• XSS.stack #1 – первый литературный журнал от юзеров форума

IDA PRO, плагины, подсказки и решение проблем

Отслеживать
Пожалуйста, обратите внимание, что пользователь заблокирован
0way сказал(а):
есть ссылка?
https://xss.pro/threads/22091/post-648005

Это инсталлятор без пароля.
 
Пожалуйста, обратите внимание, что пользователь заблокирован
varwar сказал(а):
https://xss.pro/threads/22091/post-648005

Это инсталлятор без пароля.
Он тоже с паролем
 
Последнее редактирование:
varwar сказал(а):
Господа, столкнулся с проблемой idaclang77.

Решил создать библиотеку типов для WDK 10 (x64). В IDA Pro 7.7. предустановлена версия WDK 8, но с тех пор много было добавлено. Пользовался этим мануалом.

Ранее делал библиотеку из wdm.h, ntddk.h, в итоге получился такой объем информации:

Total 2985 symbols, 3079 types, 9330 macros .

Этого явно недостаточно, для сравнения встроенная в IDA библиотека WDK 8 содержит.

Total 45344 symbols, 23850 types, 40624 macros.

Что было сделано? Для начала спарсил петухоном имена файлов отсюда - C:\\Program Files (x86)\\Windows Kits\\10\Include\\10.0.22621.0\\km

Python: 
import os

inc_open = '#include "'
inc_close = '"'

def get_paths():
    root = "C:\\Program Files (x86)\\Windows Kits\\10\Include\\10.0.22621.0\\km"
    paths = []
    for root, subdirs, files in os.walk(root):
        for name in files:
            if name.endswith(".h"):
                paths.append(os.path.join(root, name))
    return paths

def main():
    paths = get_paths()
    for filename in paths:
        filename = filename.removeprefix("C:\\Program Files (x86)\\Windows Kits\\10\Include\\10.0.22621.0\\km\\")
        print(inc_open + filename + inc_close)
 
main()

