IDA Pro 64bit 插件编译

今天偶尔打开一个64bit的ida数据库的时候提示什么加载插件失败。而问题的关键是自己并没有这几个64位的插件,只有32位的。其实问题也很容易就解决掉了,代码都是自己的,所以直接编译一个64位的插件就可以了。

1.配置管理器中新建一个配置,名称可以随便设置,只要能区分就可以了。

复制设置选择当前的解决方案配置。

Continue Reading

SDF Tool v1.0 (Keygenning Tool)

 SDF Tool v1.0 by Saduff
This is a keygenning tool I started coding a long time ago, but never finished it. I decided to finally finish this tool and release it, removing some of the planned features.

Features :
★32bit Calculator – Supports hex, dec, oct, bin. Functions: +, -, *, /, BSwap, Mod, RoL, RoR, And, Or, Xor, Lsh, Rsh, Not, x^2, x^3, x^y, n!.
★ As a side-feature, it’s also possible to evaluate expressions, but the expression evaluator works with floats and not 32bit Integers.
★ BigNum Calculator – Supports binary, decimal, hex. Functions: +, -, *, /, Mod, Xor, Or, And, Shl, Shr, x^y, x^-1 mod n (modular inverse), x*y mod n, x^y mod n, GCD(x, y), LCM(x, y), Prime Generation, Prime Checking.
★ Can convert between following bases: ASCII (Base-256), Hexadecimal (Base-16), Decimal (Base-10), Binary (Base-2), Base-32, Base-64, Base-85.
★ Supports following hash algorithms with possibility to change init vectors of some hashes (*) : GOST, HAVAL* (128/160/192/224/256), MD2, MD4*, MD5*, Panama, RipeMD* (128/160/256/320), Sapphire II (128/160/192/224/256/288/320), SHA-0*, SHA-1*, SHA* (256/384/512), Snefru-128 (level 8), Snefru-256 (level 8), Square*, Tiger* (128/160/192), Whirlpool-0, Whirlpool-1, Whirlpool-512, Adler-32, CRC-16, CRC-24, CRC-32, CRC-32b, CRC-64, XOR-16, XOR-32.

Continue Reading

Immunity Debugger 1.8x Wow64 Plugin v2.0.0.1

Immdbg的版本比较多,本来是想依靠版本号来进行区分的,但是发现得到的版本号都是110,这个版本号和Od1.1的版本号是一样的,后来想用CRC计算,但是这个方法就又麻烦了,于是想了一个灰常简单的办法,至于是什么就不说了。哈哈,说出来丢人,于是就兼容了一下1.8x版本,其实也就是1.83和1.85.上图是1.83的版本效果。

下图是1.83版本的效果:

如果有什么问题就吱一声吧,如果用的是1.7x版本的Immdbg,那么最简单的办法就是升级一下吧。说实话我也没有比较下每次升级都有什么区别,但是高版本的能用就用高版本的吧。

Continue Reading

Bit Detector v2.8.5.6 & ExeInfoPe v0.0.3.1

Exeinfo PE is a software that you can use to view various information on any executable file.

This product is portable, so installation is not necessary. It means that your Windows registry entries will remain intact but that you can also place the tool on a removable device and run it on any computer.

The user interface of Exeinfo PE is based on a small, standard window in which you can insert an EXE or DLL file by using the file browser or the “drag and drop” method.

So, you can view the entry point, file offset, linker information, file size, EP section, first bytes, sub-system and overlay. But you can also input HEX data to look into BIN information.

In addition, you can open a section viewer in which you can check out each virtual offset and size, RAW data offset and size, flags, name, first bytes (in HEX mode) and section status (executable, readable, writable).

Continue Reading

Immunity Debugger 1.85 Wow64 Plugin v1.0.0.1

大多数的逆向分析人士还是喜欢在XP下进行一系列的分析共做,我也是比较喜欢XP的兼容性和稳健型。但是在除此之外的时间用的基本都是Windows 7 64bit的系统,因为对于32位的XP来说,8G的内存已经成了浪费,虽然偶尔还是会切换到XP下,但是也只能识别2.3G的内存,由于平时不怎么用也就不关心这个鸟系统到底能识别多少内存了。在看雪学院有篇文章是关于如何让xp支持大内存的,但是我的测试效果是直接让膝系统分区表挂掉,于是后来也就懒得试了~

但是在Win7 64位的系统下进行调试会出现诸多的问题,比如上图就是很明显的例子,这个东西和Ollydbg 1.1遇到的状况是一样的。详细可以参考这篇文章:《OllyDbg v1.10 And Wow64》 。至于原理文章中已经解释的很清楚了,着了也就没有必要进行详细的说明了。

Continue Reading

Immunity Debugger 1.83 SDK

虽然知道ImmDbg的调试器是从OD的源代码的基础上改进来的,SDK差别也不是很大,但是从网上找了一下却始终没有找到下载的地方。直到今天下载一个Imm插件的时候从源代码里找到了1.83的SDK,当然对于最新的ImmDbg这个sdk开发的插件也是可以用的。

其实整个SDk在OD的基础上对一些函数进行了封装,如是而已,那么如果有源代码将代码从OD迁徙到Imm还是比较容易的:

////////////////////////////////////////////////////////////////////////////////
//////////////////////////// IMPORTANT INFORMATION /////////////////////////////

// 1. Export all callback functions by name, NOT by ordinal!
// 2. Force 4 byte alignment of immDbg structures!
// 3. Set default char type to unsigned!
// 4. Read documentation!

#ifndef __PLUGIN_H__
#define __PLUGIN_H__

#pragma pack(push, 4)			// Force 4 byte alignment of structures

#ifndef _CHAR_UNSIGNED		// Verify that character is unsigned
#error Please set default char type to unsigned (option /J)
#endif

#define ODBG_Plugindata      IMMDBG_Plugindata
#define ODBG_Plugininit      IMMDBG_Plugininit
#define ODBG_Pluginmainloop  IMMDBG_Pluginmainloop
#define ODBG_Pluginsaveudd   IMMDBG_Pluginsaveudd
#define ODBG_Pluginuddrecord IMMDBG_Pluginuddrecord
#define ODBG_Pluginmenu      IMMDBG_Pluginmenu
#define ODBG_Pluginaction    IMMDBG_Pluginaction
#define ODBG_Pluginshortcut  IMMDBG_Pluginshortcut
#define ODBG_Pluginreset     IMMDBG_Pluginreset
#define ODBG_Pluginclose     IMMDBG_Pluginclose
#define ODBG_Plugindestroy   IMMDBG_Plugindestroy
#define ODBG_Paused          IMMDBG_Paused
#define ODBG_Pausedex        IMMDBG_Pausedex
#define ODBG_Plugincmd       IMMDBG_Plugincmd

////////////////////////////////////////////////////////////////////////////////
Continue Reading