IDA吊炸天插件keypatch初次使用纪实录

原文网址：https://www.52pojie.cn/thread-618234-1-2.html

 

这东东是在飘云阁论坛意外发现的宝贝儿，是总舵主飘云推荐的！很多老的汇编教程中提到IDA修改时要用到WinHEX等中再去计算偏移地址再去修改一次代码，那样实在的大大地麻烦和繁琐，有了这个神器不就能一次到位了？！所以一定要研究明白了，才更易于少走弯路~~
看有人跟贴说这玩意不会用，或者是修改后的文件没有效果
本人于是也下载一个试用了下，效果是蛮好的推荐给大家来个示范好了。


1.偶测试用的IDA 6.8（就是论坛下载的那个绿色的哟）
 
2.python其实系统中已经安好了，目录中有一个 E:\IDA_Pro_v6.8\python-2.7.6.msi  这东西直接无视安装吧~~ （可能是H老大打包时附带好的那个吧）
3.下载安装keystone

https://github.com/keystone-engine/keystone/releases/download/0.9.1/keystone-0.9.1-python-win32.msi
https://github.com/keystone-engi ... .1-python-win64.msi
我的系统是Win7X64 所以安的这个，怕不正常运行就两个全装！反正装错了也不打你们！

接下来把这个https://github.com/keystone-engi ... /master/keypatch.py扔到 E:\IDA_Pro_v6.8\plugins （这是我的）

4.下面开始试用和模仿测试到底能不能直接patch文件？
 
要破解的是个小日本的小游戏！这是未注册之前的样子。
因为以前分析过了，只要 0042AA98:  7405  je 0042AA9Fh   ===>NOP  就是注册版本的了
我们来用IDA这个新的 补丁插件 来搞次实验下吧。
把主程序拖入IDA，来到图中所示的这个地方（敲g 0042AA98 回车就到了）
 

然后我们选择 这个菜单
 
看到没？跟飘云阁老大提供的那个截图 以及

https://github.com/keystone-engine/keypatch/blob/master/Keypatch-slides.pdf 老外的那个教程中的是不太一样的

 用这个
或者 
 
这个
或者
 汇编

之后别忘了选择
 
来保存下
 
建议选择 【创建备份】
 






最后是测试用到的破解前的源游戏作为大家实验素材吧。
 原版MageBros.rar (2.65 MB, 下载次数: 98) 




Plugins

• 3DSX Loader: IDA PRO Loader for 3DSX files
• Adobe Flash disassembler: The 2 plugins present in this archive will enable IDA to parse SWF files, load all SWF tags as segments for fast search and retrieval, parse all tags that can potentially contain ActionScript2 code, discover all such code(a dedicated processor module has been written for it) and even name the event functions acording to event handled in it (eg. OnInitialize). Download
• Android Debugging: This version have both support for native arm debugging via usb and sdk ADV manager.
• Android Scripts Collection: Collection of Android reverse engineering scripts that make my life easier
• AutoRE: Auto-renaming plugin with tagging support.
• BinAuthor: Match an author to an unknown binary.
• BinClone: BinClone: detecting code clones in malware [SERE 2014]
• BinNavi: BinNavi is a binary analysis IDE - an environment that allows users to inspect, navigate, edit, and annotate control-flow-graphs of disassembled code, do the same for the callgraph of the executable, collect and combine execution traces, and generally keep track of analysis results among a group of analysts.
• Bin Sourcerer: BinSourcerer (a.k.a RE-Source Online) is an assembly to source code matching framework for binary auditing and malware analysis.
• Bootroom Analysis Library: IBAL is the IDA Pro Bootrom Analysis Library, which contains a number of useful functions for analyzing embedded ROMs.
• Bosch ME7: Siemens Bosch ME7.x Disassembler Helper for IDA Pro
• CGEN: CGEN with support for generating IDA Pro IDP modules.
• Class Informer: Scans an MSVC 32bit target IDB for vftables with C++ RTTI, and MFC RTCI type data. Places structure defs, names, labels, and comments to make more sense of class vftables ("Virtual Function Table") and make them read easier as an aid to reverse engineering. Creates a list window with found vftables for browsing.
• c0demap: Codemap is a binary analysis tool for "run-trace visualization" provided as IDA plugin.
• collabREate: collabREate is a plugin for IDA Pro that is designed to provide a collaborative reverse engineering capability for multiple IDA users working on the same binary file.
• Crowd Detox: The CrowdDetox plugin for Hex-Rays automatically removes junk code and variables from Hex-Rays function decompilations.
• Dalvik Header: This is a simple Dalvik header plugin for IDA Pro
• Data Xref Counter: Enumerates all of the the x-references in a specific segment and counts the frequency of usage. The plugin displays the data in QtTableWidget and lets the user filter and sort the references. You can also export the data to a CSV file.
• Debugger: Debugger plugin for IDA Pro backed by the Unicorn Engine
• Diaphora: Diaphora (διαφορά, Greek for 'difference') is a program diffing plugin for IDA Pro, similar to Zynamics Bindiff or the FOSS counterparts DarunGrim, TurboDiff, etc... It was released during SyScan 2015.
• Docker IDA: Run IDA Pro disassembler in Docker containers for automating, scaling and distributing the use of IDAPython scripts.
• DOXBox Debugger: Eric Fry's IDA/DOSBox debugger plugin
• DriverBuddy: DriverBuddy is an IDA Python script to assist with the reverse engineering of Windows kernel drivers.
• DWARF Plugin: IDADWARF is an IDA plugin that imports DWARF debugging symbols into an IDA database. Download
• Dynamic IDA Enrichment: DIE is an IDA python plugin designed to enrich IDA`s static analysis with dynamic data. This is done using the IDA Debugger API, by placing breakpoints in key locations and saving the current system context once those breakpoints are hit.
• EFI Scripts: Some IDA scripts and tools to assist with reverse engineering EFI executables.
• EtherAnnotate: Parses the specialized instruction trace files that are generated using the EtherAnnotate Xen modification (http://github.com/inositle/etherannotate_xen). From the instruction trace, register values and code coverage of the run-time information are visualized in IDA Pro through instruction comments and line colorations.
• Extract Macho-O: This is a very simple IDA plugin to extract all Mach-O binaries contained anywhere in the disassembly.
• FCatalog: FCatalog (The functions catalog) is a mechanism for finding similarities between different binary blobs in an efficient manner. It is mostly useful for identifying a new binary blob is somewhat similar to a binary blob that have been encountered before. The client side of FCatalog is an IDA plugin that allows a group of reverse engineers to manage a pool of reversed functions. Whenever a new binary function is encountered, FCatalog can compare it to all the known and previously reversed binary functions.
• Flare Plugins: Shellcode Hashes, Struct Typer, StackStrings, MSDN Annotations, ApplyCalleType
• FLS Loader: IDA Pro loader module for IFX iPhone baseband firmwares. Based on a universal scatter loader script by roxfan.
• Frida: This is plugin for ida pro thar uses the Frida api. Mainly trace functions.
• FRIEND: Flexible Register/Instruction Extender aNd Documentation. FRIEND is an IDA plugin created to improve disassembly and bring register/instruction documentation right into IDA View.
• Funcap: This script records function calls (and returns) across an executable using IDA debugger API, along with all the arguments passed. It dumps the info to a text file, and also inserts it into IDA's inline comments. This way, static analysis that usually follows the behavioral runtime analysis when analyzing malware, can be directly fed with runtime info such as decrypted strings returned in function's arguments.