Получил готовый заголовочный файл для дальнейшего парсинга idaclang'ом.
#include "1394.h"
#include "61883.h"
#include "a2dpsidebandaudio.h"
#include "acpitabl.h"
#include "amtvuids.h"
#include "ata.h"
#include "atm.h"
#include "aux_klib.h"
#include "avc.h"
#include "avcstrm.h"
#include "backpack.h"
#include "bdasup.h"
#include "BluetoothLEAudioStreaming.h"
#include "bthddi.h"
#include "bthguid.h"
#include "bthhfpddi.h"
#include "bthsdpddi.h"
#include "bthxddi.h"
#include "buffring.h"
#include "charging.h"
#include "cifs.h"
#include "classpnp.h"
#include "d4drvif.h"
#include "d4iface.h"
#include "dderror.h"
#include "dispmprt.h"
#include "dmusicks.h"
#include "dmusprop.h"
#include "dot11wdi.h"
#include "dot11wificxintf.h"
#include "drmk.h"
#include "dsm.h"
#include "eventdetectoroemadapter.h"
#include "fcb.h"
#include "fcbtable.h"
#include "fltKernel.h"
#include "fltsafe.h"
#include "fwpmk.h"
#include "fwpsk.h"
#include "gpioclx.h"
#include "hbapiwmi.h"
#include "hdaudio.h"
#include "hidpddi.h"
#include "hidport.h"
#include "hpmi.h"
#include "hubbusif.h"
#include "hwnclx.h"
#include "ioaccess.h"
#include "iointex.h"
#include "ip6firewall.h"
#include "ipfirewall.h"
#include "ipinfo.h"
#include "irb.h"
#include "irclass_ioctl.h"
#include "iscsicfg.h"
#include "iscsidef.h"
#include "iscsifnd.h"
#include "iscsilog.h"
#include "iscsimgt.h"
#include "iscsiop.h"
#include "iscsiprf.h"
#include "kbdmou.h"
#include "kcom.h"
#include "keyworddetectoroemadapter.h"
#include "KNetPwrDepBroker.h"
#include "ksdebug.h"
#include "ksi.h"
#include "kusbfn.h"
#include "kusbfnclasslib.h"
#include "lkmdtel.h"
#include "lowio.h"
#include "mcd.h"
#include "mce.h"
#include "mf.h"
#include "midatlax.h"
#include "miniport.h"
#include "minitape.h"
#include "mountdev.h"
#include "mountmgr.h"
#include "mpiodisk.h"
#include "mpiowmi.h"
#include "mrx.h"
#include "mrxfcb.h"
#include "msviddrv.h"
#include "namcache.h"
#include "ndis.h"
#include "ndischimney.h"
#include "ndisNDK.h"
#include "ndistapi.h"
#include "ndiswan.h"
#include "ndiswwan.h"
#include "ndkpi.h"
#include "ndkrss.h"
#include "netdma.h"
#include "netioddk.h"
#include "netpnp.h"
#include "nodetype.h"
#include "npivwmi.h"
#include "ntagp.h"
#include "ntdd8042.h"
#include "ntdddump.h"
#include "ntddk.h"
#include "ntddnlb.h"
#include "ntddpcm.h"
#include "ntddsd.h"
#include "ntddsfio.h"
#include "ntddsysenv.h"
#include "nthalext.h"
#include "ntifs.h"
#include "ntimage.h"
#include "ntintsafe.h"
#include "ntnls.h"
#include "ntpoapi.h"
#include "ntrxdef.h"
#include "ntstrsafe.h"
#include "offreg.h"
#include "oprghdlr.h"
#include "parallel.h"
#include "pcivirt.h"
#include "pepevents.h"
#include "pepfx.h"
#include "pep_x.h"
#include "pfhook.h"
#include "pmi.h"
#include "portcls.h"
#include "prefix.h"
#include "procgrp.h"
#include "psci.h"
#include "ptpusd.h"
#include "punknown.h"
#include "pwmutil.h"
#include "rx.h"
#include "rxce.h"
#include "rxcehdlr.h"
#include "rxcontx.h"
#include "rxdata.h"
#include "rxexcept.h"
#include "rxlog.h"
#include "rxovride.h"
#include "rxpooltg.h"
#include "rxprocs.h"
#include "rxstruc.h"
#include "rxtimer.h"
#include "rxtrace.h"
#include "rxtypes.h"
#include "rxworkq.h"
#include "scavengr.h"
#include "scsiwmi.h"
#include "scutil.h"
#include "SDCAStreaming.h"
#include "SdcaXu.h"
#include "sddef.h"
#include "sdplib.h"
#include "sdpnode.h"
#include "sdport.h"
#include "sffdisk.h"
#include "sffprtcl.h"
#include "sidebandaudio.h"
#include "smclib.h"
#include "smcnt.h"
#include "SoundWireController.h"
#include "srbhelper.h"
#include "stdunk.h"
#include "storduid.h"
#include "storport.h"
#include "storswtr.h"
#include "stortrce.h"
#include "strmini.h"
#include "struchdr.h"
#include "swenum.h"
#include "systemrng.h"
#include "tdikrnl.h"
#include "tdistat.h"
#include "test.h"
#include "treeinlinecryptoservice.h"
#include "treerpmbservice.h"
#include "treetpmservice.h"
#include "treevariableservice.h"
#include "trustedruntimeclx.h"
#include "uart.h"
#include "ufxproprietarycharger.h"
#include "unknown.h"
#include "upssvc.h"
#include "usbbusif.h"
#include "usbcamdi.h"
#include "usbctypes.h"
#include "usbdlib.h"
#include "usbdrivr.h"
#include "usbfnattach.h"
#include "usbfnioctl.h"
#include "usbkern.h"
#include "usbpmapi.h"
#include "usbsidebandaudio.h"
#include "usbstorioctl.h"
#include "video.h"
#include "videoagp.h"
#include "vmbuskernelmodeclientlibapi.h"
#include "vpci.h"
#include "wdm.h"
#include "wdmsec.h"
#include "wdmwarn4.h"
#include "wheaevents.h"
#include "wmidata.h"
#include "wmiguid.h"
#include "wmilib.h"
#include "wpmbbextensiondef.h"
#include "wpprecorder.h"
#include "wsk.h"
#include "wskndk.h"
#include "wwan.h"
#include "xfilter.h"
#include "acx\km\1.0\acx.h"
#include "acx\km\1.0\acxcircuit.h"
#include "acx\km\1.0\acxdataformat.h"
#include "acx\km\1.0\acxdevice.h"
#include "acx\km\1.0\acxdriver.h"
#include "acx\km\1.0\acxelements.h"
#include "acx\km\1.0\acxevents.h"
#include "acx\km\1.0\acxfuncenum.h"
#include "acx\km\1.0\acxglobals.h"
#include "acx\km\1.0\acxmanager.h"
#include "acx\km\1.0\acxmisc.h"
#include "acx\km\1.0\acxpin.h"
#include "acx\km\1.0\acxrequest.h"
#include "acx\km\1.0\acxstreams.h"
#include "acx\km\1.0\acxtargets.h"
#include "acx\km\1.0\acxtraceenums.h"
#include "acx\km\1.0\acxtypes.h"
#include "acx\km\1.1\acx.h"
#include "acx\km\1.1\acxcircuit.h"
#include "acx\km\1.1\acxdataformat.h"
#include "acx\km\1.1\acxdevice.h"
#include "acx\km\1.1\acxdriver.h"
#include "acx\km\1.1\acxelements.h"
#include "acx\km\1.1\acxevents.h"
#include "acx\km\1.1\acxfuncenum.h"
#include "acx\km\1.1\acxglobals.h"
#include "acx\km\1.1\acxmanager.h"
#include "acx\km\1.1\acxmisc.h"
#include "acx\km\1.1\acxpin.h"
#include "acx\km\1.1\acxrequest.h"
#include "acx\km\1.1\acxstreams.h"
#include "acx\km\1.1\acxtargets.h"
#include "acx\km\1.1\acxtraceenums.h"
#include "acx\km\1.1\acxtypes.h"
#include "crt\ammintrin.h"
#include "crt\arm64intr.h"
#include "crt\arm64_neon.h"
#include "crt\armintr.h"
#include "crt\arm_neon.h"
#include "crt\assert.h"
#include "crt\conio.h"
#include "crt\crtdbg.h"
#include "crt\crtdefs.h"
#include "crt\crtwrn.h"
#include "crt\ctype.h"
#include "crt\direct.h"
#include "crt\dos.h"
#include "crt\dvec.h"
#include "crt\eh.h"
#include "crt\emmintrin.h"
#include "crt\errno.h"
#include "crt\excpt.h"
#include "crt\fcntl.h"
#include "crt\float.h"
#include "crt\fpieee.h"
#include "crt\fstream.h"
#include "crt\fvec.h"
#include "crt\immintrin.h"
#include "crt\intrin.h"
#include "crt\io.h"
#include "crt\iomanip.h"
#include "crt\ios.h"
#include "crt\iostream.h"
#include "crt\istream.h"
#include "crt\ivec.h"
#include "crt\limits.h"
#include "crt\locale.h"
#include "crt\malloc.h"
#include "crt\math.h"
#include "crt\mbctype.h"
#include "crt\mbstring.h"
#include "crt\memory.h"
#include "crt\minmax.h"
#include "crt\mm3dnow.h"
#include "crt\mmintrin.h"
#include "crt\new.h"
#include "crt\nmmintrin.h"
#include "crt\ostream.h"
#include "crt\pmmintrin.h"
#include "crt\process.h"
#include "crt\rtcapi.h"
#include "crt\search.h"
#include "crt\setjmp.h"
#include "crt\setjmpex.h"
#include "crt\share.h"
#include "crt\signal.h"
#include "crt\smmintrin.h"
#include "crt\stdarg.h"
#include "crt\stddef.h"
#include "crt\stdexcpt.h"
#include "crt\stdio.h"
#include "crt\stdiostr.h"
#include "crt\stdlib.h"
#include "crt\stlshared.h"
#include "crt\streamb.h"
#include "crt\string.h"
#include "crt\strstrea.h"
#include "crt\tchar.h"
#include "crt\time.h"
#include "crt\tmmintrin.h"
#include "crt\typeinfo.h"
#include "crt\useoldio.h"
#include "crt\use_ansi.h"
#include "crt\vadefs.h"
#include "crt\varargs.h"
#include "crt\wchar.h"
#include "crt\wmmintrin.h"
#include "crt\xmmintrin.h"
#include "crt\yvals.h"
#include "crt\zmmintrin.h"
#include "crt\_70_yvals.h"
#include "crt\sys\locking.h"
#include "crt\sys\stat.h"
#include "crt\sys\timeb.h"
#include "crt\sys\types.h"
#include "crt\sys\utime.h"
#include "HidSpiCx\1.0\HidSpiCx.h"
#include "HidSpiCx\1.0\HidSpiCxFuncEnum.h"
#include "HidSpiCx\1.0\HidSpiCxTraceEnums.h"
#include "mbbcx\1.0\mbbcx.h"
#include "mbbcx\1.0\mbbcxtypes.h"
#include "mbbcx\1.0\mbbfuncenum.h"
#include "mbbcx\1.0\mbbtraceenums.h"
#include "ndis\encapsulationconfig.h"
#include "ndis\kdnetpf.h"
#include "ndis\mdlapi.h"
#include "ndis\monitor.h"
#include "ndis\nbl.h"
#include "ndis\nbl8021q.h"
#include "ndis\nblaccessors.h"
#include "ndis\nblapi.h"
#include "ndis\nblchecksum.h"
#include "ndis\nblhash.h"
#include "ndis\nblinfo.h"
#include "ndis\nbllso.h"
#include "ndis\nblreceive.h"
#include "ndis\nblrsc.h"
#include "ndis\nblsend.h"
#include "ndis\nbltimestamp.h"
#include "ndis\nbluro.h"
#include "ndis\nbluso.h"
#include "ndis\oidrequest.h"
#include "ndis\poll.h"
#include "netcx\kmdf\adapter\2.0\netadapter.h"
#include "netcx\kmdf\adapter\2.0\netadaptercx.h"
#include "netcx\kmdf\adapter\2.0\netadaptercxtypes.h"
#include "netcx\kmdf\adapter\2.0\netadapterpacket.h"
#include "netcx\kmdf\adapter\2.0\netconfiguration.h"
#include "netcx\kmdf\adapter\2.0\netdevice.h"
#include "netcx\kmdf\adapter\2.0\netfuncenum.h"
#include "netcx\kmdf\adapter\2.0\netpacketqueue.h"
#include "netcx\kmdf\adapter\2.0\netpoweroffload.h"
#include "netcx\kmdf\adapter\2.0\netpoweroffloadlist.h"
#include "netcx\kmdf\adapter\2.0\netreceivescaling.h"
#include "netcx\kmdf\adapter\2.0\netrxqueue.h"
#include "netcx\kmdf\adapter\2.0\nettraceenums.h"
#include "netcx\kmdf\adapter\2.0\nettxqueue.h"
#include "netcx\kmdf\adapter\2.0\netwakesource.h"
#include "netcx\kmdf\adapter\2.0\netwakesourcelist.h"
#include "netcx\kmdf\adapter\2.1\netadapter.h"
#include "netcx\kmdf\adapter\2.1\netadaptercx.h"
#include "netcx\kmdf\adapter\2.1\netadaptercxtypes.h"
#include "netcx\kmdf\adapter\2.1\netadapteroffload.h"
#include "netcx\kmdf\adapter\2.1\netadapterpacket.h"
#include "netcx\kmdf\adapter\2.1\netadaptertxdemux.h"
#include "netcx\kmdf\adapter\2.1\netconfiguration.h"
#include "netcx\kmdf\adapter\2.1\netdevice.h"
#include "netcx\kmdf\adapter\2.1\netexecutioncontext.h"
#include "netcx\kmdf\adapter\2.1\netfuncenum.h"
#include "netcx\kmdf\adapter\2.1\netpacketqueue.h"
#include "netcx\kmdf\adapter\2.1\netpoweroffload.h"
#include "netcx\kmdf\adapter\2.1\netpoweroffloadlist.h"
#include "netcx\kmdf\adapter\2.1\netreceivescaling.h"
#include "netcx\kmdf\adapter\2.1\netrxqueue.h"
#include "netcx\kmdf\adapter\2.1\nettraceenums.h"
#include "netcx\kmdf\adapter\2.1\nettxqueue.h"
#include "netcx\kmdf\adapter\2.1\netwakesource.h"
#include "netcx\kmdf\adapter\2.1\netwakesourcelist.h"
#include "netcx\kmdf\adapter\2.2\netadapter.h"
#include "netcx\kmdf\adapter\2.2\netadaptercx.h"
#include "netcx\kmdf\adapter\2.2\netadaptercxtypes.h"
#include "netcx\kmdf\adapter\2.2\netadapteroffload.h"
#include "netcx\kmdf\adapter\2.2\netadapterpacket.h"
#include "netcx\kmdf\adapter\2.2\netadaptertxdemux.h"
#include "netcx\kmdf\adapter\2.2\netconfiguration.h"
#include "netcx\kmdf\adapter\2.2\netdevice.h"
#include "netcx\kmdf\adapter\2.2\netexecutioncontext.h"
#include "netcx\kmdf\adapter\2.2\netfuncenum.h"
#include "netcx\kmdf\adapter\2.2\netpacketqueue.h"
#include "netcx\kmdf\adapter\2.2\netpoweroffload.h"
#include "netcx\kmdf\adapter\2.2\netpoweroffloadlist.h"
#include "netcx\kmdf\adapter\2.2\netreceivescaling.h"
