加密与解密第三章：IDA的基本操作

Posted 2020-12-03

tags:

篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了加密与解密第三章：IDA的基本操作相关的知识，希望对你有一定的参考价值。

更改数据为结构体和枚举类型

查看输入和输出的idc脚本

//Imports.idc ?г???????????????
//(c)  www.PEDIY.com 2000-2008

#include <idc.idc>

static GetImportSeg()
{
    auto ea, next, name;
    ea = FirstSeg();
    next = ea;
    while ( (next = NextSeg(next)) != -1) {
        name = SegName(next);
        if ( substr( name, 0, 6 ) == ".idata" ) break;
   }
   return next;
}

static main()
{
    auto BytePtr, EndImports;
    BytePtr = SegStart( GetImportSeg() );
    EndImports = SegEnd( BytePtr );
    Message(" 
" + "Parsing Import Table...
");
    while ( BytePtr < EndImports ) {
        if (LineA(BytePtr, 1) != "") Message("
" + "____" + LineA(BytePtr,1) + "____" + "
");
        Message(Name(BytePtr) + "
");
        BytePtr = NextAddr(BytePtr);
    }
    Message("
" + "Import Table Parsing Complete
");
}

//exports.idc 
//(c)  www.PEDIY.com 2000-2008

#include <idc.idc>

static main()
{
    auto x, ord, ea;
    Message("
 Program Entry Points: 
 
");
    for ( x=0; x<= GetEntryPointQty(); x = x+1){  //GetEntryPointQty()得到入口点个数
        ord =  GetEntryOrdinal( x );          //得到该入口点的序列数
        ea = GetEntryPoint( ord );
        Message( Name( ea ) + ":  Ordinal " + ltoa( ord,16 ) + " at offset " + ltoa( ea, 16) + "
");
    }
    Message("
" + "Export Parsing Complete
");
}

解密self modify code

idc文件如下：

//encrypted.idc
//(c)  www.PEDIY.com 2000-2008

#include <idc.idc>
static decrypt(from, size, key ) { 
   auto i, x; 
   for ( i=0; i < size; i=i+1 ) { 
      x = Byte(from); 
      x = (x^key); 
      PatchByte(from,x); 
      from = from + 1;
   } 

} 
static main() { 
decrypt(0x00401060,0x15,0x1);
}

如果遇到ida未识别十六进制数据，直接强转为代码即可。