• Function Tagger: This IDAPython script tags subroutines according to their use of imported functions
• Gamecube Extension: This is a Gekko CPU Paired Single extension instructions plug-in for IDA Pro 5.2
• Gamecube DSP: This project adds support for the DSP present in the Gamecube and the Wii to IDA, the Interactive Disassembler [1]. This allows easy analyze of a DSP ucode, handling cross-references, control flow, and so on.
• Gensida: IDA debugger plugin for Sega Genesis / Megadrive ROMs based on Gens ReRecordings emulator modifications.
• Graph Slick: Automated detection of inlined functions. It highlights similar groups of nodes and allows you to group them, simplifying complex functions. The authors provide an accompanying presentation which explains the algorithms behind the plugin and shows sample use cases.
• HexRays CodeXplorer: The Hex-Rays Decompiler plugin for better code navigation in RE process. CodeXplorer automates code REconstruction of C++ applications or modern malware like Stuxnet, Flame, Equation, Animal Farm ...
• HexRays Tools:
  • Assist in creation of new structure definitions / virtual calls detection
  • Jump directly to virtual function or structure member definition
  • Gives list of structures with given size, with given offset
  • Finds structures with same "shape" as is used.
  • convert function to __usercall or __userpurge
  • and more....
• HexRaysPyTools: Plugin assists in creation classes/structures and detection virtual tables. Best to use with Class Informer plugin, because it helps to automatically get original classes names.
• HRDEV: This is an IDA Pro Python plugin to make Hex-Rays Decompiler output bit more attractive. HRDEV plugin retrieves standard decompiler output, parses it with Python Clang bindings, does some magic, and puts back.
• IDA2SQL: As the name implies this plugin can be used to export information from IDA databases to SQL databases. This allows for further analysis of the collected data: statstical analysis, building graphs, finding similarities between programs, etc.
• IDA C#: Scripting IDA with C#
• IDA Compare: IDA disassembly level diffing tool, find patches and modifications between malware variants. See mydoom A/B sample database and video trainer for usage.
• IDA Emu: idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro. it is base on unicorn-engine.
• IDA Eye: Plugin that enables you to perform different operations at the mnemonic level, independent of any particular processor type. These operations are facilitated through a parameterized template, which include the capabilities to de/highlight instructions, gather statistical information about the frequency of each instruction, and search for sequences of mnemonics, among other features.
• IDA Extrapass: An IDA Pro Win32 target clean up plug-in by Sirmabus. It does essentially four cleaning/fixing steps: Convert stray code section values to "unknown", fix missing "align" blocks, fix missing code bytes, and locate and fix missing/undefined functions.
• IDA Images: Image preview plugin for IDA disassembler.
• IDA IPython: This is a plugin to embed an IPython kernel in IDA Pro. The Python ecosystem has amazing libraries (and communities) for scientific computing. IPython itself is great for exploratory data analysis. Using tools such as the IPython notebook make it easy to share code and explanations with rich media. IPython makes using IDAPython and interacting with IDA programmatically really fun and easy.
• IDA Patchwork: Stitching against malware families with IDA Pro (tool for the talk at Spring9, https://spring2014.gdata.de/spring2014/programm.html). In essence, I use a somewhat fixed / refurbished version of PyEmu along IDA to demonstrate deobfuscation of the different patterns found in the malware family Nymaim.
• IDA Ref: IDA Pro Full Instruction Reference Plugin - It's like auto-comments but useful.
• IDA Rest: A simple REST-like API for basic interoperability with IDA Pro.
• IDA Scope: IDAscope is an IDA Pro extension with the goal to ease the task of (malware) reverse engineering with a current focus on x86 Windows. It consists of multiple tabs, containing functionality to achieve different goals such as fast identification of semantically interesting locations in the analysis target, seamless access to MSDN documentation of Windows API, and finding of potential crypto/compression algorithms.
• IDA Signature Matching Tool: Tool for searching signatures inside files, extremely useful as help in reversing jobs like figuring or having an initial idea of what encryption/compression algorithm is used for a proprietary protocol or file. It can recognize tons of compression, multimedia and encryption algorithms and many other things like known strings and anti-debugging code which can be also manually added since it's all based on a text signature file read at run-time and easy to modify.
• IDA Skins: Plugin providing advanced skinning support for the Qt version of IDA Pro utilizing Qt stylesheets, similar to CSS.
