Notice
Recent Posts
Recent Comments
Link
- Korea times
- 끌리면 오라...BGM 광고음악 라이브러리
- KartOO visual meta search engi…
- E-Book
- Channel9
- MSDN
- 여리의 작업실
- 유경상의 .NET 블로그
- window 쪼물딱 거리기
- 블루 홈(소현이 누님)
- IT 관련 전반 내용(정환이네)
- 비너스의 정보 공유(유틸리티들)
- 형기의 자료공간(디지털ERA에서 콘텐츠ERA로)
- EzineArticles (여러 분야의 글들이 올라옴)
- Relationship을 보여주는 라이브러리
- OpenRCE
- 젠틀의 블로그(무선 통신의 모든것)
- 헐랭이와 IT보안
- 워니. 추억ㅇㅔ ㅂㅣ추ㅇㅓ.
- Computer Forensics
- 토익 광장(YBM)
- Korea Times 이용하기
- Larkware Software
- TCP/UDP
- Black Hat
- DEF CON
- Slashdot
- ReallyUsefulEbooks.com Update
- 실리콘밸리 뉴스
- Application Development Trends
- Visual Studio Hacks
- MIT OCW
- Redmond Developer News
- SecurityFocus
- Microsoft Window Hacking Porta…
- Darknet - Don't Learn to Hack …
- Windows Tips, Tricks and Hacks
- Hack In the Box
- (IN)SECURE Magazine
- SuperSite Windows Vista
- Government Security
- Life is Still Talking (Good)
- PHRACK
- Found+Read(resource for startu…
- Jonathan Boutelle
- Venture Hacks
- 스마트플레이스
- All about Intellipedia
- Undocumented Windows 2000 Secr…
- HexBlog (Decompiler)
- TED (Ideas worth spreading)
- Crash Dump Analysis and Debugg…
- Rootkit
- DDK Developers(MS)
- 미친 감자의 블로그
- The Art of Assembly Language
- Chpie (키보드 후킹)
- Drivers Online
- (음악) Delicate SONG
- Reverse Engineering Community
- Software Best Practices
- Sara Ford's WebLog
- Cheat Happens
- Debugging,Unpacking,Assembling…
- 윤석찬님 블로그
- OK 괜찮아 다 잘 될거야
- RingBlog
- Art Life :: 하늘소
- IT's Paradise
- John Robbins!
- Wintellect
- Hacked Gadgets
- 소프트웨어 이야기
- Ryan Naraine's Zero Day
- VULN
- Stay Secure
- EBS 영어 공부(블루워터)
- 101BLoG : "Bright Size Life" o…
- Hacker Challenge
- Hackers Center
- White Hat, Chicago Con
- Ethical Hacker Network
- ChaseNet (Security)
- TechTarget
- Entrepreneur
- Infopackets
- Popular Science
- Dark Reading - The Business of…
- How Stuff Works
- codeDriver - Crack (역공학)
- Gadget (Windows)
- Serious Code
- Iguacu Blog(블루문)
- SecurityProof
- Power of Community(Hacker)
- Crack ?