#include "netcx\kmdf\adapter\2.2\netrxqueue.h"
#include "netcx\kmdf\adapter\2.2\nettraceenums.h"
#include "netcx\kmdf\adapter\2.2\nettxqueue.h"
#include "netcx\kmdf\adapter\2.2\netwakesource.h"
#include "netcx\kmdf\adapter\2.2\netwakesourcelist.h"
#include "netcx\kmdf\adapter\2.3\netadapter.h"
#include "netcx\kmdf\adapter\2.3\netadaptercx.h"
#include "netcx\kmdf\adapter\2.3\netadaptercxtypes.h"
#include "netcx\kmdf\adapter\2.3\netadapteroffload.h"
#include "netcx\kmdf\adapter\2.3\netadapterpacket.h"
#include "netcx\kmdf\adapter\2.3\netadaptertxdemux.h"
#include "netcx\kmdf\adapter\2.3\netconfiguration.h"
#include "netcx\kmdf\adapter\2.3\netdevice.h"
#include "netcx\kmdf\adapter\2.3\netexecutioncontext.h"
#include "netcx\kmdf\adapter\2.3\netfuncenum.h"
#include "netcx\kmdf\adapter\2.3\netpacketqueue.h"
#include "netcx\kmdf\adapter\2.3\netpoweroffload.h"
#include "netcx\kmdf\adapter\2.3\netpoweroffloadlist.h"
#include "netcx\kmdf\adapter\2.3\netreceivescaling.h"
#include "netcx\kmdf\adapter\2.3\netrxqueue.h"
#include "netcx\kmdf\adapter\2.3\nettraceenums.h"
#include "netcx\kmdf\adapter\2.3\nettxqueue.h"
#include "netcx\kmdf\adapter\2.3\netwakesource.h"
#include "netcx\kmdf\adapter\2.3\netwakesourcelist.h"
#include "netcx\kmdf\adapter\2.3\preview\netadapter.h"
#include "netcx\kmdf\adapter\2.3\preview\netadaptercx.h"
#include "netcx\kmdf\adapter\2.3\preview\netadapteroffload.h"
#include "netcx\kmdf\adapter\2.3\preview\netfuncenum.h"
#include "netcx\kmdf\adapter\2.3\preview\netrequest.h"
#include "netcx\kmdf\adapter\2.3\preview\netrequestqueue.h"
#include "netcx\kmdf\adapter\2.3\preview\nettraceenums.h"
#include "sercx\1.0\sercx.h"
#include "sercx\1.0\serfuncenum.h"
#include "sercx\1.0\sertraceenums.h"
#include "sercx\2.0\sercx.h"
#include "sercx\2.0\sercxfuncenum.h"
#include "spb\1.0\spbcx.h"
#include "spb\1.0\spbfuncenum.h"
#include "spb\1.0\spbtraceenums.h"
#include "spb\1.1\spbcx.h"
#include "spb\1.1\spbfuncenum.h"
#include "spb\1.1\spbtraceenums.h"
#include "ucm\1.0\UcmCx.h"
#include "ucm\1.0\UcmFuncEnum.h"
#include "ucm\1.0\UcmGlobals.h"
#include "ucm\1.0\UcmManager.h"
#include "ucm\1.0\UcmTraceEnums.h"
#include "ucm\1.0\UcmTypes.h"
#include "UcmTcpci\1.0\UcmTcpciCx.h"
#include "UcmTcpci\1.0\UcmTcpciDevice.h"
#include "UcmTcpci\1.0\UcmTcpciFuncEnum.h"
#include "UcmTcpci\1.0\UcmTcpciGlobals.h"
#include "UcmTcpci\1.0\UcmTcpciPortController.h"
#include "UcmTcpci\1.0\UcmTcpciPortControllerRequests.h"
#include "UcmTcpci\1.0\UcmTcpciSpec.h"
#include "UcmTcpci\1.0\UcmTcpciTraceEnums.h"
#include "UcmUcsi\1.0\UcmucsiCx.h"
#include "UcmUcsi\1.0\UcmucsiDevice.h"
#include "UcmUcsi\1.0\UcmucsiFuncEnum.h"
#include "UcmUcsi\1.0\UcmucsiGlobals.h"
#include "UcmUcsi\1.0\UcmucsiPpm.h"
#include "UcmUcsi\1.0\UcmucsiPpmRequests.h"
#include "UcmUcsi\1.0\UcmucsiSpec.h"
#include "UcmUcsi\1.0\UcmucsiTraceEnums.h"
#include "ucx\1.1\ucxclass.h"
#include "ucx\1.1\ucxcontroller.h"
#include "ucx\1.1\ucxendpoint.h"
#include "ucx\1.1\ucxfuncenum.h"
#include "ucx\1.1\ucxglobals.h"
#include "ucx\1.1\ucxobjects.h"
#include "ucx\1.1\ucxroothub.h"
#include "ucx\1.1\ucxsstreams.h"
#include "ucx\1.1\ucxtraceenums.h"
#include "ucx\1.1\ucxusbdevice.h"
#include "ucx\1.2\ucxclass.h"
#include "ucx\1.2\ucxcontroller.h"
#include "ucx\1.2\ucxendpoint.h"
#include "ucx\1.2\ucxfuncenum.h"
#include "ucx\1.2\ucxglobals.h"
#include "ucx\1.2\ucxobjects.h"
#include "ucx\1.2\ucxroothub.h"
#include "ucx\1.2\ucxsstreams.h"
#include "ucx\1.2\ucxtraceenums.h"
#include "ucx\1.2\ucxusbdevice.h"
#include "ucx\1.3\ucxclass.h"
#include "ucx\1.3\ucxcontroller.h"
#include "ucx\1.3\ucxendpoint.h"
#include "ucx\1.3\ucxfuncenum.h"
#include "ucx\1.3\ucxglobals.h"
#include "ucx\1.3\ucxobjects.h"
#include "ucx\1.3\ucxroothub.h"
#include "ucx\1.3\ucxsstreams.h"
#include "ucx\1.3\ucxtraceenums.h"
#include "ucx\1.3\ucxusbdevice.h"
#include "ucx\1.4\ucxclass.h"
#include "ucx\1.4\ucxcontroller.h"
#include "ucx\1.4\ucxendpoint.h"
#include "ucx\1.4\ucxfuncenum.h"
#include "ucx\1.4\ucxglobals.h"
#include "ucx\1.4\ucxobjects.h"
#include "ucx\1.4\ucxroothub.h"
#include "ucx\1.4\ucxsstreams.h"
#include "ucx\1.4\ucxtraceenums.h"
#include "ucx\1.4\ucxusbdevice.h"
#include "ucx\1.5\ucxclass.h"
#include "ucx\1.5\ucxcontroller.h"
#include "ucx\1.5\ucxendpoint.h"
#include "ucx\1.5\ucxfuncenum.h"
#include "ucx\1.5\ucxglobals.h"
#include "ucx\1.5\ucxobjects.h"
#include "ucx\1.5\ucxroothub.h"
#include "ucx\1.5\ucxsstreams.h"
#include "ucx\1.5\ucxtraceenums.h"
#include "ucx\1.5\ucxusbdevice.h"
#include "ude\1.0\UdeCx.h"
#include "ude\1.0\UdeCxFuncEnum.h"
#include "ude\1.0\UdeCxTraceEnums.h"
#include "ude\1.0\UdeCxTypes.h"
#include "ude\1.0\UdeCxUrb.h"
#include "ude\1.0\UdeCxUsbDevice.h"
#include "ude\1.0\UdeCxUsbEndpoint.h"
#include "ude\1.0\UdeCxWdfDevice.h"
#include "ude\1.1\UdeCx.h"
#include "ude\1.1\UdeCxFuncEnum.h"
#include "ude\1.1\UdeCxTraceEnums.h"
#include "ude\1.1\UdeCxTypes.h"
#include "ude\1.1\UdeCxUrb.h"
#include "ude\1.1\UdeCxUsbDevice.h"
#include "ude\1.1\UdeCxUsbEndpoint.h"
#include "ude\1.1\UdeCxWdfDevice.h"
#include "ufx\1.1\ufxbase.h"
#include "ufx\1.1\ufxclient.h"
#include "urs\1.0\UrsCx.h"
#include "urs\1.0\UrsDevice.h"
#include "urs\1.0\UrsFuncEnum.h"
#include "urs\1.0\UrsGlobals.h"
#include "urs\1.0\UrsTraceEnums.h"
#include "urs\1.0\UrsTypes.h"
#include "wificx\1.0\wificx.h"
#include "wificx\1.0\wificxpoweroffload.h"
#include "wificx\1.0\wificxpoweroffloadlist.h"
#include "wificx\1.0\wificxtypes.h"
#include "wificx\1.0\wificxwakesource.h"
#include "wificx\1.0\wificxwakesourcelist.h"
#include "wificx\1.0\wififuncenum.h"
#include "wificx\1.0\wifitraceenums.h"

