ida python 插件编写

一.第一步

这个是抄的

天下代码一般抄，自己从零开始写并不会

源代码是这样（pyhexraysdeob.py）,一个反混淆插件

import os

import ida_idaapi
import ida_loader
import ida_kernwin
import ida_hexrays

my_dirname, _ = os.path.split(__file__)

setattr(ida_hexrays, "MMAT_DEOB_MAP", getattr(ida_hexrays, "MMAT_LOCOPT"))

class pyhexraysdeob_t(ida_idaapi.plugin_t):
    flags = 0
    comment = "Show microcode"
    help = ""
    wanted_name = "Python Microcode explorer (pyhexraysdeob)"
    wanted_hotkey = ""

    def __init__(self):
        print("start")
        self.black_list = []
        self.white_list = []
        self.activated = False

    def toggle_activated(self):
        if not self.activated:
            # Install our block and instruction optimization classes.
            import pattern_deobfuscate
            self.oco = pattern_deobfuscate.obf_compiler_optimizer_t()
            self.oco.install()
            import unflattener
            self.cfu = unflattener.cf_unflattener_t(self)
            self.cfu.install()
        else:
            # Uninstall our block and instruction optimization classes.
            self.oco.remove()
            self.oco = None
            self.cfu.remove()
            self.cfu = None
        self.activated = not self.activated
        print("%s is now %sactivated" % (self.wanted_name, "" if self.activated else "de-"))

    def init(self):
        if not ida_hexrays.init_hexrays_plugin():
            print("pyhexraysdeob: no decompiler, skipping")
            return ida_idaapi.PLUGIN_SKIP
        print("Hex-rays version %s has been detected, %s ready to use" % (
            ida_hexrays.get_hexrays_version(),
            self.wanted_name))

        import sys
        modules_path = os.path.join(my_dirname, "pyhexraysdeob_modules")
        if not modules_path in sys.path:
            sys.path.append(modules_path)

        return ida_idaapi.PLUGIN_OK

    def run(self, arg):
        if arg == 0:
            self.toggle_activated()
        elif arg == 0xbeef:
            self.flags |= ida_loader.PLUGIN_UNL
        elif arg == 2:
            fix_calls_to_alloca_probe() # unimp
        elif arg == 3:
            show_microcode_explorer() # unimp
        return True

    def term(self):
        if self.activated:
            self.toggle_activated()

def PLUGIN_ENTRY():
    return pyhexraysdeob_t()
PLUGIN_ENTRY()

下面把该删除的删除，该改的改，就成了下面这样

import os

import ida_idaapi
import ida_loader
import ida_kernwin
import ida_hexrays

my_dirname, _ = os.path.split(__file__)

#setattr(ida_hexrays, "MMAT_DEOB_MAP", getattr(ida_hexrays, "MMAT_LOCOPT"))

class MiasmPluginT(ida_idaapi.plugin_t):
    flags = 0
    comment = "This is miasm plugin"
    help = ""
    wanted_name = "Python Miasm Plugin"
    wanted_hotkey = ""

    def __init__(self):
        print("start")
        self.activated = False

    def toggle_activated(self):
        if not self.activated:
            # Install our block and instruction optimization classes.
            import center
            center.choose_exec()
        print("%s is now %sactivated" % (self.wanted_name, "" if self.activated else "de-"))

    def init(self):
        if not ida_hexrays.init_hexrays_plugin():
            print("MiasmPlugin: no decompiler, skipping")
            return ida_idaapi.PLUGIN_SKIP
        print("Hex-rays version %s has been detected, %s ready to use" % (
            ida_hexrays.get_hexrays_version(),
            self.wanted_name))

        import sys
        modules_path = os.path.join(my_dirname, "miasm_modules")
        if not modules_path in sys.path:
            sys.path.append(modules_path)

        return ida_idaapi.PLUGIN_OK

    def run(self, arg):
        if arg == 0:
            self.toggle_activated()
        return True

    def term(self):
        if self.activated:
            self.toggle_activated()

def PLUGIN_ENTRY():
    return MiasmPluginT()
PLUGIN_ENTRY()

然后在模块中添加一个center.py 用来控制选用启动的插件

import graph_ir
import depgraph
import symbol_exec_module
import ida_kernwin as kw
def ask_desired_maturity():
	"""Displays a dialog which lets the user choose a maturity level
	of the microcode to generate."""
	choose_num = [
	["graph_ir", 0],
	["symbol_exec", 1],
	["depgraph",2]]

	class MaturityForm(kw.Form):
		def __init__(self):
			self.title = "Choose exec"
			form = ("STARTITEM {id:mat_lvl}\n"
				"%s\n"
				" \n"
				"\n\n"
				"<##Options##Output includes comments:{flags_short}>{chkgroup_flags}>\n\n" %
				self.title)

			dropdown_ctl = kw.Form.DropdownListControl(
				[text for text, _ in choose_num])
			chk_ctl = kw.Form.ChkGroupControl(("flags_short",))

			controls = {"mat_lvl": dropdown_ctl,
			"chkgroup_flags": chk_ctl}

			kw.Form.__init__(self, form, controls)

	form = MaturityForm()
	form, args = form.Compile()
	form.flags_short.checked = True
	ok = form.Execute()

	choose = None
	text = None
	flags = 0
	if ok == 1:
		text, choose = choose_num[form.mat_lvl.value]
	form.Free()
	return (text, choose, flags)
	
def choose_exec():
	text, choose_num,flags = ask_desired_maturity()
	if text is None and choose_num is None:
		return (True, "Cancelled")
	if choose_num==0:
		graph_ir.function_graph_ir()
	elif choose_num==1:
		symbol_exec_module.symbolic_exec()
	else:
		depgraph.launch_depgraph()

项目地址：

https://github.com/0x1shyboy1/MiasmPlugin(项目已更新，可能与上述存在差异)