- Security Freak
- Data Network Resource
- FoundStone - Security Consulti…
- Google Online Security Blog
- (BOOK) Cool DogBooks
- SachaBarber (좋은 개발자)
- System Software Incorporation
- 스카이 벤처
- NewsTorrent
- 글로벌 IT 네트워크
- Ethical Hacking and Infosec
- Realms of Hacking tricks
- CodeBreakers Journal
- Anti Rootkit Blog
- The Reverse Code Engineering C…
- Anti-Debug Tools
- Reverse Code Engineering Video…
- Damn Vulnerable linux
- Security Problems
- French Reverse Engineering Tea…
- Monac
- Open Source Vulnerability Data…
- Viruschaser 검사(바이러스)
- Windows Tips
- 보안 대처 연습
- [Download] Kartz CD
- [Download] FlMS Download
- [Download] DDL2
- 중국 해킹 사이트(안전중국)
- 바이러스 분석
- Javascript 전문가
- Virus Alert Zone (바이러스 분석)
- Computer World
- 문스랩닷컴(보안)
- Unpack China
- Black Storm Reverse Engineerin…
- 역공학 Reverser
- 문화 망명지 - 시, 소설
- WPF MVP
- Research Channel
- The Problem Solver - C# MVP
- Reversing - 리버스 엔지니어링
- Nigel Spencer's Blog (.NET)
- Kirill Osenkov (.NET C# IDE Te…
- H33T (BitTorrnet 검색 사이트)
- ITL (해킹, 보안)
- ITL (Invisible Things Lab) Blo…
- ebook, pdf, chm
- 주식 - 멘토클리닉
- CherryLove - 바이러스, 백신, 악성코드
- PMP
- 영원한 해커, hacker
- 리버싱, PE
- 신호철 - dsphome
- TechEd 2009
- SHOUT
- [도서] 오디오북
- [도서] 전자책
- [도서] 국내도서요약
- [도서] 해외도서요약
- TopCorder - 프로그래밍 연습
일 | 월 | 화 | 수 | 목 | 금 | 토 |
---|---|---|---|---|---|---|
1 | 2 | 3 | 4 | 5 | ||
6 | 7 | 8 | 9 | 10 | 11 | 12 |
13 | 14 | 15 | 16 | 17 | 18 | 19 |
20 | 21 | 22 | 23 | 24 | 25 | 26 |
27 | 28 | 29 | 30 | 31 |
Tags
- .NET Framework
- .net
- 닷넷
- security
- 해킹
- 마이크로소프트
- 구글
- MVP
- Visual Studio
- Microsoft
- 역공학
- 디버그랩
- english
- hacking
- visual studio 2010
- VSTS
- .net framework 4
- 비주얼스튜디오
- C#
- Windows 7
- 디버깅
- debugging
- 비주얼 스튜디오
- 보안
- WPF
- 책
- VSTS 2010
- Windows
Archives
- Today
- Total
NaggingMachine
Creating IDA Plug-ins with C# or VB6 본문
다음 링크에서 가져왔습니다.
http://www.openrce.org/articles/full_view/13
This article highlightstechnique where you can use a high level language such as C# or VB6 to create GUIs for IDA plugins. Why bother? Why not. These two languages make complex UI programming very easy, are easy to debug, and are great for rapid prototyping.
What we will be doing is creating a traditional IDA plug-in stub in VC, which will be used to add menu items to IDA, and export a wrapped set of IDA API functions for the high level language plug-in to utilize. A basic block diagram of what we want to accomplish looks like this:
Conceptual Block Diagram
To make VB6, .NET, and VC all play nice together, we have set up our plug-ins so that they can be accessed as COM Dll's. To access the .NET dll as a COM object, you will have to use the regasm utility to setup the proper registry entries for the interface as well as produce a type library file (.tlb) so we can early bind to it in our VC stub. VB6 can only produce ActiveX DLLs, and already sets up all registry entries and adds the type library information directly to its DLLs during compilation. If you are just trying out the demo, you will still need to register the VB6 sample dll using regsvr32.
So for a quick walk through of the code. In both of our plug-in examples here we are early binding to our Dlls. This means that you should compile the VB6 or .NET dlls first and make sure that binary compatability is set so that their interface GUIDs do not change the next time you compile (or you will have to recompile your stub again). This is not really a problem because the interface we use to launch the plug-ins is very simple and never needs to change. It is only used to initalize the library and runtimes and get it executing. In out VC stub you will see the following declaration:
Microsoft Ole View Utility
When it comes time to display our interface, all we have to do is call our class method to launch it. In the example code below, we are passing it the hwnd of the main IDA window so that we can display our form modally. (At this point I have not tried to set it as a MDI child of the main window using SetParent which may also work.)
Be sure to read the README files in the applications home directories to learn how to setup the projects. Precompiled binaries are provided for IDA 4.7.
If you would like to play with some more involved samples, I have also made some of my personal plug-ins. Note that these other samples were thrown together relativly quickly from scraps of code so they will probably have their share of bugs.
Anyway, enjoy..
-dzzie
http://www.openrce.org/articles/full_view/13
This article highlightstechnique where you can use a high level language such as C# or VB6 to create GUIs for IDA plugins. Why bother? Why not. These two languages make complex UI programming very easy, are easy to debug, and are great for rapid prototyping.
