├── README.md ├── idapython_tools ├── findguid │ ├── README.md │ ├── guid_list │ │ ├── media.txt │ │ ├── folder.txt │ │ └── class.txt │ └── findguid.py ├── 695_to_7 │ ├── README.md │ └── 695_to_7.py ├── findcrypt │ ├── README.md │ └── findcrypt.py └── hide_junk_code.py ├── theme └── forest.clr └── LICENSE /README.md: -------------------------------------------------------------------------------- 1 | # IDA 2 | A place for IDA related stuff. 3 | 4 | ## idapython_tools 5 | My tiny IDAPython tools. 6 | 7 | ### FindCrypt 8 | A Python implementation of FindCrypt plugin. 9 | 10 | ### 695 to 7 11 | IDAPython API name converter. 12 | 13 | ### FindGUID 14 | GUID resolver. 15 | 16 | ### Hide Junk Code 17 | An IDAPython script to hide junk code. Run hide_junk_code.py on IDA. 18 | 19 | ## theme 20 | IDA's color theme for IDA 6... Should be updated. 21 | 22 | ## License 23 | Apache License 2.0. See [LICENSE](/LICENSE). 24 | -------------------------------------------------------------------------------- /idapython_tools/findguid/README.md: -------------------------------------------------------------------------------- 1 | # FindGUID 2 | An IDAPython script to resolve GUID names like ClassAndInterfaceToNames.py. [ComIDA](https://github.com/airbus-cert/comida) or [COM-Code-Helper](https://github.com/fboldewin/COM-Code-Helper) will be better choices if you want to analyze COM related things only. 3 | 4 | FindGUID supports the following GUID types: 5 | 6 | * Class ID 7 | * Interface ID 8 | * Folder ID 9 | * Media Type 10 | 11 | ## How to use 12 | Execute findguid.py on your IDA. Tested on IDA 7.6 for macOS/Windows. 13 | 14 | ## Todo 15 | 1. Additional GUID support 16 | 2. Performance improvement 17 | -------------------------------------------------------------------------------- /idapython_tools/695_to_7/README.md: -------------------------------------------------------------------------------- 1 | # 695 to 7 - IDAPython API name converter 2 | A Python script to convert IDAPython API names from 6.x to 7.x. Of course, it's not perfect because it only replaces API names by using regex. 3 | 4 | ## How to use 5 | Execute 695_to_7.py as the following: 6 | 7 | ``` 8 | $ python 695_to_7.py test.py 9 | [*] Read /Applications/IDA Pro 7.4/ida.app/Contents/MacOS/python/2/idc_bc695.py 10 | [*] Read 695_to_7_doc.html 11 | [*] Convert test.py 12 | def ScreenEA(): return get_screen_ea() 13 | def AskAddr(defval, prompt): return ida_kernwin.ask_addr(defval, prompt) 14 | def GetOpnd(ea, n): return print_operand(ea, n) 15 | [*] Save converted script as test_new.py 16 | [*] The script is using the following modules: 17 | ida_kernwin, idc 18 | $ 19 | $ diff test.py test_new.py 20 | 10,11c10,11 21 | < start_addr = AskAddr(ScreenEA(), 'Start address') 22 | < end_addr = AskAddr(ScreenEA(), 'End address') 23 | --- 24 | > start_addr = ida_kernwin.ask_addr(ida_kernwin.get_screen_ea(), 'Start address') 25 | > end_addr = ida_kernwin.ask_addr(ida_kernwin.get_screen_ea(), 'End address') 26 | 13c13 27 | < value = GetOpnd(head, 1) 28 | --- 29 | > value = idc.print_operand(head, 1) 30 | ``` 31 | 32 | The script attempts to download https://www.hex-rays.com/products/ida/support/idapython_docs/toc-everything.html if 695_to_7_doc.html doesn't exist. 33 | -------------------------------------------------------------------------------- /idapython_tools/findcrypt/README.md: -------------------------------------------------------------------------------- 1 | # FindCrypt 2 | A Python implementation of IDA FindCrypt/FindCrypt2 plugin (see http://www.hexblog.com/?p=28). 3 | 4 | ## How to use 5 | Execute findcrypt.py on your IDA. Tested on IDA 7.0+ for macOS. 