IDA-Pro-7.7-反汇编程序_计算从溢出点到函数返回点之间的偏移量放入ida中资源-CSDN文库

共2000个文件

py：1329个

pyc：828个

dll：326个

需积分: 5 68 浏览量 2022-11-24 16:57:58 上传评论 1 收藏 507.65MB ZIP 举报

资源推荐

资源详情

资源评论

收起资源包目录

IDA-Pro-7.7-反汇编程序（2000个子文件）

Apache-license-2.0 11KB

SDK77.7z 30.31MB

Keygen.7z 1.91MB

python38._pth 78B

android_server 784KB

android_server64 1.19MB

android_x64_server 1.17MB

android_x86_server 1.1MB

armlinux_server 638KB

pdb64.dll.bak 423KB

pdb.dll.bak 423KB

sha1thumb.c 11KB

sha1.c 11KB

get_key_armv7_thumb.c 4KB

get_key.c 3KB

malloc.c 237B

7355608.c4 13KB

python.cat 536KB

idacolor.cf 218B

pic33.cfg 34.02MB

pic24.cfg 21.51MB

pic14.cfg 9.16MB

78k0.cfg 2.73MB

c166.cfg 1.83MB

pic30.cfg 1.58MB

78k0s.cfg 1.23MB

6812.cfg 1.2MB

6808.cfg 1.19MB

m32r.cfg 1.16MB

6811.cfg 1.01MB

6805.cfg 1.01MB

clsid.cfg 1016KB

st7.cfg 909KB

avr.cfg 785KB

st10.cfg 782KB

c166v2.cfg 732KB

tricore.cfg 694KB

r32c.cfg 595KB

i51.cfg 483KB

f2mc16lx.cfg 389KB

sh3.cfg 313KB

m7700.cfg 305KB

m7900.cfg 293KB

c166v1.cfg 194KB

f2mc16l.cfg 178KB

super10.cfg 112KB

pic12.cfg 98KB

hcs12.cfg 79KB

ida.cfg 71KB

idagui.cfg 70KB

atrap.cfg 65KB

m32c80.cfg 61KB

m16c80.cfg 48KB

hcs12x.cfg 45KB

ppc.cfg 43KB

m16c60.cfg 41KB

m65816.cfg 34KB

rl78.cfg 24KB

idatui.cfg 22KB

i960.cfg 21KB

xbe.cfg 19KB

goodname.cfg 18KB

hexrays.cfg 17KB

dbg_gdb.cfg 17KB

hexray6.cfg 17KB

riscv.cfg 16KB

hexray5.cfg 16KB

pic16.cfg 16KB

exceptions.cfg 16KB

hpux.cfg 15KB

h8.cfg 12KB

dbg_ios.cfg 11KB

dwarf.cfg 11KB

tlcs900.cfg 11KB

c39.cfg 11KB

fr.cfg 10KB

dbg_xnu.cfg 10KB

cr16.cfg 9KB

z180.cfg 9KB

6816.cfg 9KB

tms320c3.cfg 9KB

psx.cfg 8KB

arc.cfg 8KB

m740.cfg 6KB

gdb_arch.cfg 6KB

dsp563xx.cfg 5KB

tms320c54.cfg 5KB

alpha.cfg 4KB

plugins.cfg 4KB

xtensa.cfg 4KB

z8.cfg 4KB

idaclang.cfg 4KB

sysconfig.cfg 3KB

dbg_bochs.cfg 3KB

mn102l00.cfg 3KB

mc68kvec.cfg 2KB

noret.cfg 2KB

pdb.cfg 2KB

autoload.cfg 2KB

dsp561xx.cfg 2KB

共 2000 条

Diaphora – An IDA Python BinDiffing plugin
Index
Introduction..........................................................................................................................................2
Files distributed with the diaphora distribution...............................................................................2
Running Diaphora............................................................................................................................2
Diaphora quick start.............................................................................................................................4
Finding differences in new versions (Patch diffing)........................................................................4
Ignoring small differences (Finding new functionalities)..............................................................10
Porting symbols.............................................................................................................................12
Diffing huge databases (or exporting smaller .SQLite databases).................................................15
Heuristics............................................................................................................................................16
Best matches..................................................................................................................................16
Partial and unreliabe matches (according to the confidence's ratio):.............................................16
Unreliable matches........................................................................................................................18
Experimental (and likely to be removed or moved or changed in the future):..............................18

Introduction

Diaphora is a plugin for IDA Pro that aims to help in the typical BinDiffing tasks. It's similar to

other competitor products and open source projects like Zynamics BinDiff, DarunGrim or

TurboDiff. However, it's able to perform more actions than any of the previous IDA plugins or

projects.

In the next paragraphs, I will describe how to use it in different scenarios.

Files distributed with the diaphora distribution

Diaphora is distributed as a compressed file with various files and folders inside it. The structure is

similar to the following one:

1. diaphora.py: The main IDAPython plugin. It contains all the code of the heuristics, graphs

displaying, export interface, etc...

2. jkutils/kfuzzy.py: This is an unmodified version of the kfuzzy.py library, part of the

DeepToad project, a tool and a library for performing fuzzy hashing of binary files. It's

included because fuzzy hashes of pseudo-codes are used as part of the various heuristics

implemented.

3. jkutils/factor.py: This is a modified version of a private malware clusterization toolkit based

on graphs theory. This library offers the ability to factor numbers quickly in Python and,

also, to compare arrays of prime factors. Diaphora uses it to compare fuzzy AST hashes and

call graph fuzzy hashes based on small-primes-products (an idea coined and implemented by

Thomas Dullien and Rolf Rolles first, authors or former authors of the Zynamics BinDiff

commercial product, in their “Graph-based comparison of Executable Objects – Zynamics”

paper).

4. Pygments/: This directoy contains an unmodified distribution of the Python pygments

library, a “generic syntax highlighter suitable for use in code hosting, forums, wikis or other

applications that need to prettify source code”.

Running Diaphora

Diaphora can only be used by running the script, as of March 2015. Initially, during the BETA

phases, there was support for installing it as a true IDA plugin. However, it causes a lot of

maintenance problems, like finding workarounds for known IDA problems and bugs. As so, and

because during the beta phase more time was expended in finding workarounds to different IDA

bugs and problems with many different versions of IDA than actually fixing bugs on Diaphora, the

support have been dropped. It may be added back again at some point in the future, but is unlikely.

So, in order to run Diaphora, simply, unpack the compressed distribution file wherever you prefer

and directly execute “diaphora.py” from the IDA Pro menu File → Script file. Once the script

diaphora.py is executed, a dialog like the following one will be opened:

This dialog, although it can be a bit confusing at first, is used for both exporting the current IDA

database to SQLite format as well as for performing diffing against another SQLite exported format

database.

The first field, is the path of the SQLite file format database that will be created with all the

information extracted from the current database. The 2nd field is the other SQLite format database

to diff the current database against. If this field is left empty, Diaphora will just export the current

database to SQLite format. If the 2nd field is not empty, it will diff both databases.

The other fields, the check-boxes, are explained bellow:

1. Use the decompiler if available. If the Hex-Rays decompiler is installed with IDA and IDA

Python bindings are available, Diaphora will use the decompiler to get many interesting

information that will help during the bindiffing process.

2. Export only non-IDA generated functions. Self-explanatory, only functions with non IDA

autogenerated names will be exported.

3. Do not export instructions and basic blocks. Export only function summaries. When

exporting huge databases, it may help speeding up operations. However, the diffing

capabilities will be more limited.

4. Use probably unreliable methods. Diaphora uses many heuristics to try to match functions

in both databases being compared. However, some heuristics are not really reliable or the

ratio of similarity is very low. Check this box if you want to see also the likely unreliable

matches Diaphora my find. Unreliable results are shown in a specific list, it doesn't mix the

“Best results” (results with a ratio of 1.00) with the “Partial results” (results with a ratio of

0.50 or higher) or “Unreliable results”.

5. Use slow heuristics. Some heuristics can be quite expensive and take long. For medium to

big databases, it's disabled by default and is recommended to left unchecked unless the

results from a execution with this option disabled are not good enough. It will likely find

more better matches than the normal, not that slow, heuristics, but it will take significantly

longer.

6. Relaxed calculations of difference ratios. Diaphora uses, by default, a kind of aggressive

method to calculate difference ratios between matches. It's possible to relax that

aggressiveness level by checking this option. Under the hood, the function

SequenceMatcher.quick_ratio is used when this option is unchecked and

SequenceMatcher.real_quick_ratio when this option is checked. Also, when the option is

checked, Diaphora will use too the difference ratio of the primes numbers calculated from

the AST of the pseudo-code of the 2 functions, calculating the highest ratio from the AST,

assembly and pseudo-code comparisons.