What we will be doing is creating a traditional IDA plug-in stub in VC, which will be used to add menu items to IDA, and export a wrapped set of IDA API functions for the high level language plug-in to utilize. A basic block diagram of what we want to accomplish looks like this:
Conceptual Block Diagram
To make VB6, .NET, and VC all play nice together, we have set up our plug-ins so that they can be accessed as COM Dll's. To access the .NET dll as a COM object, you will have to use the regasm utility to setup the proper registry entries for the interface as well as produce a type library file (.tlb) so we can early bind to it in our VC stub. VB6 can only produce ActiveX DLLs, and already sets up all registry entries and adds the type library information directly to its DLLs during compilation. If you are just trying out the demo, you will still need to register the VB6 sample dll using regsvr32.
So for a quick walk through of the code. In both of our plug-in examples here we are early binding to our Dlls. This means that you should compile the VB6 or .NET dlls first and make sure that binary compatability is set so that their interface GUIDs do not change the next time you compile (or you will have to recompile your stub again). This is not really a problem because the interface we use to launch the plug-ins is very simple and never needs to change. It is only used to initalize the library and runtimes and get it executing. In out VC stub you will see the following declaration:
#import "./bin_4.7/CSharpIDASample.tlb" raw_interfaces_only using namespace CSharpIDASample; ICpluginPtr pIPlug(__uuidof(Cplugin));This uses some VC VooDoo to load the type library interfaces, and create an initalized object pointer instance of our main class. The names of the namespace, class, and Interface pointer are all set in the typelibrary and can be viewed using any type library viewer such as the free demo that comes from Matt Curlands Power VB site or other tools like the Microsoft Ole View utility.
Microsoft Ole View Utility
When it comes time to display our interface, all we have to do is call our class method to launch it. In the example code below, we are passing it the hwnd of the main IDA window so that we can display our form modally. (At this point I have not tried to set it as a MDI child of the main window using SetParent which may also work.)
int h = (int)callui(ui_get_hwnd).vptr; //ida main window hwnd pIPlug->DopluginAction( h , &lRet);Here the lRet variable will receive the HRESULT COM return value which we dont have to worry about. Once our plug-in form is displayed, the IDA API functionality is accessed via function declares written in our form. These declare statements were made as a way to give VB developers access to stdcall Win32 API and are still present in .NET so that you can access custom C dlls. Below are C prototypes and corrosponding C# and VB6 declares.
C Prototypes: int __stdcall NumFuncs(void) int __stdcall FunctionStart(int n) int __stdcall FunctionEnd(int n) VB6: Private Declare Function NumFuncs Lib "vcSample.plw" () As Long Private Declare Function FunctionStart Lib "vcSample.plw" (ByVal functionIndex As Long) As Long Private Declare Function FunctionEnd Lib "vcSample.plw" (ByVal functionIndex As Long) As Long C#: [DllImport("c_stub.plw")] public static extern int NumFuncs(); [DllImport("c_stub.plw")] public static extern int FunctionStart(int index); [DllImport("c_stub.plw")] public static extern int FunctionEnd(int index);Using this mechanism to access wrapped API exports from our CPP stub gives us alittle more flexability and frees us from having to worring about COM compatability issues relating to changing interfaces. Included in the sample zip are VB6 and C# samples of example IDA plug-ins. In addition to the basic example framework provided, I have also included a file with another 36 IDA API wrappers that you can use in your own projects. If for some reason you would prefer to late bind to the COM objects you can find older examples of that on my site. The reason I use early binding here is that to late bind takes about a page and half of long winded code.
Be sure to read the README files in the applications home directories to learn how to setup the projects. Precompiled binaries are provided for IDA 4.7.
If you would like to play with some more involved samples, I have also made some of my personal plug-ins. Note that these other samples were thrown together relativly quickly from scraps of code so they will probably have their share of bugs.
Anyway, enjoy..
-dzzie
'TechnoBabbler' 카테고리의 다른 글
Advanced reverse-engineering tool for spying on Windows software (0) | 2007.08.19 |
---|---|
[질문]인터럽트개체가 뭐야????? (0) | 2007.08.19 |
Microsoft Patching Internals (0) | 2007.08.18 |
How to launch an executable... (0) | 2007.08.18 |
SlideCasting: The SlideCast (0) | 2007.08.12 |