Далее запустил idaclang такими параметрами.

Код: 
idaclang.exe --idaclang-tilname D:\wdk10.til --idaclang-log-target --idaclang-tildesc "Windows Driver Kit 10 headers (x64)" -target x86_64-pc-windows-msvc19.34.31937 -x c++  -D_AMD64_ -isysroot "C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0" -ferror-limit=100 -I "C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared" -I "C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km" "C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km\test.h"

В результате чего получаю полотно варнингов и фатальную ошибку из-за избытка варнгингов (в команде установлено 100, но я увеличивал и до 10000, не уверен, что имеет смысл наращивать это значение).

Код: 
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:534:5: error: unknown type name 'ULONG'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:535:5: error: unknown type name 'ULONG'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:538:5: error: unknown type name 'CHAR'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:541:25: error: typedef redefinition with different types ('ACPI_ENUM_CHILD' (aka '_ACPI_ENUM_CHILD') vs 'APICTABLE' (aka '_APICTABLE'))
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:541:34: error: expected ';' after top level declarator
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:544:5: error: unknown type name 'ULONG'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:545:5: error: unknown type name 'ULONG'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:549:42: error: typedef redefinition with different types ('ACPI_ENUM_CHILDREN_OUTPUT_BUFFER' (aka '_ACPI_ENUM_CHILDREN_OUTPUT_BUFFER') vs 'APICTABLE' (aka '_APICTABLE'))
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:549:51: error: expected ';' after top level declarator
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:559:5: error: unknown type name 'ULONG'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:560:5: error: unknown type name 'USHORT'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:561:5: error: unknown type name 'UCHAR'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:562:5: error: unknown type name 'UCHAR'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:568:5: error: unknown type name 'USHORT'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:569:5: error: unknown type name 'USHORT'
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\include\10.0.22621.0\shared\acpiioct.h:570:5: error: unknown type name 'USHORT'
fatal: fatal error: too many errors emitted, stopping now [-ferror-limit=]

Вопрос, что нужно сделать, чтобы собрать такую библиотеку? В доке ответа не нашел. Пробовал убирать вручную проблемные заголовочные файлы, добавлял пути с инклудами из SDK, подсказывая где может лежать недостающая инфа, но ошибки лезли и лезли. Как обычно в доке все работает, на практике хуита получается. Тьфу.


UPD. Увеличил значения параметра -ferror-limit=100000

Код: 
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:534:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:535:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:536:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:537:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:538:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:539:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:540:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:541:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:542:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:543:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:544:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:545:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:546:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:547:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:548:10: error: #include nested too deeply
IDACLANG: nonfatal: C:\Program Files (x86)\Windows Kits\10\Include\10.0.22621.0\km/test.h:549:10: error: #include nested too deeply
fatal: failed to convert type info for "struct _NODE_ADDRESS(105)"

o_O

UPD2. Помучился еще немного, оставил тут https://github.com/varwar/tilibs
Прошу прощения за басурманский, так исторически сложилось.

столкнулся с похожей проблемой при написании плагина для Ida с использованием binexport
там они решают проблему примерно след образом ...


begin_idasdk.inc
Код: 
// Copyright 2011-2021 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Allow to safely include IDA's pro.h. In order to work, any IDA Pro header
// must be included between includes of begin_idasdk.inc (this file) and
// end_idasdk.inc (which undoes the preprocessor changes from this file).
//
// Note: There is no header guard in this file, we rely on the one in IDA's
//       pro.h to provide the basic types IDA plugins need. Other than that,
//       we do want to support the case where IDA plugin code includes other
//       headers that need to include IDA headers. Using include guards here
//       would prevent that.

// Alias IDA-specific integer types which conflict with the ones defined by
// Protocol Buffers/Abseil.
#define int8 ida_int8
#define sint8 ida_sint8
#define uint8 ida_uint8
#define int16 ida_int16
#define uint16 ida_uint16
#define int32 ida_int32
#define uint32 ida_uint32
#define int64 ida_int64
#define uint64 ida_uint64
#define int128 ida_int128
#define uint128 ida_uint128

// Silence some compiler warnings in IDA SDK headers
#ifdef __clang__
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wvarargs"
#elif __GNUC__
#pragma GCC diagnostic push
#pragma GCC diagnostic ignored "-Wvarargs"
#elif _MSC_VER
#pragma warning(push)
#pragma warning(disable : 4005)
#pragma warning(disable : 4244)
#pragma warning(disable : 4267)
#endif

// Now include the problematic header, end_idasdk.inc will clean up again.
#include <pro.h>

end_idasdk.inc
Код: 
// Copyright 2011-2021 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

// Companion header to begin_idasdk.inc. In order to work, this must be
// included after including any IDA Pro headers.

#ifdef __clang__
#pragma clang diagnostic pop
#elif __GNUC__
#pragma GCC diagnostic pop
#elif _MSC_VER
#pragma warning(pop)
#endif

#undef uint128
#undef int128
#undef uint64
#undef int64
#undef uint32
#undef int32
#undef uint16
#undef int16
#undef uint8
#undef sint8
#undef int8

// Undefine the operand shortcuts Op1-Op8, as those pollute the global
// namespace.
#undef Op8
#undef Op7
#undef Op6
#undef Op5
#undef Op4
#undef Op3
#undef Op2
#undef Op1

если их не использовать то тоже появляются сообщения о неизвестных типах

получается как то так

begin_idasdk.inc
тут идут ида сдк файлы заголовков
end_idasdk.inc

возможно и в вашем случае нужно написать что то подобное ...
 
Последнее редактирование:

IDA Pro 8.3 + декомпилятор 32/64​


Источник - https://www.52pojie.cn/thread-1861384-1-1.html

Архив - https://kenny666-my.sharepoint.com/...ZLknXGNhLdCo2Up4zU2CoMB7h_Dlx9x0VtfN3wzwkdCmw
Кейген - https://kenny666-my.sharepoint.com/...SOZVNs1UchAiMuYbabL3jwBf-172_5jg8l87-bEzYakAw

ida_keygen.exe -v 830 -u user -e e@mail.com -t 3 > ida.key или ida_keygen.exe -v 830 -u user -e e@mail.com -t 3 -s 5169> ida.key чтобы не писдело про просрочку
 
Apocalypse сказал(а):

IDA Pro 8.3 + декомпилятор 32/64​


Источник - https://www.52pojie.cn/thread-1861384-1-1.html

Архив - https://kenny666-my.sharepoint.com/...ZLknXGNhLdCo2Up4zU2CoMB7h_Dlx9x0VtfN3wzwkdCmw
Кейген - https://kenny666-my.sharepoint.com/...SOZVNs1UchAiMuYbabL3jwBf-172_5jg8l87-bEzYakAw

ida_keygen.exe -v 830 -u user -e e@mail.com -t 3 > ida.key или ida_keygen.exe -v 830 -u user -e e@mail.com -t 3 -s 5169> ida.key чтобы не писдело про просрочку

Огонь🔥 Всегда радуюсь новой версии IDA, как ребенок новой игрушке.
 
Пожалуйста, обратите внимание, что пользователь заблокирован
reqwest сказал(а):
Подскажите, помню плагин для иды был - умел сравнивать два PE файла, как он называелся?
скорее всего ты про bindiff
 
Пожалуйста, обратите внимание, что пользователь заблокирован
Плагин, упрощающий реверс драйверов, написанных на фреймворке KMDF (Kernel-Mode Driver Framework).
Супер плагин, проверено.

Plugin focus: ida kmdf – Hex Rays

This is a guest entry written by Arnaud Gatignol and Julien Staszewski from the THALIUM team. The views and opinions expressed in this blog post are solely
hex-rays.com

Еще один интересный плагин - FindFunc
Есть продвинутые фильтры поиска. Использовался одним из участников в конкурсе XSS PWN-Day 0x1.
 
Пожалуйста, обратите внимание, что пользователь заблокирован
The installation package for IDA Pro 9.0 beta has been leaked.
we.tl/t-uzO2qS3lwo

Source:
https://twitter.com/x/status/1821962897888780446


Python: 
import json
import hashlib
import os

license = {
    "header": {"version": 1},
    "payload": {
        "name": "meow :3",
        "email": "hi@hex-rays.com",
        "licenses": [
            {
                "id": "48-2137-ACAB-99",
                "license_type": "named",
                "product": "IDA",
                "seats": 1,
                "start_date": "2024-08-10 00:00:00",
                "end_date": "2033-12-31 23:59:59",  # This can't be more than 10 years!
                "issued_on": "2024-08-10 00:00:00",
                "owner": "cracked by alula :3",
                "add_ons": [
                    # {
                    #     "id": "48-1337-DEAD-01",
                    #     "code": "HEXX86L",
                    #     "owner": "48-0000-0000-00",
                    #     "start_date": "2024-08-10 00:00:00",
                    #     "end_date": "2033-12-31 23:59:59",
                    # },
                    # {
                    #     "id": "48-1337-DEAD-02",
                    #     "code": "HEXX64L",
                    #     "owner": "48-0000-0000-00",
                    #     "start_date": "2024-08-10 00:00:00",
                    #     "end_date": "2033-12-31 23:59:59",
                    # },
                ],
                "features": [],
            }
        ],
    },
}


def add_every_addon(license):
    platforms = [
        "W",  # Windows
        "L",  # Linux
        "M",  # macOS
    ]
    addons = [
        "HEXX86",
        "HEXX64",
        "HEXARM",
        "HEXARM64",
        "HEXMIPS",
        "HEXMIPS64",
        "HEXPPC",
        "HEXPPC64",
        "HEXRV64",
        "HEXARC",
        "HEXARC64",
        # Probably cloud?
        # "HEXCX86",
        # "HEXCX64",
        # "HEXCARM",
        # "HEXCARM64",
        # "HEXCMIPS",
        # "HEXCMIPS64",
        # "HEXCPPC",
        # "HEXCPPC64",
        # "HEXCRV",
        # "HEXCRV64",
        # "HEXCARC",
        # "HEXCARC64",
    ]

    i = 0
    for addon in addons:
        i += 1
        license["payload"]["licenses"][0]["add_ons"].append(
            {
                "id": f"48-1337-DEAD-{i:02}",
                "code": addon,
                "owner": license["payload"]["licenses"][0]["id"],
                "start_date": "2024-08-10 00:00:00",
                "end_date": "2033-12-31 23:59:59",
            }
        )
    # for addon in addons:
    #     for platform in platforms:
    #         i += 1
    #         license["payload"]["licenses"][0]["add_ons"].append(
    #             {
    #                 "id": f"48-1337-DEAD-{i:02}",
    #                 "code": addon + platform,
    #                 "owner": license["payload"]["licenses"][0]["id"],
    #                 "start_date": "2024-08-10 00:00:00",
    #                 "end_date": "2033-12-31 23:59:59",
    #             }
    #         )


add_every_addon(license)


def json_stringify_alphabetical(obj):
    return json.dumps(obj, sort_keys=True, separators=(",", ":"))


def buf_to_bigint(buf):
    return int.from_bytes(buf, byteorder="little")


def bigint_to_buf(i):
    return i.to_bytes((i.bit_length() + 7) // 8, byteorder="little")


