|
|
---|---|
谢谢分享优质插件,还有论坛有人发过类似插件. 我根据它的代码改了一下. 输出更贴合自己使用.
跟你的类似. 你的可以在右键菜单提供菜单项,另一个哥们开发的直接使用快捷键即可. (我只是把输出改成更贴合自己使用的) 原始文件好像叫做 PatternGen 论坛链接:PatternGen 这个快捷键是ALT+Z 原本是一个输出特征码的插件.提取特征码. 我依据它的代码做了少许修改,可以直接获取 VA RVA X64Dbg跳转.(不输出特征码) 插件快捷键 ALT+/. 下面是我魔改过的输出, X64DBG CTRL+G 支持 模块名.0 + 偏移 方式,跟你写的XCOPY 一样, 也支持 $ 当做前缀符号跳转. 更多X64dbg小技巧可以看下我博客. X64dbg使用小技巧 希望能帮到大家. 下列是我魔改过的输出. 下列代码直接复制下来,改为`.py`后缀. 然后放到`plugin`里面即可. 快捷键 `alt+z` 兼容性 支持最新`IDA8.2` # -*- coding: utf-8 -*- import math import idaapi import idc #import clipboard try: class Kp_Menu_Context(idaapi.action_handler_t): def __init__(self): idaapi.action_handler_t.__init__(self) @classmethod def get_name(self): return self.__name__ @classmethod def get_label(self): return self.label @classmethod def register(self, plugin, label): self.plugin = plugin self.label = label instance = self() return idaapi.register_action(idaapi.action_desc_t( self.get_name(), # Name. Acts as an ID. Must be unique. instance.get_label(), # Label. That's what users see. instance # Handler. Called when activated, and for updating )) @classmethod def unregister(self): """Unregister the action. After unregistering the class cannot be used. """ idaapi.unregister_action(self.get_name()) @classmethod def activate(self, ctx): # dummy method return 1 @classmethod def update(self, ctx): if ctx.form_type == idaapi.BWN_DISASM: return idaapi.AST_ENABLE_FOR_FORM return idaapi.AST_DISABLE_FOR_FORM class Searcher(Kp_Menu_Context): def activate(self, ctx): self.plugin.search() return 1 except: pass class GetOffsetInfo_Plugin_t(idaapi.plugin_t): comment = "GetOffset By IBinary" help = "todo" wanted_name = "GetOffset" wanted_hotkey = "ALT+/" flags = idaapi.PLUGIN_KEEP def init(self): try: print ("GetOffset By IBinary") Searcher.register(self, "GetOffset") except: pass return idaapi.PLUGIN_KEEP def term(self): pass def printAvd(slef): print (100* "-") def formatByte(self,ea): return " "+"{:02X}".format(idc.get_wide_byte(ea)) def calcStr(self,ea, endcount): hstr = "" firstByte = self.formatByte(ea) hstr += self.formatByte(ea) hstr = hstr + self.formatByte(ea + 1) if (firstByte == "FF" or firstByte == "66" or firstByte == "67") else hstr #print(math.ceil(endcount - len(hstr) / 2)) hstr = hstr + math.ceil(endcount - len(hstr) / 2) * " ??" if endcount >= 2 else hstr return hstr def extractCode(self): self.printAvd() result = "" szIdbName = idc.get_idb_path(); szIdbName = szIdbName[szIdbName.rfind("\\")+1:-4]; base = idaapi.get_imagebase(); here = idc.here(); offset = here - base; functionName = idc.get_func_name(here); print ("functionName %s Address:0x%x Offset:0x%x ImageBase:0x%x " % (functionName,here, offset,base)) print ("Rva = %s+0x%x x64dbgCtrl+G = %s.0+0x%x " % (szIdbName,offset,szIdbName,offset)) self.printAvd() # print result return result def run(self, arg): if (idc.BADADDR != idc.here()): copyContent = self.extractCode(); print(copyContent) # clipboard.copy(copyContent) # register IDA plugin def PLUGIN_ENTRY(): return GetOffsetInfo_Plugin_t(); 最后于 2天前 被TkBinary编辑 ,原因: 增加X64dbg小技巧 |
|
感谢分享 |
|
x64dbg 还有一个 :#文件偏移 可以支持一下 |
|
https://github.com/P4nda0s/LazyIDA |
|
缺8.2 |
|