• IDA Sploiter: IDA Sploiter is a plugin for Hex-Ray's IDA Pro disassembler designed to enhance IDA's capabilities as an exploit development and vulnerability research tool. Some of the plugin's features include a powerful ROP gadgets search engine, semantic gadget analysis and filtering, interactive ROP chain builder, stack pivot analysis, writable function pointer search, cyclic memory pattern generation and offset analysis, detection of bad characters and memory holes, and many others.
• IDA Stealth: IDAStealth is a plugin which aims to hide the IDA debugger from most common anti-debugging techniques. The plugin is composed of two files, the plugin itself and a dll which is injected into the debuggee as soon as the debugger attaches to the process. The injected dll actually implements most of the stealth techniques either by hooking system calls or by patching some flags in the remote process.
• IDA Toolbag: The IDA Toolbag plugin provides many handy features, such as:
  • A 'History' view, that displays functions in the disassembly that you have decided are important, and the relationships between them.
  • A code path-searching tool, that lets you find what functions (or blocks) are forming a path between two locations.
  • Manage and run your IDC/Python scripts
  • Something that's also of considerable importance is that the IDA Toolbag lets you collaborate with other IDA users: one can publish his 'History', or import another user's history & even merge them!
  • See the official documentation for an extensive feature list.
• IdaVSHelp: IDAPython plugin to integrate Visual Studio Help Viewer in IDA Pro >= 6.8
• IDAtropy: IDAtropy is a plugin for Hex-Ray's IDA Pro designed to generate charts of entropy and histograms using the power of idapython and matplotlib.
• IDA Xtensa: This is a processor plugin for IDA, to support the Xtensa core found in Espressif ESP8266. It does not support other configurations of the Xtensa architecture, but that is probably (hopefully) easy to implement.
• idb2pat: IDB to Pat.
• IFL: Interactive Functions List is an user-friendly way to navigate between functions and their references.
• ioctl_plugin: A tool to help when dealing with IOCTL codes and Windows driver IOCTL dispatch functions.
• Kam1n0: Kam1n0 is a scalable system that supports assembly code clone search. It allows a user to first index a (large) collection of binaries, and then search for the code clones of a given target function or binary file. Kam1n0 tries to solve the efficient subgraph search problem (i.e. graph isomorphism problem) for assembly functions.
• Keypatch: A multi-architeture assembler for IDA. Keypatch allows you enter assembly instructions to directly patch the binary under analysis. Powered by Keystone engine.
• Labeless: Labeless is a plugin system for dynamic, seamless and realtime synchronization between IDA Database and Olly. Labels, function names and global variables synchronization is supported. Labeless provides easy to use dynamic dumping tool, which supports automatic on-the-fly imports fixing as well as convenient tool for IDA-Olly Python scripting synergy.
• LazyIDA: LazyIDA lets you perform many tasks simply and quickly (e.g., remove function return type in Hex-Rays, convert data into different formats, scan for format string vulnerabilities and a variety of shortcuts)
• Lighthouse: Lighthouse is a Code Coverage Plugin for IDA Pro. The plugin leverages IDA as a platform to map, explore, and visualize externally collected code coverage data when symbols or source may not be available for a given binary.
• MSDN Helper: This tool will help you to get to Offline MSDN help while using IDA Pro.
• MyNav: MyNav is a plugin for IDA Pro to help reverse engineers in the most typical task like discovering what functions are responsible of some specifical tasks, finding paths between "interesting" functions and data entry points.
• nao: nao(no-meaning assembly omiter) is dead code eliminator plugin for IDA pro
• NES Loader: Nintendo Entertainment System (NES) ROM loader module for IDA Pro.
• NSIS Reversing Suite: NRS is a set of Python librairies used to unpack and analysis NSIS installer's data. It also feature an IDA plugin used to disassembly the NSIS Script of an installer.
• Optimice: This plugin enables you to remove some common obfuscations and rewrite code to a new segment. Currently supported optimizations are: Dead code removal, JMP merging, JCC opaque predicate removal, Pattern based deobfuscations
• Patcher: IDA Patcher is a plugin for Hex-Ray's IDA Pro disassembler designed to enhance IDA's ability to patch binary files and memory.
• Plus22: Plus22 transforms x86_64 executables to be processed with 32-bit version of Hex-Rays Decompiler.
• Plympton: A gem to read program disassembly from a YAML dump. The YAML dump is generated from an IDA Pro python script. This script is included along with this Gem (func.py)
• Pomidor: IDA Pomidor is a plugin for Hex-Ray's IDA Pro disassembler that will help you retain concentration and productivity during long reversing sessions.
• Ponce: Taint analysis and symbolic execution over binaries in an easy and intuitive fashion.
• Prefix: Prefix is a small function prefixing plugin for IDA Pro. The plugin augments IDA's function renaming capabilities by adding a handful of convenient prefixing actions to relevant right click menus.
• Qualcomm Loader: IDA loader plugin for Qualcomm Bootloader Stages
• qb-sync: qb-sync is an open source tool to add some helpful glue between IDA Pro and Windbg. Its core feature is to dynamically synchronize IDA's graph windows with Windbg's position.