# Yup, you only have to patch 5c -> cb in libida64.so
pub_modulus_hexrays = buf_to_bigint(
    bytes.fromhex(
        "edfd425cf978546e8911225884436c57140525650bcf6ebfe80edbc5fb1de68f4c66c29cb22eb668788afcb0abbb718044584b810f8970cddf227385f75d5dddd91d4f18937a08aa83b28c49d12dc92e7505bb38809e91bd0fbd2f2e6ab1d2e33c0c55d5bddd478ee8bf845fcef3c82b9d2929ecb71f4d1b3db96e3a8e7aaf93"
    )
)
pub_modulus_patched = buf_to_bigint(
    bytes.fromhex(
        "edfd42cbf978546e8911225884436c57140525650bcf6ebfe80edbc5fb1de68f4c66c29cb22eb668788afcb0abbb718044584b810f8970cddf227385f75d5dddd91d4f18937a08aa83b28c49d12dc92e7505bb38809e91bd0fbd2f2e6ab1d2e33c0c55d5bddd478ee8bf845fcef3c82b9d2929ecb71f4d1b3db96e3a8e7aaf93"
    )
)

private_key = buf_to_bigint(
    bytes.fromhex(
        "77c86abbb7f3bb134436797b68ff47beb1a5457816608dbfb72641814dd464dd640d711d5732d3017a1c4e63d835822f00a4eab619a2c4791cf33f9f57f9c2ae4d9eed9981e79ac9b8f8a411f68f25b9f0c05d04d11e22a3a0d8d4672b56a61f1532282ff4e4e74759e832b70e98b9d102d07e9fb9ba8d15810b144970029874"
    )
)


def decrypt(message):
    decrypted = pow(buf_to_bigint(message), exponent, pub_modulus_patched)
    decrypted = bigint_to_buf(decrypted)
    return decrypted[::-1]


def encrypt(message):
    encrypted = pow(buf_to_bigint(message[::-1]), private_key, pub_modulus_patched)
    encrypted = bigint_to_buf(encrypted)
    return encrypted


exponent = 0x13


def sign_hexlic(payload: dict) -> str:
    data = {"payload": payload}
    data_str = json_stringify_alphabetical(data)

    buffer = bytearray(128)
    # first 33 bytes are random
    for i in range(33):
        buffer[i] = 0x42

    # compute sha256 of the data
    sha256 = hashlib.sha256()
    sha256.update(data_str.encode())
    digest = sha256.digest()

    # copy the sha256 digest to the buffer
    for i in range(32):
        buffer[33 + i] = digest[i]

    # encrypt the buffer
    encrypted = encrypt(buffer)

    return encrypted.hex().upper()


def generate_patched_dll(filename):
    if not os.path.exists(filename):
        print(f"Didn't find {filename}, skipping patch generation")
        return

    with open(filename, "rb") as f:
        data = f.read()

        if data.find(bytes.fromhex("EDFD42CBF978")) != -1:
            print(f"{filename} looks to be already patched :)")
            return
       
        if data.find(bytes.fromhex("EDFD425CF978")) == -1:
            print(f"{filename} doesn't contain the original modulus.")
            return

        data = data.replace(
            bytes.fromhex("EDFD425CF978"), bytes.fromhex("EDFD42CBF978")
        )

        patched_filename = f"{filename}.patched"
        with open(patched_filename, "wb") as f:
            f.write(data)

        print(f"Generated modulus patch to {patched_filename}! To apply the patch, replace the original file with the patched file")


# message = bytes.fromhex(license["signature"])
# print(decrypt(message).hex())
# print(encrypt(decrypt(message)).hex())

license["signature"] = sign_hexlic(license["payload"])

serialized = json_stringify_alphabetical(license)

# write to ida.hexlic
filename = "ida.hexlic"

with open(filename, "w") as f:
    f.write(serialized)

print(f"Saved new license to {filename}!")

generate_patched_dll("ida.dll")
generate_patched_dll("ida64.dll")
generate_patched_dll("libida.so")
generate_patched_dll("libida64.so")
generate_patched_dll("libida.dylib")
generate_patched_dll("libida64.dylib")

Только я не понял, а где другие декомпиляторы?

1723405536738.png
 
Последнее редактирование:
IDA Pro 9.0 Beta

Ссылка на скачку:
У вас должно быть более 1 сообщений для просмотра скрытого контента.

Gofile - Cloud Storage Made Simple

Secure, fast and free cloud storage solution. Upload and share files instantly.
gofile.io

VT:
У вас должно быть более 1 сообщений для просмотра скрытого контента.

VirusTotal

VirusTotal
www.virustotal.com

1. После установки закинуть скрипт в папку, куда была установлена IDA
2. Файл лицензии (ida.hexlic) переместить в %APPDATA%\Hex-Rays\IDA Pro
3. Заменить ida.dll и ida64.dll на ida.dll.patched и ida64.dll.patched (оригинальные файлы удалить)

Скрипт:
У вас должно быть более 1 сообщений для просмотра скрытого контента.
Python: 
import json
import hashlib
import os

license = {
    "header": {"version": 1},
    "payload": {
        "name": "hetzner",
        "email": "joe_biden@hex-rays.com",
        "licenses": [
            {
                "id": "48-2137-ACAB-99",
                "license_type": "named",
                "product": "IDA",
                "seats": 1,
                "start_date": "2024-08-10 00:00:00",
                "end_date": "2033-12-31 23:59:59",  # 10 y. max
                "issued_on": "2024-08-10 00:00:00",
                "owner": "joe biden",
                "add_ons": [
                    # {
                    #     "id": "48-1337-DEAD-01",
                    #     "code": "HEXX86L",
                    #     "owner": "48-0000-0000-00",
                    #     "start_date": "2024-08-10 00:00:00",
                    #     "end_date": "2033-12-31 23:59:59",
                    # },
                    # {
                    #     "id": "48-1337-DEAD-02",
                    #     "code": "HEXX64L",
                    #     "owner": "48-0000-0000-00",
                    #     "start_date": "2024-08-10 00:00:00",
                    #     "end_date": "2033-12-31 23:59:59",
                    # },
                ],
                "features": [],
            }
        ],
    },
}