6 | 7 | ## Supported constants 8 | * aPLib: aPLib_magic 9 | * xxHash32: xxHash32_PRIME32_[1-5] 10 | * xxHash64: xxHash64_PRIME64_[1-5] 11 | * zlib: zinflate_lengthStarts, zinflate_lengthExtraBits, zinflate_distanceStarts, zinflate_distanceExtraBits, zdeflate_lengthCodes 12 | * Adler-32: Adler32_BASE 13 | * Camellia: Camellia_sigma, Camellia_SBOX[1-4] 14 | * DES: DES_ip, DES_fp, DES_ei, DES_sbox[1-8], DES_p32i, DES_pc[1-2] 15 | * AES: Rijndael_sbox, Rijndael_inv_sbox, Rijndael_Te[0-4], Rijndael_Td[0-4] 16 | * Blowfish: Blowfish_P_array, Blowfish_S_boxes 17 | * CRC32: CRC32_m_tab_le, CRC32_m_tab_be 18 | * CRC64: CRC64_ECMA 19 | * FNV-1-32: FNV-1-32_prime, FNV-1-32_offset_basis 20 | * FNV-1-64: FNV-1-64_prime, FNV-1-64_offset_basis 21 | * MD5: MD5_T, MD5_initstate 22 | * RC5_RC6: RC5_RC6_PQ 23 | * Salsa20_ChaCha: Salsa20_ChaCha_sigma, Salsa20_ChaCha_tau 24 | * SHA1: SHA1_H 25 | * SHA224: SHA224_H 26 | * SHA256: SHA256_K, SHA256_H 27 | * SHA512: SHA512_K 28 | * (XX)TEA: (XX)TEA_delta 29 | * VEST: rns_w, rns_f, p5, vest_sbox, vest_f, vest_[4,8,16,32]_structure, provest_[4,8,16,32] 30 | 31 | ## Todo 32 | 1. Add more constants - I always welcome your pull request :) 33 | 2. Performance improvement 34 | -------------------------------------------------------------------------------- /idapython_tools/hide_junk_code.py: -------------------------------------------------------------------------------- 1 | import idc, idaapi, idautils, ida_bytes, ida_search, ida_segment 2 | #import time 3 | 4 | junk_patterns_x86 = [] 5 | junk_patterns_x64 = [] 6 | 7 | # .text:100046E4 004 90 nop 8 | # .text:100046E5 004 48 dec eax 9 | # .text:100046E6 004 40 inc eax 10 | # .text:100046E7 004 90 nop 11 | junk_patterns_x86.append(['90 48 40 90', 4]) 12 | junk_patterns_x86.append(['90 40 48 90', 4]) 13 | 14 | def get_code_segments(): 15 | segments = [] 16 | for ea in idautils.Segments(): 17 | s = ida_segment.getseg(ea) 18 | if ida_segment.get_segm_class(s) == 'CODE': 19 | segments.append(s) 20 | return segments 21 | 22 | def main(): 23 | print('[*] start debfuscation') 24 | 25 | for s in get_code_segments(): 26 | print('[*] try to deobfuscate {} section'.format(ida_segment.get_segm_name(s))) 27 | 28 | if s.use32(): 29 | junk_patterns = junk_patterns_x86 30 | elif s.use64(): 31 | junk_patterns = junk_patterns_x64 32 | else: 33 | print('[!] unsupported arch') 34 | 35 | print('[*] replace junk code to nop') 36 | for pattern, pattern_len in junk_patterns: 37 | addr_from = idc.find_binary(s.start_ea, ida_search.SEARCH_DOWN, pattern) 38 | while addr_from != idaapi.BADADDR and addr_from < s.end_ea: 39 | ida_bytes.patch_bytes(addr_from, '\x90'*pattern_len) 40 | addr_from = idc.find_binary(addr_from+pattern_len, ida_search.SEARCH_DOWN, pattern) 41 | 42 | print('[*] hide nop code') 43 | addr_from = ida_search.find_text(s.start_ea, 0, 0, 'nop', ida_search.SEARCH_CASE|ida_search.SEARCH_DOWN) 44 | while addr_from != idaapi.BADADDR and addr_from < s.end_ea: 45 | func_offset = idc.get_func_off_str(addr_from) 46 | if type(func_offset) == str and func_offset.find('+') == -1: 47 | addr_from = ida_search.find_text(idc.next_head(addr_from), 0, 0, 'nop', ida_search.SEARCH_CASE|ida_search.SEARCH_DOWN) 48 | else: 49 | i = 0 50 | while True: 51 | if ida_bytes.get_byte(addr_from+i) == 0x90: 52 | i += 1 53 | else: 54 | break 55 | if i >= 3: 56 | idc.add_hidden_range(addr_from, addr_from+i, 'nop', None, None, 0xFFFFFFFF) 57 | print("%08X" % addr_from) 58 | addr_from = ida_search.find_text(idc.next_head(addr_from+i), 0, 0, 'nop', ida_search.SEARCH_CASE|ida_search.SEARCH_DOWN) 59 | 60 | #print('[*] renanlyze') 61 | #idc.del_items(s.start_ea, size=s.size()) 62 | #time.sleep(1) 63 | #idc.plan_and_wait(s.start_ea, s.end_ea) 64 | print('[*] done') 65 | 66 | if __name__ == '__main__': 67 | main() 68 | -------------------------------------------------------------------------------- /idapython_tools/findguid/guid_list/media.txt: -------------------------------------------------------------------------------- 1 | 00000000-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_Base 2 | 00000001-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_PCM 3 | 00000009-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_DRM 4 | 0000000A-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMSP1 5 | 00000055-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_MP3 6 | 00000130-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_ACELPnet 7 | 00000161-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMAudioV8 8 | 00000162-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMAudioV9 9 | 00000163-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMAudio_Lossless 10 | 05589f80-c356-11ce-bf01-00aa0055595a WMFORMAT_VideoInfo 11 | 05589f81-c356-11ce-bf01-00aa0055595a WMFORMAT_WaveFormatEx 12 | 1d4a45f2-e5f6-4b44-8388-f0ae5c0e0c37 MEDIASUBTYPE_VIDEOIMAGE 13 | 30323449-0000-0010-8000-00AA00389B71 MEDIASUBTYPE_I420 14 | 31313259-0000-0010-8000-00AA00389B71 MEDIASUBTYPE_YV12 15 | 3153534D-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_MSS1 16 | 31564D57-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMV1 17 | 32323450-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_P422 18 | 32505657-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WVP2 19 | 3253344D-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_M4S2 20 | 3253534D-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_MSS2 21 | 32564D57-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMV2 22 | 32595559-0000-0010-8000-00AA00389B71 MEDIASUBTYPE_YUY2 23 | 3334504D-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_MP43 24 | 33564D57-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMV3 25 | 34A50FD8-8AA5-4386-81FE-A0EFE0488E31 WMMEDIATYPE_Image 26 | 39555659-0000-0010-8000-00AA00389B71 MEDIASUBTYPE_YVU9 27 | 41564D57-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMVA 28 | 50564D57-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_WMVP 29 | 5334504D-0000-0010-8000-00AA00389B71 WMMEDIASUBTYPE_MP4S 30 | 55595659-0000-0010-8000-00AA00389B71 MEDIASUBTYPE_YVYU 31 | 56555949-0000-0010-8000-00AA00389B71 MEDIASUBTYPE_IYUV 32 | 59565955-0000-0010-8000-00AA00389B71 MEDIASUBTYPE_UYVY 33 | 5C8510F2-DEBE-4ca7-BBA5-F07A104F8DFF WMFORMAT_Script 34 | 73636d64-0000-0010-8000-00AA00389B71 WMMEDIATYPE_Script 35 | 73646976-0000-0010-8000-00AA00389B71 WMMEDIATYPE_Video 36 | 73647561-0000-0010-8000-00AA00389B71 WMMEDIATYPE_Audio 37 | 776257d4-c627-41cb-8f81-7ac7ff1c40cc WMMEDIASUBTYPE_WebStream 38 | 82f38a70-c29f-11d1-97ad-00a0c95ea850 WMSCRIPTTYPE_TwoStrings 39 | 9BBA1EA7-5AB2-4829-BA57-0940209BCF3E WMMEDIATYPE_Text 40 | D9E47579-930E-4427-ADFC-AD80F290E470 WMMEDIATYPE_FileTransfer 41 | da1e6b13-8359-4050-b398-388e965bf00c WMFORMAT_WebStream 42 | e06d8026-db46-11cf-b4d1-00805f6cbbea WMMEDIASUBTYPE_MPEG2_VIDEO 43 | e06d80e3-db46-11cf-b4d1-00805f6cbbea WMFORMAT_MPEG2Video 44 | e436eb78-524f-11ce-9f53-0020af0ba770 MEDIASUBTYPE_RGB1 45 | e436eb79-524f-11ce-9f53-0020af0ba770 MEDIASUBTYPE_RGB4 46 | e436eb7a-524f-11ce-9f53-0020af0ba770 MEDIASUBTYPE_RGB8 47 | e436eb7b-524f-11ce-9f53-0020af0ba770 MEDIASUBTYPE_RGB565 48 | e436eb7c-524f-11ce-9f53-0020af0ba770 MEDIASUBTYPE_RGB555 49 | e436eb7d-524f-11ce-9f53-0020af0ba770 MEDIASUBTYPE_RGB24 50 | e436eb7e-524f-11ce-9f53-0020af0ba770 