Page 1 of 3 123 LastLast
Results 1 to 15 of 35

Thread: new IDA 5.0 plugin

  1. #1

    Thumbs up new IDA 5.0 plugin

    I wrote new IDA plugin.

    It loads obj and lib (COFF format) files signature to ida database..

    it identifies so many labels more than flair signatures..

    you can try..

    (
    i use it for flexlm cracking.. you can load lmgr.lib to ida database
    )
    Attached Files Attached Files

  2. #2
    King of Redonda
    Join Date
    Jul 2006
    Posts
    109
    Blog Entries
    4
    Seems pretty useful. Thanks.
    <[TN]FBMachine> i got kicked out of barnes and noble once for moving all the bibles into the fiction section

  3. #3
    Quote Originally Posted by gerbay View Post
    I wrote new IDA plugin.

    It loads obj and lib (COFF format) files signature to ida database..
    I downloaded and installed it, and now I'm curious as how it works?
    Could you tell us a little bit of its internals?

    thanks!

  4. #4
    evilkings
    Guest

    can you pls share the src code ?

    can you pls share the src code ?
    it will be useful to us to add more into that. Thanks
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  5. #5
    Reversing Since '98 \o/ [yAtEs]'s Avatar
    Join Date
    Feb 2002
    Posts
    97
    Blog Entries
    2
    If used correctly flirt signatures are created from libs and obj so i dont
    see how this is any different

  6. #6
    evilkings
    Guest

    Thanks ;)

    thanks .. still having the code is good to learn
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  7. #7

    Thumbs up I upload my ida plugin with source code...

    FLIRT signature creation not possible for some situation, for example you can try to create flirt signature for flexlm libs..

    my plugin is free... you can use if you wants...

    thanks for all..

    gerbay...
    Attached Files Attached Files

  8. #8
    thanks a lot!!!
    I'll take a look, and if possible, I'll try to contribute as a "thank you"

  9. #9
    hehe,

    gerbay

    i did also not try it, just looked at the source. cool, its also a nice reference how to add fileformats to ida (for me, thank u )

    regards, 0xf001

  10. #10
    ::[ Reverse Engineer ]:: OHPen's Avatar
    Join Date
    Nov 2002
    Location
    .text
    Posts
    399
    Blog Entries
    5
    Hey,

    @gerbay: Nice plug, i tested it with flexlm for example. I tried my sigs and also your plugin with the correct library. Seems that your plugin is recognizing more functions than the signature approach.

    I will try it in future on other targets.

    Cheers,

    PAPi
    - Reverse Enginnering can be everything, but sometimes it's more than nothing. Really rare moments but then they appear to last ages... -

  11. #11
    Leo_Jiang
    Guest
    Thanks for your codes!
    It is very useful!
    I promise that I have read the FAQ and tried to use the Search to answer my question.

  12. #12
    Thanks a lot, gerbay.
    With this plugin, I have import MFC Static lib into a MFC static dll. It is very good. My MFC signatures files does not reveal many symbols.

  13. #13
    Administrator dELTA's Avatar
    Join Date
    Oct 2000
    Location
    Ring -1
    Posts
    4,204
    Blog Entries
    5
    Nice work gerbay! (and nice to see you're still around TQN)
    "Give a man a quote from the FAQ, and he'll ignore it. Print the FAQ, shove it up his ass, kick him in the balls, DDoS his ass and kick/ban him, and the point usually gets through eventually."

  14. #14
    Hi gerbay !
    Sometimes your plugin causes IDA crash. Can I debug, find the bug and modify your code ?
    Regards,

  15. #15

    of course..

    Quote Originally Posted by TQN View Post
    Hi gerbay !
    Sometimes your plugin causes IDA crash. Can I debug, find the bug and modify your code ?
    Regards,

    please, feel free the modifing my code..

    if you find bug please post it the forum.

Similar Threads

  1. [plugin] OllyScript v0.8
    By psyCK0 in forum OllyScript Plugin
    Replies: 13
    Last Post: October 27th, 2004, 10:16
  2. [plugin] OllyScript v0.85
    By psyCK0 in forum OllyScript Plugin
    Replies: 3
    Last Post: May 21st, 2004, 03:13
  3. [plugin] OllyScript v0.7
    By psyCK0 in forum OllyScript Plugin
    Replies: 5
    Last Post: April 18th, 2004, 11:32
  4. [plugin] OllyScript v0.6
    By psyCK0 in forum OllyScript Plugin
    Replies: 24
    Last Post: March 10th, 2004, 17:41
  5. [plugin] OllyScript v0.5
    By psyCK0 in forum OllyScript Plugin
    Replies: 21
    Last Post: February 18th, 2004, 10:53

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •