH_MIPS
        if ida_ida.inf_is_64bit():
            mode = KS_MODE_MIPS64
        else:
            mode = KS_MODE_MIPS32
        if is_be:
            mode |= KS_MODE_BIG_ENDIAN
        else:
            mode |= KS_MODE_LITTLE_ENDIAN
    elif cpuname.startswith("systemz") or cpuname.startswith("s390x"):
        arch = KS_ARCH_SYSTEMZ
        mode = KS_MODE_BIG_ENDIAN
 
    return (arch, mode)

[培训]Windows内核深度攻防：从Hook技术到Rootkit实战！

最后于 2024-8-11 13:49 被奋斗小菜鸟编辑 ，原因：
收藏
免费 ・4
支持
分享
最新回复 (7)
mb_fefksfsl
雪    币： 3239
活跃值： (3512)
能力值： ( LV3，RANK：30 )
在线值：
发帖
回帖
粉丝
私信
2 楼
edcK9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6Y4K9i4c8Z5N6h3u0Q4x3X3g2U0L8$3#2Q4x3V1k6C8k6i4W2K6N6r3!0F1k6g2)9J5k6r3g2F1k6$3W2F1k6g2)9J5c8X3E0W2P5i4m8S2N6r3y4Z5i4K6u0r3j5X3I4G2j5W2)9J5c8X3f1^5y4$3j5H3k6U0V1H3k6e0p5@1z5h3q4S2x3r3b7I4y4U0R3#2x3h3x3&6k6o6V1I4z5h3c8T1j5e0t1I4y4r3j5J5x3K6W2W2y4$3y4Q4x3V1k6C8k6i4W2H3j5i4c8U0K9q4)9J5k6i4m8&6
2024-8-11 19:05
1
zer0daysec
雪    币： 1464
活跃值： (2910)
能力值： ( LV4，RANK：51 )
在线值：
发帖
回帖
粉丝
私信
3 楼

ida_ida not defined, should replace with idaapi

@classmethod
def update(self, ctx):
    try:
        if ctx.form_type == idaapi.BWN_DISASM:
            return idaapi.AST_ENABLE_FOR_FORM
    else:
        return idaapi.AST_DISABLE_FOR_FORM
except Exception as e:
    # Add exception for main menu on >= IDA 7.0
    return idaapi.AST_ENABLE_ALWAYS
@classmethod
def update(self, ctx):
    try:
        if ctx.widget_type == idaapi.BWN_DISASM:
            return idaapi.AST_ENABLE_FOR_FORM
    else:
        return idaapi.AST_DISABLE_FOR_FORM
except Exception as e:
    # Add exception for main menu on >= IDA 7.0
    return idaapi.AST_ENABLE_ALWAYS

ctx.form_type -> ctx.widget_type

2024-8-12 18:59
0
UnicornMaker
雪    币： 2125
活跃值： (2509)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
4 楼

修改好的。

上传的附件：
2024-8-12 21:21
3
天涯过客
雪    币： 212
活跃值： (93)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
5 楼
谢谢分享。
2025-2-17 09:37
0
丁海洋
雪    币： 44
活跃值： (1422)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
6 楼
谢谢分享
2025-2-21 22:25
0
活到老也要学
雪    币： 0
能力值： ( LV1，RANK：0 )
在线值：
发帖
回帖
粉丝
私信
7 楼

不错

2025-3-20 09:10
0
shanzj
雪    币： 59
活跃值： (15)
能力值： ( LV2，RANK：10 )
在线值：
发帖
回帖
粉丝
私信
8 楼
为啥会报这个啊“undefined function __plugins__Keypatch.PLUGIN_ENTRY”
2025-5-21 00:18
0
游客
登录 | 注册 方可回帖
回帖 表情 雪币赚取及消费
高级回复
返回