MEDIASUBTYPE_RGB32 51 | -------------------------------------------------------------------------------- /theme/forest.clr: -------------------------------------------------------------------------------- 1 | [DISASM] 2 | 000000 // 3 | cccccc //Default color 4 | 99f0a0 //Regular comment 5 | b3b3b3 //Repeatable comment 6 | b3b3b3 //Automatic comment 7 | f5f5f5 //Instruction 8 | 336699 //Dummy Data Name 9 | 00ff00 //Regular Data Name 10 | acefaf //Demangled Name 11 | f5f5f5 //Punctuation 12 | 6699cc //Char constant in instruction 13 | 00ff00 //String constant in instruction 14 | 6699cc //Numeric constant in instruction 15 | 6699cc //Void operand 16 | 008000 //Code reference 17 | 336699 //Data reference 18 | 0000ff //Code reference to tail byte 19 | 0000ff //Data reference to tail byte 20 | 0000ff //Error or problem 21 | c0c0c0 //Line prefix 22 | 005600 //Binary line prefix bytes 23 | acefaf //Extra line 24 | 00ff55 //Alternative operand 25 | 999999 //Hidden name 26 | 66ccff //Library function name 27 | 6699cc //Local variable name 28 | f5f5f5 //Dummy code name 29 | 00ff00 //Assembler directive 30 | 6699cc //Macro 31 | 6699cc //String constant in data directive 32 | 00b400 //Char constant in data directive 33 | 6699cc //Numeric constant in data directive 34 | f5f5f5 //Keywords 35 | f5f5f5 //Register name 36 | 0080ff //Imported name 37 | f5f5f5 //Segment name 38 | 408000 //Dummy unknown name 39 | 00ff00 //Regular code name 40 | 999999 //Regular unknown name 41 | 00ff55 //Collapsed line 42 | 000000 //Max color number 43 | 000000 //Line prefix: library function 44 | 00ff00 //Line prefix: regular function 45 | 66ccff //Line prefix: instruction 46 | f5f5f5 //Line prefix: data 47 | 008000 //Line prefix: unexplored 48 | 336699 //Line prefix: externs 49 | 999999 //Line prefix: current item 50 | 0080ff //Line prefix: current line 51 | 000000 //Punctuation 52 | 00ff00 //Opcode bytes 53 | 000000 //Manual operand 54 | [NAVBAR] 55 | 66ccff //Library function 56 | 00ff55 //Regular function 57 | 008000 //Instruction 58 | 004080 //Data item 59 | 666666 //Unexplored 60 | 0080ff //External symbol 61 | 5b5bff //Errors 62 | 000600 //Gaps 63 | f5f5f5 //Cursor 64 | f5f5f5 //Address 65 | [DEBUG] 66 | 00ff00 //Current IP 67 | 0080ff //Current IP (Enabled) 68 | 004080 //Current IP (Disabled) 69 | 008000 //Current IP (Unavailible) 70 | 0000ff //Address 71 | 004080 //Address (Enabled) 72 | b3b3b3 //Address (Disabled) 73 | b3b3b3 //Address (Unavailible) 74 | 000000 //Registers 75 | 004080 //Registers (Changed) 76 | 0080ff //Registers (Edited) 77 | [ARROW] 78 | ffffff //Jump in current function 79 | 236cff //Jump external to function 80 | 00ff00 //Jump under the cursor 81 | 008000 //Jump target 82 | ff4040 //Register target 83 | [GRAPH] 84 | f5f5f5 //Top color 85 | acefaf //Bottom color 86 | f5f5f5 //Normal title 87 | 00ff00 //Selected title 88 | cfcfa0 //Current title 89 | 00ffff //Group frame 90 | 000000 //Node shadow 91 | ffffcc //Highlight color 1 92 | ccffcc //Highlight color 2 93 | 0000ff //Foreign node 94 | ff0000 //Normal edge 95 | 008000 //Yes edge 96 | 0000ff //No edge 97 | ff00ff //Highlighted edge 98 | ffff00 //Current edge 99 | [MISC] 100 | f5f5f5 //Message text 101 | 000000 //Message background 102 | 404080 //Patched bytes 103 | 0080ff //Unsaved changes 104 | [OTHER] 105 | 66ffcc //Highlight color 106 | 000000 //Hint color 107 | [SYNTAX] 108 | ff0000 0 0 //Keyword 1 109 | 800080 0 0 //Keyword 2 110 | 0000ff 0 0 //Keyword 3 111 | 00008b 0 0 //String 112 | 006400 0 1 //Comment 113 | ff0000 1 0 //Preprocessor 114 | 8b8b00 1 0 //Number 115 | -------------------------------------------------------------------------------- /idapython_tools/695_to_7/695_to_7.py: -------------------------------------------------------------------------------- 1 | import platform, re, os 2 | import argparse 3 | 4 | if platform.system() == 'Darwin': 5 | BC695_FILE = '/Applications/IDA Pro 7.5/ida.app/Contents/MacOS/python/2/idc_bc695.py' 6 | elif platform.system() == 'Windows': 7 | BC695_FILE = 'C:\\Program Files\\IDA Pro 7.5\\python\\2\\idc_bc695.py' 8 | else: 9 | print('[!] Unsupported OS') 10 | exit() 11 | 12 | # def AskYN(defval, prompt): return ask_yn(defval, prompt) 13 | # Warning=ida_kernwin.warning 14 | DEF_PATTERNS = [re.compile(r'def ([^\(]+)\(.*\): return ([^\(]+)\(.*\)'), 15 | re.compile(r'(.+)=(.+)')] 16 | 17 | IDAPYTHON_DOC_URL = 'https://www.hex-rays.com/products/ida/support/idapython_docs/toc-everything.html' 18 | IDAPYTHON_DOC_HTML = os.path.join(os.path.dirname(__file__), '695_to_7_doc.html') 19 | 20 | def main(): 21 | parser = argparse.ArgumentParser(description="IDAPython API name converter") 22 | parser.add_argument("-o", "--out", action="store", dest="out", help="Specify output file name") 23 | parser.add_argument("FILE", help="Input IDAPython script") 24 | args = parser.parse_args() 25 | 26 | if args.out: 27 | out_file = args.out 28 | else: 29 | root, ext = os.path.splitext(args.FILE) 30 | out_file = root + "_new.py" 31 | 32 | print('[*] Read {}'.format(BC695_FILE)) 33 | fp = open(BC695_FILE, 'r') 34 | bc695 = [] 35 | for line in fp.readlines(): 36 | line = line.strip('\n') 37 | for pattern in DEF_PATTERNS: 38 | m = re.match(pattern, line) 39 | if m: 40 | bc695.append([m.group(1), m.group(2), line]) 41 | break 42 | fp.close() 43 | 44 | if os.path.exists(IDAPYTHON_DOC_HTML): 45 | print('[*] Read {}'.format(IDAPYTHON_DOC_HTML)) 46 | fp = open(IDAPYTHON_DOC_HTML, 'r') 47 | text = fp.read() 48 | fp.close() 49 | else: 50 | print('[*] Obtain new API name list from {}'.format(IDAPYTHON_DOC_URL)) 51 | import requests 52 | response = requests.get(IDAPYTHON_DOC_URL) 53 | text = response.text 54 | fp = open(IDAPYTHON_DOC_HTML, 'w') 55 | fp.write(text) 56 | fp.close() 57 | html_tag_pattern = re.compile(r"<[^>]*?>") 58 | new_names = sorted(set(html_tag_pattern.sub("", text).split(' ')), reverse=True) 59 | 60 | replace_list = [] 61 | for old, new, line in bc695: 62 | if new.isdigit() or new.startswith('0x') or len(new.split('.')) == 2: 63 | replace_list.append([old, new, line]) 64 | continue 65 | for name in new_names: 66 | if new in name: 67 | replace_list.append([old, name, line]) 68 | break 69 | 70 | print('[*] Convert {}'.format(args.FILE)) 71 | fp = open(args.FILE, 'r') 72 | data = fp.read() 73 | fp.close() 74 | used_modules = [] 75 | flag_modified = False 76 | for old, new, line in replace_list: 77 | tmp = re.sub(re.compile(r'([ \n])(idc\.|idaapi\.)*'+old), r'\1'+new, data) 78 | if data != tmp: 79 | flag_modified = True 80 | print(format(line)) 81 | used_modules.append(new.split('.')[0]) 82 | data = tmp 83 | 84 | if flag_modified: 85 | fp = open(out_file, 'w') 86 | fp.write(data) 87 | fp.close() 88 | print('[*] Save converted script as {}'.format(out_file)) 89 | print('[*] The script is using the following modules:\n{}'.format(', '.join(set(used_modules)))) 90 | else: 91 | print('[*] Nothing to do') 92 | 93 | if __name__ == "__main__": 94 | main() -------------------------------------------------------------------------------- /idapython_tools/findguid/findguid.py: -------------------------------------------------------------------------------- 1 | import idc, idaapi, ida_search, ida_name, ida_bytes, ida_pro 2 | import os, binascii, struct 3 | 4 | try: 5 | import ida_struct 