def add_every_addon(license):
    platforms = [
        "W",  # win
        "L",  # linux
        "M",  # mac
    ]
    addons = [
        "HEXX86",
        "HEXX64",
        "HEXARM",
        "HEXARM64",
        "HEXMIPS",
        "HEXMIPS64",
        "HEXPPC",
        "HEXPPC64",
        "HEXRV64",
        "HEXARC",
        "HEXARC64",
        # "HEXCX86",
        # "HEXCX64",
        # "HEXCARM",
        # "HEXCARM64",
        # "HEXCMIPS",
        # "HEXCMIPS64",
        # "HEXCPPC",
        # "HEXCPPC64",
        # "HEXCRV",
        # "HEXCRV64",
        # "HEXCARC",
        # "HEXCARC64",
    ]

    i = 0
    for addon in addons:
        i += 1
        license["payload"]["licenses"][0]["add_ons"].append(
            {
                "id": f"48-1337-DEAD-{i:02}",
                "code": addon,
                "owner": license["payload"]["licenses"][0]["id"],
                "start_date": "2024-08-10 00:00:00",
                "end_date": "2033-12-31 23:59:59",
            }
        )
    # for addon in addons:
    #     for platform in platforms:
    #         i += 1
    #         license["payload"]["licenses"][0]["add_ons"].append(
    #             {
    #                 "id": f"48-1337-DEAD-{i:02}",
    #                 "code": addon + platform,
    #                 "owner": license["payload"]["licenses"][0]["id"],
    #                 "start_date": "2024-08-10 00:00:00",
    #                 "end_date": "2033-12-31 23:59:59",
    #             }
    #         )


add_every_addon(license)


def json_stringify_alphabetical(obj):
    return json.dumps(obj, sort_keys=True, separators=(",", ":"))


def buf_to_bigint(buf):
    return int.from_bytes(buf, byteorder="little")


def bigint_to_buf(i):
    return i.to_bytes((i.bit_length() + 7) // 8, byteorder="little")


# you only have to patch 5c -> cb in libida64.so
pub_modulus_hexrays = buf_to_bigint(
    bytes.fromhex(
        "edfd425cf978546e8911225884436c57140525650bcf6ebfe80edbc5fb1de68f4c66c29cb22eb668788afcb0abbb718044584b810f8970cddf227385f75d5dddd91d4f18937a08aa83b28c49d12dc92e7505bb38809e91bd0fbd2f2e6ab1d2e33c0c55d5bddd478ee8bf845fcef3c82b9d2929ecb71f4d1b3db96e3a8e7aaf93"
    )
)
pub_modulus_patched = buf_to_bigint(
    bytes.fromhex(
        "edfd42cbf978546e8911225884436c57140525650bcf6ebfe80edbc5fb1de68f4c66c29cb22eb668788afcb0abbb718044584b810f8970cddf227385f75d5dddd91d4f18937a08aa83b28c49d12dc92e7505bb38809e91bd0fbd2f2e6ab1d2e33c0c55d5bddd478ee8bf845fcef3c82b9d2929ecb71f4d1b3db96e3a8e7aaf93"
    )
)

private_key = buf_to_bigint(
    bytes.fromhex(
        "77c86abbb7f3bb134436797b68ff47beb1a5457816608dbfb72641814dd464dd640d711d5732d3017a1c4e63d835822f00a4eab619a2c4791cf33f9f57f9c2ae4d9eed9981e79ac9b8f8a411f68f25b9f0c05d04d11e22a3a0d8d4672b56a61f1532282ff4e4e74759e832b70e98b9d102d07e9fb9ba8d15810b144970029874"
    )
)


def decrypt(message):
    decrypted = pow(buf_to_bigint(message), exponent, pub_modulus_patched)
    decrypted = bigint_to_buf(decrypted)
    return decrypted[::-1]


def encrypt(message):
    encrypted = pow(buf_to_bigint(message[::-1]), private_key, pub_modulus_patched)
    encrypted = bigint_to_buf(encrypted)
    return encrypted


exponent = 0x13


def sign_hexlic(payload: dict) -> str:
    data = {"payload": payload}
    data_str = json_stringify_alphabetical(data)

    buffer = bytearray(128)
    # first 33 bytes are random
    for i in range(33):
        buffer[i] = 0x42

    # compute sha256 of the data
    sha256 = hashlib.sha256()
    sha256.update(data_str.encode())
    digest = sha256.digest()

    # copy the sha256 digest to the buffer
    for i in range(32):
        buffer[33 + i] = digest[i]

    encrypted = encrypt(buffer)

    return encrypted.hex().upper()


def generate_patched_dll(filename):
    if not os.path.exists(filename):
        print(f"Didn't find {filename}, skipping patch generation")
        return

    with open(filename, "rb") as f:
        data = f.read()

        if data.find(bytes.fromhex("EDFD42CBF978")) != -1:
            print(f"{filename} looks to be already patched :)")
            return
     
        if data.find(bytes.fromhex("EDFD425CF978")) == -1:
            print(f"{filename} doesn't contain the original modulus.")
            return

        data = data.replace(
            bytes.fromhex("EDFD425CF978"), bytes.fromhex("EDFD42CBF978")
        )

        patched_filename = f"{filename}.patched"
        with open(patched_filename, "wb") as f:
            f.write(data)

        print(f"Generated modulus patch to {patched_filename}! To apply the patch, replace the original file with the patched file")


# message = bytes.fromhex(license["signature"])
# print(decrypt(message).hex())
# print(encrypt(decrypt(message)).hex())

license["signature"] = sign_hexlic(license["payload"])

serialized = json_stringify_alphabetical(license)

filename = "ida.hexlic"

with open(filename, "w") as f:
    f.write(serialized)

print(f"Saved new license to {filename}!")

generate_patched_dll("ida.dll")
generate_patched_dll("ida64.dll")
generate_patched_dll("libida.so")
generate_patched_dll("libida64.so")
generate_patched_dll("libida.dylib")
generate_patched_dll("libida64.dylib")
 
admin


Напишите ответ...
  • Вставить:
Прикрепить файлы
Верх