0xgalz / virtuailor Goto Github PK

View Code? Open in Web Editor NEW

1.2K 1.2K 129.0 924 KB

IDAPython tool for creating automatic C++ virtual tables in IDA Pro

License: GNU General Public License v3.0

Python 100.00%

virtuailor's People

Contributors

Stargazers

Watchers

Forkers

explife0011 joxeankoret lallouslab singi fatgrass dothanthitiendiettiende fengjixuchui y11en crackercat deelmind raystyle chubbymaggie ufwt sigma-random fcccode w00t3k cclauss 0xflotus 4144 zh-explorer peterg75 gipsyd dnhdang94 kaisaryousuf heruix supjerk gdraperi 3453-315h idkwim skirge xabiugarte seth1002 acv147258369 boogie77 zhuhuibeishadiao modulexcite sammyenigma gitmesam freemanzyq xjbevasion trietptm-on-coding-algorithms sakamaki-izayoi hkdavid2008 up777 lcytxw hello-xbugs imulmul csu-anzai woozoo86 mgq2018 yuknight gteissier kmwin rawc0de jackyyvan killvxk arryboom pcy190 the-mario jack51706 yangfan6888 wdnmd-rushb kamcpp minaungle s1kr10s forkarepo reversetools 5l1v3r1 jarlob geekonion wyu0hop jhftss bia10 greg-workspace malhaar e4ck qazxsw1597532018 6un9-h0-dan rocker9527 stevezhou6 obi0ne clayne hugmyndakassi kernelbk fnsank blueamulet singleghost2 cybersecops southdy idapluginproject redscarf1005 ylkcy bb33bb wuyadie lyingsimon mfkiwl sanqudui8ban oldmoonagainagain pinkperfect seungjin1112

virtuailor's Issues

"global name 'rdx' is not defined'

I keep getting the following warning box when running the dynamic pass (debugger):

[BP Address here]: breakpoint condition:
Traceback (most recent call last):
File "", line 119, in __Python_7748
NameError: global name 'rdx' is not defined

Is this a problem? There are many, many of these warnings when I run the debugger.

Any published paper

@0xgalz @joxeankoret Very meaningful work! Are there any papers that can be cited for this work

Incompatibility of IDA in conditional BPs?

Removed future print_function in BPs due to incompatibility of IDA in conditional BPs

Two changes in #2 was reverted in e72106a . If you get a minute, can you explain this message. I do not know much about IDA.

IDA 8.0 support

Hi, trying this out with IDA 8.0 but getting limited results and some errors on BP's while executing the sample. Is IDA 8.0 supported or not currently?
Thanks!

Can't get the vtable result

Here's the result when I execute the main.py. I can't figure out what's wrong but there's nothing output but these errors.

ERROR at address 0x7ffbd68bd37c: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ffbd68bdce8: the vtable pointer was assigned outside of function, could not place BP
ERROR at address 0x7ffbd68be0dc: the vtable pointer was assigned outside of function, could not place BP

Error message when running the script Main.py on IDA Pro 7.5

IDA Version: 7.5
Python Version: 3.9.6

I get this error message in the IDA console when running the Main.py script:

Virtuailor - Started update_bpt failed: ('invalid non-printable character U+FEFF', ('<string>', 1, 1, '\ufeffdef __Python_0():')) update_bpt failed: ('invalid non-printable character U+FEFF', ('<string>', 1, 1, '\ufeffdef __Python_1():')) update_bpt failed: ('invalid non-printable character U+FEFF', ('<string>', 1, 1, '\ufeffdef __Python_2():')) update_bpt failed: ('invalid non-printable character U+FEFF', ('<string>', 1, 1, '\ufeffdef __Python_3():')) Virtuailor - Finished

Any idea why this happening?

crashes IDA pro 7.5

as soon as I load the script the error pops up:

IDA has encountered a problem
a minidump has been created

update:
tried IDA 7.3 "finished" is shown but there are so many:
Warning! At address 0xXXXXX: The vtable assignment might be in another function (Maybe sub_XXXXXX), could not place BP.

in the log.

What is this warning message?

Today I have found this tool on googling.
So happy and just launched your script file but got following message and didn't work anymore.