6 | add_struc = ida_struct.add_struc 7 | get_struc_id = ida_struct.get_struc_id 8 | add_struc_member = ida_struct.add_struc_member 9 | get_struc_size = ida_struct.get_struc_size 10 | get_struc = ida_struct.get_struc 11 | get_member_by_name = ida_struct.get_member_by_name 12 | except ModuleNotFoundError: 13 | # from IDA 9.0, many of them are in idc. 14 | add_struc = idc.add_struc 15 | get_struc_id = idc.get_struc_id 16 | add_struc_member = idc.add_struc_member 17 | get_struc_size = idc.get_struc_size 18 | 19 | # for IDA 9.0 20 | # Some of them are needed to implement. 21 | def get_struc(struct_tid): 22 | tif = ida_typeinf.tinfo_t() 23 | if tif.get_type_by_tid(struct_tid): 24 | if tif.is_struct(): 25 | return tif 26 | return ida_idapi.BADADDR 27 | 28 | def get_member_by_name(tif, name): 29 | if not tif.is_struct(): 30 | return None 31 | 32 | udm = ida_typeinf.udm_t() 33 | udm.name = name 34 | idx = tif.find_udm(udm, ida_typeinf.STRMEM_NAME) 35 | if idx != -1: 36 | return udm 37 | return None 38 | 39 | GUID_LIST_DIR = os.path.join(os.path.dirname(__file__), 'guid_list') 40 | GUID_LIST= [] 41 | # [name, prefix, filepath] 42 | GUID_LIST.append(['Class ID', 'CLSID_', os.path.join(GUID_LIST_DIR, 'class.txt')]) 43 | GUID_LIST.append(['Interface ID', 'IID_', os.path.join(GUID_LIST_DIR, 'interface.txt')]) 44 | GUID_LIST.append(['Folder ID', 'FOLDERID_', os.path.join(GUID_LIST_DIR, 'folder.txt')]) 45 | GUID_LIST.append(['Media Type', '', os.path.join(GUID_LIST_DIR, 'media.txt')]) 46 | 47 | def get_guid_tid(): 48 | tid = get_struc_id('GUID') 49 | if tid == idaapi.BADADDR: 50 | print("[*] create GUID struct") 51 | tid = add_struc(0xffffffff, 'GUID', 0) 52 | sptr = get_struc(tid) 53 | add_struc_member(sptr, 'Data1', 0x0, 0x20000000, None, 4) 54 | add_struc_member(sptr, 'Data2', 0x4, 0x10000000, None, 2) 55 | add_struc_member(sptr, 'Data3', 0x6, 0x10000000, None, 2) 56 | add_struc_member(sptr, 'Data4', 0x8, 0x00000000, None, 8) 57 | return tid 58 | 59 | def make_binary_pattern(guid): 60 | # sample guid: 0F87369F-A4E5-4CFC-BD3E-73E6154572DD 61 | tmp = guid.split('-') 62 | data = b'' 63 | data += struct.pack('H', int(tmp[3], 16)) 67 | data += binascii.a2b_hex(tmp[4]) 68 | 69 | binary_pattern = ' '.join(map(lambda x:format(x if type(x) == int else ord(x), '02x'), list(data))) 70 | return binary_pattern 71 | 72 | def main(): 73 | tid = get_guid_tid() 74 | for type_name, type_prefix, filepath in GUID_LIST: 75 | print('[*] scanning {}'.format(type_name)) 76 | fp = open(filepath, 'r') 77 | for line in fp.readlines(): 78 | line = line.strip() 79 | if line == "": 80 | continue 81 | guid, guid_name = line.split(' ') 82 | guid_name = type_prefix + guid_name 83 | binary_pattern = make_binary_pattern(guid) 84 | 85 | ea = 0 86 | while True: 87 | if ida_pro.IDA_SDK_VERSION >= 900: 88 | ea = ida_bytes.find_bytes(binary_pattern, ea, flags=ida_bytes.BIN_SEARCH_FORWARD | ida_bytes.BIN_SEARCH_NOSHOW) 89 | else: 90 | ea = idc.find_binary(ea, ida_search.SEARCH_DOWN | ida_search.SEARCH_NEXT | ida_search.SEARCH_NOSHOW, binary_pattern) 91 | if ea == idaapi.BADADDR: 92 | break 93 | 94 | idc.del_items(ea, 16, 0) 95 | ida_bytes.create_struct(ea, get_struc_size(tid), tid) 96 | if idc.set_name(ea, guid_name, ida_name.SN_NOWARN) != 1: 97 | for i in range(0, 100): 98 | if idc.set_name(ea, guid_name + "_" + str(i), ida_name.SN_NOWARN) == 1: 99 | break 100 | else: 101 | print("[!] 