7. Use experimental heuristics. It says it all: experimental heuristics are enabled only if this

check-box is marked. Disabled by default as they are likely not useful.

8. Ignore automatically generated names. When performing the comparison between

databases, it tells Diaphora to ignore in the “Same name” heuristic functions with the same

IDA's autogenerated name (i.e., when there are two function sub_01020304 in both

databases but they aren't actually the same function). Used only when comparing.

9. Ignore all function names. Just disable the “Same name” heuristic. Used only when

comparing.

10. Ignore small functions. Ignore functions with less than 6 assembly instructions. Used only

when comparing.

Diaphora quick start

Finding differences in new versions (Patch diffing)

In order to use Diaphora we need at least two binary files to compare. I will take as example 2

different versions of the “avast” binary from Avast for Linux x86_64. The files has the following

hashes:

1. c0092cf0cb1286cfd8399681bcab68a4 avast-2014

2. 716ff77e74e47d3ee619df49995536ec avast

The file “avast-2014” is an old version from 2014 and the binary “avast” is the latest version.

Launch IDA Pro for 64 bits (idaq64) and open the file “avast-2014”. Once the initial auto-analysis

finishes launch Diaphora by either running the script “diaphora.py”. The following dialog will

open:

We only need to care about 2 things:

1. Field “Export current database to SQLite”. This is the path to the SQLite database that

will be created with all the information extracted from the IDA database of this avast binary.

2. Field “Use the decompiler if available”. If the Hex-Rays decompiler is available and we

want to use it, we will leave this check-box marked, otherwise uncheck it.

After correctly selecting the appropriate values, press OK. It will start exporting all the data from

the IDA database. When export process finishes the message “Database exported.” will appear in

the IDA's Output Window.

Now, close this database, save the changes and open the “avast” binary. Wait until the IDA's auto-

analysis finishes and, after it, run Diaphora like with the previous binary file. This time, we will

select in the 2nd field, the one name “SQLite database to diff”, the path to the .sqlite file we just

exported in the previous step, as shown in the next figure:

评论收藏

内容反馈

西伯利亚鹰

粉丝: 29
资源: 28

IDA-Pro-7.7-反汇编程序

IDA-Pro-7.7-全插件版

Ida-Pro-64-full-Test3-By-Dalao-file1

用于Hex-Ray的IDA-Pro的IDA批反编译插件和脚本

Ida-Pro-64-full-Test3-By-Dalao-file2

IDA反汇编工具视频全集

ida-evm-master

《反汇编分析工具》 （Hex-Rays IDA Pro）v6.1 Advanced （一）

IDA-Pro-5.4.chm.zip_ ida_IDA Pro_IDA Pro 5_ida

基于IDA-Pro 的软件逆向分析方法

IDA-Pro-5.4-help-chinese.rar_Help!_IDA Pro_IDA chinese_ida_ida p

IDA反汇编程序教程

塞尔瑟斯IDA-100辐射式电子风量罩简介说明.pdf

IDA PRO 教程-IDA图形工具.pdf

塞尔瑟斯ida-100辐射式电子风量罩中文使用说明书.pdf

DirectX修复工具V4.3增强版

免费插件-AI插件-illustrator插件集合-尺寸标注-智能填充-颜色自动处理-自动批处理-Windows安装包.zip

VS2022 VISUAL ASSIST X 小番茄 v10.9.2435.0 VA_X_Setup2440_0.exe

dll修复工具，修复windows xxxx.dll丢失问题，完全免费，解压就可用没有任何插件广告

电脑中常用的一些字体的整理，默认的office和wps没有这些字体

64位系统 mfc140u.dll

VideoDownloadHelper高级版.7z（解除120分钟限制及显示不全的问题）

0x0000011b共享打印机无法连接 0x0000011b一键修复工具

realtek audio console 1.41.290

九彩固件下载器-机顶盒刷机固件实现在线高速下载

win11安装ie11浏览器

zotero connector 插件

谷歌reCAPTCHA验证不显示的处理方法

最新资源

《反汇编分析工具》（Hex-Rays IDA Pro）v6.1 Advanced （一）