• Recompiler: IDA recompiler
• REProgram: A way of making almost-arbitrary changes to an executable when run under a debugger -- even changes that don't fit.
• ret-sync: ret-sync stands for Reverse-Engineering Tools synchronization. It's a set of plugins that help to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA disassembler. The underlying idea is simple: take the best from both worlds (static and dynamic analysis).
• REtypedef: REtypedef is an IDA PRO plugin that allows defining custom substitutions for function names. It comes with a default ruleset providing substitutions for many common STL types.
• Samsung S4 Rom Loader: IDA Pro Loader Plugin for Samsung Galaxy S4 ROMs
• Sark: Sark, (named after the notorious Tron villain,) is an object-oriented scripting layer written on top of IDAPython. Sark is easy to use and provides tools for writing advanced scripts and plugins.
• ScratchABit: ScratchABit is an interactive incremental disassembler with data/control flow analysis capabilities. ScratchABit is dedicated to the efforts of the OpenSource reverse engineering community (reverse engineering to produce OpenSource drivers/firmware for hardware not properly supported by vendors).
• Sega Genesis/Megadrive Tools: Special IDA Pro tools for the Sega Genesis/Megadrive romhackers. Tested work on v5.2, v6.6. Should work on other versions.
• Sig Maker: Can create sigs automatically and has a wide variety of functions (might be unstable on IDA 6.2).
• Simulator: IDASimulator is a plugin that extends IDA's conditional breakpoint support, making it easy to augment / replace complex executable code inside a debugged process with Python code.
• Snippt Detector: Snippet Detector is an IDA Python scripts project used to detect snippets from 32bit disassembled files. snippet is the word used to identify a generic sequence of instructions (at the moment a snippet is indeed a defined function). The aim of the tool is to collect many disassembled snippets inside a database for the detection process.
• Snowman Decompiler: Snowman is a native code to C/C++ decompiler. Standalone and IDA Plugin. Source Code
• Splode: Augmenting Static Reverse Engineering with Dynamic Analysis and Instrumentation
• spu3dbg: Ida Pro debugger module for the anergistic SPU emulator.
• Stingray: Stingray is an IDAPython plugin for finding function strings. The search is from the current position onwards in the current function. It can do it recursively also with configurable search depth. The results order is the natural order of strings in the BFS search graph.
• Styler: Small Plugin to change the style off Ida Pro
• Synergy: A combination of an IDAPython Plugin and a control version system that result in a new reverse engineering collaborative addon for IDA Pro. By http://cubicalabs.com/
• Tarkus: Tarkus is a plugin manager for IDA Pro, modelled after Python's pip.
• TurboDiff: Turbodiff is a binary diffing tool developed as an IDA plugin. It discovers and analyzes differences between the functions of two binaries.
• VirusBattle: The plugin is an integration of Virus Battle API to the well known IDA Disassembler. Virusbattle is a web service that analyses malware and other binaries with a variety of advanced static and dynamic analyses.
• VMAttack: Static and dynamic virtualization-based packed analysis and deobfuscation.
• Win32 LST to Inline Assembly: Python script which extracts procedures from IDA Win32 LST files and converts them to correctly dynamically linked compilable Visual C++ inline assembly.
• WinIOCtlDecoder: An IDA Pro plugin which decodes a Windows Device I/O control code into DeviceType, FunctionCode, AccessType and MethodType.
• Xex Loader for IDA 6.6: This adds the ability to load xex files into IDA directly without having to first process them in any way. It processes the xex file as much as possible while loading to minimise the work required by the user to get it to a state fit for reversing.
• X86Emu: Its purpose is to allow a reverse engineer the chance to step through x86 code while reverse engineering a binary. The plugin can help you step through any x86 binary from any platform. For Windows binaries, many common library calls are trapped and emulated by the emulator, allowing for a higher fidelity emulation. I find it particularly useful for stepping through obfuscated code as it automatically reorganizes an IDA disassembly based on actual code paths.
• YaCo : Collaboration Plugin : when enabled, an unlimited number of users can work simultaneously on the same binary. Any modification done by any user is synchronized through git version control. It has been initially released at SSTIC 2017
• Zynamics BinDiff: BinDiff is a comparison tool for binary files, that assists vulnerability researchers and engineers to quickly find differences and similarities in disassembled code.

 

@tt521
试了下，6.6不能用，请问能否把你的6.8共享一下，谢谢了。

看来这位同学是位盲人朋友，说过了https://down.52pojie.cn/Tools/Disassemblers/ 里边找~~

 

@寒枫雨雪
原来IDA需要装插件才能改内容。

一个上万美元的软件本来就该能实现如此简单务实的需求啊。

 

Hmily
Keypatch is a IDA Pro plugin for Keystone Assembler Engine
http://www.52pojie.cn/thread-524841-1-1.html
(出处: 吾爱破解论坛)

这个神器论坛很早就有发布了，ida里用来patch文件必备。
点评

冥界3大法王
可是教程资料太少了，再有只有自己深入实践自己做到了，才是真正的学会并掌握，否则全是人家的知识。OD的那个hit trace功能，搜索下就真没人发表过贴子的。再好的功能没多少人知道和理解也是暴殄天物啊。

最后感谢 @whyida @some 第102 103楼
两位对此文章的纠错！确实写错了~~ 另外还请 @@风吹屁屁凉
大侠指向如何汉化该插件中文不乱码的问题。