0x{:X}: failed to apply {}".format(ea, guid_name)) 102 | print("[*] 0x{:X}: {}".format(ea, guid_name)) 103 | 104 | # add a byte size for find_bytes because it does not have SEARCH_NEXT option like find_binary 105 | if ida_pro.IDA_SDK_VERSION >= 900: 106 | ea += 1 107 | 108 | print("[*] finished") 109 | 110 | if __name__ == "__main__": 111 | main() 112 | -------------------------------------------------------------------------------- /idapython_tools/findguid/guid_list/folder.txt: -------------------------------------------------------------------------------- 1 | 008CA0B1-55B4-4C56-B8A8-4DE4B299D3BE AccountPictures 2 | 00BCFC5A-ED94-4e48-96A1-3F6217F21990 RoamingTiles 3 | 0139D44E-6AFE-49F2-8690-3DAFCAE6FFB8 CommonPrograms 4 | 0482AF6C-08F1-4C34-8C90-E17EC98B1E17 PublicUserTiles 5 | 054FAE61-4DD8-4787-80B6-090220C4B700 GameTasks 6 | 0762D272-C50A-4BB0-A382-697DCD729B80 UserProfiles 7 | 0AC0837C-BBF8-452A-850D-79D08E667CA7 ComputerFolder 8 | 0F214138-B1D3-4a90-BBA9-27CBC0C5389A SyncSetupFolder 9 | 15CA69B3-30EE-49C1-ACE1-6B5EC372AFB5 SamplePlaylists 10 | 1777F761-68AD-4D8A-87BD-30B759FA33DD Favorites 11 | 18989B1D-99B5-455B-841C-AB7C74E4DDFC Videos 12 | 190337D1-B8CA-4121-A639-6D472D16972A SearchHome 13 | 1A6FDBA2-F42D-4358-A798-B74D745926C5 RecordedTVLibrary 14 | 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7 System 15 | 1B3EA5DC-B587-4786-B4EF-BD1DC332AEAE Libraries 16 | 1E87508D-89C2-42F0-8A7E-645A0F50CA58 AppsFolder 17 | 2112AB0A-C86A-4FFE-A368-0DE96E47012E MusicLibrary 18 | 2400183A-6185-49FB-A2D8-4A392A602BA3 PublicVideos 19 | 289A9A43-BE44-4057-A41B-587A76D7E7F9 SyncResultsFolder 20 | 2A00375E-224C-49DE-B8D1-440DF7EF3DDC LocalizedResourcesDir 21 | 2B0F765D-C0E9-4171-908E-08A611B84FF6 Cookies 22 | 2C36C0AA-5812-4b87-BFD0-4CD0DFB19B39 OriginalImages 23 | 3214FAB5-9757-4298-BB61-92A9DEAA44FF PublicMusic 24 | 33E28130-4E1E-4676-835A-98395C3BC3BB Pictures 25 | 352481E8-33BE-4251-BA85-6007CAEDCF9D InternetCache 26 | 374DE290-123F-4565-9164-39C4925E467B Downloads 27 | 3D644C9B-1FB8-4f30-9B45-F670235F79C0 PublicDownloads 28 | 3EB685DB-65F9-4CF6-A03A-E3EF65729F3D RoamingAppData 29 | 43668BF8-C14E-49B2-97C9-747784D784B7 SyncManagerFolder 30 | 48DAF80B-E6CF-4F4E-B800-0E69D84EE384 PublicLibraries 31 | 491E922F-5643-4AF4-A7EB-4E7A138D8174 VideosLibrary 32 | 4C5C32FF-BB9D-43b0-B5B4-2D72E54EAAA4 SavedGames 33 | 4D9F7874-4E0C-4904-967B-40B0D20C3E4B InternetFolder 34 | 4bfefb45-347d-4006-a5be-ac0cb0567192 ConflictFolder 35 | 52528A6B-B9E3-4ADD-B60D-588C2DBA842D HomeGroup 36 | 52a4f021-7b75-48a9-9f6b-4b87a210bc8f QuickLaunch 37 | 56784854-C6CB-462b-8169-88E350ACB882 Contacts 38 | 5CD7AEE2-2219-4A67-B85D-6C9CE15660CB UserProgramFiles 39 | 5CE4A5E9-E4EB-479D-B89F-130C02886155 DeviceMetadataStore 40 | 5E6C858F-0E22-4760-9AFE-EA3317B67173 Profile 41 | 625B53C3-AB48-4EC1-BA1F-A1EF4146FC19 StartMenu 42 | 62AB5D82-FDC1-4DC3-A9DD-070D1D495D97 ProgramData 43 | 69D2CF90-FC33-4FB7-9A0C-EBB0F0FCB43C PhotoAlbums 44 | 6D809377-6AF0-444b-8957-A3773F02200E ProgramFilesX64 45 | 6F0CD92B-2E97-45D1-88FF-B0D186B8DEDD ConnectionsFolder 46 | 724EF170-A42D-4FEF-9F26-B60E846FBA4F AdminTools 47 | 76FC4E2D-D6AD-4519-A663-37BD56068185 PrintersFolder 48 | 7B0DB17D-9CD2-4A93-9733-46CC89022E7C DocumentsLibrary 49 | 7B396E54-9EC5-4300-BE0A-2482EBAE1A26 SidebarDefaultParts 50 | 7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E ProgramFilesX86 51 | 7D1D3A04-DEBB-4115-95CF-2F29DA2920DA SavedSearches 52 | 82A5EA35-D9CD-47C5-9629-E15D2F714E6E CommonStartup 53 | 82A74AEB-AEB4-465C-A014-D097EE346D63 ControlPanelFolder 54 | 859EAD94-2E85-48AD-A71A-0969CB56A6CD SampleVideos 55 | 8983036C-27C0-404B-8F08-102D10DCFD74 SendTo 56 | 8AD10C31-2ADB-4296-A8F7-E4701232C972 ResourceDir 57 | 905E63B6-C1BF-494E-B29C-65B732D3D21A ProgramFiles 58 | 9274BD8D-CFD1-41C3-B35E-B13F55A758F4 PrintHood 59 | 98EC0E18-2098-4D44-8644-66979315A281 SEARCH_MAPI 60 | 9B74B6A3-0DFD-4f11-9E78-5F7800F2E772 