My IDA Pro version is 7.0 and supported Python version is 2.7
Please help me.
What's wrong with it?

about IDA7.7 support

  File "C:\Users\ZHEFOX\Desktop\IDA\IDA7.7\python\3\ida_idaapi.py", line 580, in IDAPython_ExecScript
    exec(code, g)
  File "C:/Users/ZHEFOX/Desktop/Virtuailor-master/Main.py", line 56, in <module>
    add_bp_to_virtual_calls(int(gui.start_line.text(),16), int(gui.stop_line.text(), 16))
  File "C:/Users/ZHEFOX/Desktop/Virtuailor-master/Main.py", line 35, in add_bp_to_virtual_calls
    cond, bp_address = vtableAddress.write_vtable2file(cur_addr)
  File "C:\Users/ZHEFOX/Desktop/Virtuailor-master\vtableAddress.py", line 133, in write_vtable2file
    opnd = get_con2_var_or_num(reg, start_addr)
  File "C:\Users/ZHEFOX/Desktop/Virtuailor-master\vtableAddress.py", line 65, in get_con2_var_or_num
    dct_arch = get_arch_dct()
  File "C:\Users/ZHEFOX/Desktop/Virtuailor-master\vtableAddress.py", line 39, in get_arch_dct
    arch, is_64 = get_processor_architecture()
  File "C:\Users/ZHEFOX/Desktop/Virtuailor-master\vtableAddress.py", line 19, in get_processor_architecture
    if info.procName == "ARM":
Please use "procname" instead of "procName" ("procName" is kept for backward-compatibility, and will be removed soon.)
Warning! At address 0x16a60bf3e: The vtable assignment might be in another function (Maybe ?SafeAddRef@?$TCntPtr@VCRdpWinClosedCaptionSettingsMonitor@WindowsRemoteAppLib@@@@AEAAXXZ), could not place BP.
Warning! At address 0x16a615cc3: The vtable assignment might be in another function (Maybe memset_0), could not place BP.
Warning! At address 0x16a617727: The vtable assignment might be in another function (Maybe WPP_SF_Sd), could not place BP.
Warning! At address 0x16a617825: The vtable assignment might be in another function (Maybe memset_0), could not place BP.

....

Why could not place BP?

Thanks!

C:\Users\user\Documents\code\Virtuailor\Main.py: DLL load failed while importing sip: The specified module could not be found.
Traceback (most recent call last):
  File "D:\tools\IDA Pro 7.5\python\3\ida_idaapi.py", line 616, in IDAPython_ExecScript
    exec(code, g)
  File "C:/Users/user/Documents/code/Virtuailor/Main.py", line 9, in <module>
    idaapi.require("GUI")
  File "C:\tools\IDA Pro 7.5\python\3\ida_idaapi.py", line 161, in require
    m = importlib.import_module(modulename, package)
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Program Files\Python311\Lib\importlib\__init__.py", line 126, in import_module
    return _bootstrap._gcd_import(name[level:], package, level)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "<frozen importlib._bootstrap>", line 1206, in _gcd_import
  File "<frozen importlib._bootstrap>", line 1178, in _find_and_load
  File "<frozen importlib._bootstrap>", line 1149, in _find_and_load_unlocked
  File "<frozen importlib._bootstrap>", line 690, in _load_unlocked
  File "<frozen importlib._bootstrap_external>", line 940, in exec_module
  File "<frozen importlib._bootstrap>", line 241, in _call_with_frames_removed
  File "C:\Users/user/Documents/code/Virtuailor\GUI.py", line 3, in <module>
    from PyQt5 import QtCore, QtGui, QtWidgets
ImportError: DLL load failed while importing sip: The specified module could not be found.

hello

Is this mipsel supported ?

Supported IDA versions?

What versions of IDA is this expected to work with?

With a stock install of IDA 7.4 the script fails with errors like:

Main.py: 'module' object has no attribute 'MinEA'
Traceback (most recent call last):
  File "C:\Program Files\IDA Pro 7.4\python\2\ida_idaapi.py", line 622, in IDAPython_ExecScript
    exec(code, g)
  File "Main.py", line 47, in <module>
    start_addr_range = idc.MinEA()  # You can change the virtual calls address range
AttributeError: 'module' object has no attribute 'MinEA'

(and similar errors with undefined names in the idc module if I manually specify an EA range)

It seems like this was build using a pretty old version of ida?