HomeGroupCurrentUser 61 | 9E3995AB-1F9C-4F13-B827-48B24B6C7174 UserPinned 62 | 9E52AB10-F80D-49DF-ACB8-4330F5687855 CDBurning 63 | A302545D-DEFF-464b-ABE8-61C8648D939B UsersLibraries 64 | A305CD99-F527-492B-8B1A-7E76FA98D6E4 AppUpdates 65 | A3918781-E5F2-4890-B3D9-A7E54332328C ApplicationShortcuts 66 | A4115719-D62E-491D-AA7C-E74B8BE3B067 CommonStartMenu 67 | A520A1A4-1780-4FF6-BD18-167343C5AF16 LocalAppDataLow 68 | A63293E8-664E-48DB-A079-DF759E0509F7 Templates 69 | A75D362E-50FC-4fb7-AC2C-A8BEAA314493 SidebarParts 70 | A77F5D77-2E2B-44C3-A6A2-ABA601054A51 Programs 71 | A990AE9F-A03B-4E80-94BC-9912D7504104 PicturesLibrary 72 | AAA8D5A5-F1D6-4259-BAA8-78E7EF60835E RoamedTileImages 73 | AE50C081-EBD2-438A-8655-8A092E34987A Recent 74 | B250C668-F57D-4EE1-A63C-290EE7D1AA1F SampleMusic 75 | B4BFCC3A-DB2C-424C-B029-7FE99A87C641 Desktop 76 | B6EBFB86-6907-413C-9AF7-4FC2ABF07CC5 PublicPictures 77 | B7534046-3ECB-4C18-BE4E-64CD4CB7D6AC RecycleBinFolder 78 | B7BEDE81-DF94-4682-A7D8-57A52620B86F Screenshots 79 | B94237E7-57AC-4347-9151-B08C6C32D1F7 CommonTemplates 80 | B97D20BB-F46A-4C97-BA10-5E3608430854 Startup 81 | BCB5256F-79F6-4CEE-B725-DC34E402FD46 ImplicitAppShortcuts 82 | BCBD3057-CA5C-4622-B42D-BC56DB0AE516 UserProgramFilesCommon 83 | BFB9D5E0-C6A9-404C-B2B2-AE6DB6AF4968 Links 84 | C1BAE2D0-10DF-4334-BEDD-7AA20B227A9D CommonOEMLinks 85 | C4AA340D-F20F-4863-AFEF-F87EF2E6BA25 PublicDesktop 86 | C5ABBF53-E17F-4121-8900-86626FC2C973 NetHood 87 | C870044B-F49E-4126-A9C3-B52A1FF411E8 Ringtones 88 | CAC52C1A-B53D-4edc-92D7-6B2E8AC19434 Games 89 | D0384E7D-BAC3-4797-8F14-CBA229B392B5 CommonAdminTools 90 | D20BEEC4-5CA8-4905-AE3B-BF251EA09B53 NetworkFolder 91 | D65231B0-B2F1-4857-A4CE-A8E7C6EA7D27 SystemX86 92 | D9DC8A3B-B784-432E-A781-5A1130A75963 History 93 | DE61D971-5EBC-4F02-A3A9-6C82895E5C04 AddNewPrograms 94 | DE92C1C7-837F-4F69-A3BB-86E631204A23 Playlists 95 | DE974D24-D9C6-4D3E-BF91-F4455120B917 ProgramFilesCommonX86 96 | DEBF2536-E1A8-4c59-B6A2-414586476AEA PublicGameTasks 97 | DF7266AC-9274-4867-8D55-3BD661DE872D ChangeRemovePrograms 98 | DFDF76A2-C82A-4D63-906A-5644AC457385 Public 99 | E555AB60-153B-4D17-9F04-A5FE99FC15EC PublicRingtones 100 | EE32E446-31CA-4ABA-814F-A5EBD2FD6D5E SEARCH_CSC 101 | F1B32785-6FBA-4FCF-9D55-7B8E7F157091 LocalAppData 102 | F38BF404-1D43-42F2-9305-67DE0B28FC23 Windows 103 | F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F UsersFiles 104 | F7F1ED05-9F6D-47A2-AAAE-29D317C6F066 ProgramFilesCommon 105 | FD228CB7-AE11-4AE3-864C-16F3910AB8FE Fonts 106 | -------------------------------------------------------------------------------- /idapython_tools/findcrypt/findcrypt.py: -------------------------------------------------------------------------------- 1 | import struct, copy 2 | import idc, idautils, ida_name, ida_bytes, ida_ua, ida_search 3 | from consts import non_sparse_consts, sparse_consts, operand_consts 4 | 5 | if 'g_fc_prefix_cmt' not in globals(): 6 | g_fc_prefix_cmt = "FC: " 7 | if 'g_fc_prefix_var' not in globals(): 8 | g_fc_prefix_var = "FC_" 9 | 10 | if idc.BADADDR == 0xFFFFFFFF: 11 | digits = 8 12 | else: 13 | digits = 16 14 | 15 | def convert_to_byte_array(const, big_endian=False): 16 | byte_array = [] 17 | if const["size"] == "B": 18 | byte_array = const["array"] 19 | elif const["size"] == "L": 20 | for val in const["array"]: 21 | if big_endian: 22 | byte_array += list(map(lambda x:x if type(x) == int else ord(x), struct.pack(">L", val))) 23 | else: 24 | byte_array += list(map(lambda x:x if type(x) == int else ord(x), struct.pack("Q", val))) 29 | else: 30 | byte_array += list(map(lambda x:x if type(x) == int else ord(x), struct.pack("