From 78da4e431bc839585a7c563ce5aade4f392f2927 Mon Sep 17 00:00:00 2001 From: kotori2 Date: Fri, 9 Sep 2022 17:29:28 -0400 Subject: [PATCH] IDA 7.7 support --- 3rdparty/README.txt | 2 +- Documentation/ScyllaHideDocumentation.tex | 8 +- PluginGeneric/AttachDialog.cpp | 2 +- PluginGeneric/OptionsDialog.cpp | 9 +- .../ScyllaHideIDAProPlugin.cpp | 15 +- .../ScyllaHideIDAServer.vcxproj | 322 +++++++++--------- 6 files changed, 180 insertions(+), 178 deletions(-) diff --git a/3rdparty/README.txt b/3rdparty/README.txt index 1dfcc110..303cbbaa 100644 --- a/3rdparty/README.txt +++ b/3rdparty/README.txt @@ -1 +1 @@ -To build the IDA plugin, extract the contents of idasdk695.zip in the directory "idasdk" \ No newline at end of file +To build the IDA plugin, extract the contents of idasdk77.zip into idasdk folder. \ No newline at end of file diff --git a/Documentation/ScyllaHideDocumentation.tex b/Documentation/ScyllaHideDocumentation.tex index 65efc5d1..d18fcb12 100644 --- a/Documentation/ScyllaHideDocumentation.tex +++ b/Documentation/ScyllaHideDocumentation.tex @@ -60,7 +60,7 @@ \section{Description} \begin{itemize} \item OllyDbg v1 and v2 \url{http://www.ollydbg.de} \item x64dbg \url{http://x64dbg.com} or \url{https://github.com/x64dbg/x64dbg} -\item Hex-Rays IDA v6 \url{https://www.hex-rays.com/products/ida} +\item Hex-Rays IDA v7.7 \url{https://www.hex-rays.com/products/ida} \item TitanEngine v2 \url{https://bitbucket.org/mrexodia/titanengine-update} and \url{http://www.reversinglabs.com/open-source/titanengine.html} \end{itemize} @@ -85,14 +85,14 @@ \subsection{OllyDbg v1} \subsection{OllyDbg v2} Copy scylla\_hide.ini, HookLibraryx86.dll and ScyllaHideOlly2.dll to your specific plugins directory. -\subsection{IDA v6} +\subsection{IDA v7.7} \textbf{32-bit:} Copy scylla\_hide.ini, HookLibraryx86.dll and ScyllaHideIDA.plw to your IDA plugins directory. \textbf{64-bit:} -Copy scylla\_hide.ini, HookLibraryx64.dll, ScyllaHideIDASrvx64.exe and ScyllaHideIDA.p64 to your IDA plugins directory. +Copy ScyllaHideIDAProPlugin64.dll and scylla\_hide.ini to your IDA plugins directory. -Note: \\Start ScyllaHideIDASrvx64.exe to debug 64bit applications remotely. \\Start ScyllaHideIDASrvx86.exe to debug 32bit applications remotely. +Note: \\Start ScyllaHideIDAServerx64.exe to debug 64bit applications remotely. \\Start ScyllaHideIDASrvx86.exe to debug 32bit applications remotely. Command line: ScyllaHideIDASrvxXX.exe \\ For example: ScyllaHideIDASrvxXX.exe 1345 diff --git a/PluginGeneric/AttachDialog.cpp b/PluginGeneric/AttachDialog.cpp index f364d42f..f99967fb 100644 --- a/PluginGeneric/AttachDialog.cpp +++ b/PluginGeneric/AttachDialog.cpp @@ -27,7 +27,7 @@ extern HWND hwmain; // Handle of main OllyDbg window #elif OLLY2 HWND hwmain = hwollymain; #elif __IDP__ -HWND hwmain = (HWND)callui(ui_get_hwnd).vptr; +HWND hwmain = GetForegroundWindow(); #elif X64DBG extern HWND hwndDlg; HWND hwmain; diff --git a/PluginGeneric/OptionsDialog.cpp b/PluginGeneric/OptionsDialog.cpp index 98a33590..c2a8988c 100644 --- a/PluginGeneric/OptionsDialog.cpp +++ b/PluginGeneric/OptionsDialog.cpp @@ -642,8 +642,9 @@ INT_PTR CALLBACK OptionsDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM l break; wstrNewProfileName.resize(lstrlenW(wstrNewProfileName.c_str())); -#elif defined(__IDP__) - auto szNewProfileName = askstr(0, "", "New profile name?"); +#elif defined(__IDP__) + qstring empty; + auto szNewProfileName = ask_str(&empty, 0, "New profile name?"); if (!szNewProfileName) break; wstrNewProfileName = scl::wstr_conv().from_bytes(szNewProfileName); @@ -871,7 +872,7 @@ INT_PTR CALLBACK OptionsDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM l break; EndDialog(hDlg, NULL); - DialogBoxW(hinst, MAKEINTRESOURCE(IDD_ATTACH), (HWND)callui(ui_get_hwnd).vptr, &AttachProc); + DialogBoxW(hinst, MAKEINTRESOURCE(IDD_ATTACH), GetForegroundWindow(), &AttachProc); break; } @@ -880,7 +881,7 @@ INT_PTR CALLBACK OptionsDlgProc(HWND hDlg, UINT message, WPARAM wParam, LPARAM l if (HIWORD(wParam) != BN_CLICKED) break; - scl::ShowAboutBox((HWND)callui(ui_get_hwnd).vptr); + scl::ShowAboutBox(GetForegroundWindow()); break; } #endif diff --git a/ScyllaHideIDAProPlugin/ScyllaHideIDAProPlugin.cpp b/ScyllaHideIDAProPlugin/ScyllaHideIDAProPlugin.cpp index 8d35662a..ae941950 100644 --- a/ScyllaHideIDAProPlugin/ScyllaHideIDAProPlugin.cpp +++ b/ScyllaHideIDAProPlugin/ScyllaHideIDAProPlugin.cpp @@ -5,7 +5,7 @@ //for 64bit - p64 #ifdef BUILD_IDA_64BIT #define __EA64__ -#pragma comment(lib, "x86_win_vc_64/ida.lib") +#pragma comment(lib, "x64_win_vc_32/ida.lib") // TODO: I only found this in IDA 7.7 SDK, but x64_win_vc_64 exists on 8.0 #else //for 32bit - plw #pragma comment(lib, "x86_win_vc_32/ida.lib") @@ -64,14 +64,14 @@ static void AttachProcess(DWORD dwPID) switch (res) { case -1: { - MessageBoxA((HWND)callui(ui_get_hwnd).vptr, + MessageBoxA(GetForegroundWindow(), "Can't attach to that process !", "ScyllaHide Plugin", MB_OK | MB_ICONERROR); break; } case -2: { - MessageBoxA((HWND)callui(ui_get_hwnd).vptr, + MessageBoxA(GetForegroundWindow(), "Can't find that PID !", "ScyllaHide Plugin", MB_OK | MB_ICONERROR); break; @@ -102,7 +102,7 @@ static bool SetDebugPrivileges() } //callback for various debug events -static int idaapi debug_mainloop(void *user_data, int notif_code, va_list va) +static ssize_t idaapi debug_mainloop(void *user_data, int notif_code, va_list va) { switch (notif_code) { @@ -295,13 +295,14 @@ static void idaapi IDAP_term(void) } //called when user clicks in plugin menu or presses hotkey -static void idaapi IDAP_run(int arg) +static bool idaapi IDAP_run(size_t arg) { - DialogBoxW(hinst, MAKEINTRESOURCE(IDD_OPTIONS), (HWND)callui(ui_get_hwnd).vptr, &OptionsDlgProc); + DialogBoxW(hinst, MAKEINTRESOURCE(IDD_OPTIONS), GetForegroundWindow(), &OptionsDlgProc); + return true; } //init the plugin -static int idaapi IDAP_init(void) +static plugmod_t* idaapi IDAP_init(void) { //ensure target is PE executable if (inf.filetype != f_PE) return PLUGIN_SKIP; diff --git a/ScyllaHideIDAServer/ScyllaHideIDAServer.vcxproj b/ScyllaHideIDAServer/ScyllaHideIDAServer.vcxproj index 5aa4854b..5c0111c3 100644 --- a/ScyllaHideIDAServer/ScyllaHideIDAServer.vcxproj +++ b/ScyllaHideIDAServer/ScyllaHideIDAServer.vcxproj @@ -1,162 +1,162 @@ - - - - - Debug - Win32 - - - Debug - x64 - - - Release - Win32 - - - Release - x64 - - - - 16.0 - {4506D672-19C3-439B-8E1B-F1BA8BE28844} - Win32Proj - ScyllaHideIDAServer - 10.0 - - - - Application - true - Unicode - v142 - false - false - - - Application - true - Unicode - v142 - false - false - - - Application - false - true - Unicode - v142 - false - false - - - Application - false - true - Unicode - v142 - false - false - - - - - - - - - - - - - - - - - - - - - - - - - - - - - false - $(TargetName)x86 - - - false - $(TargetName)x64 - - - false - $(TargetName)x86 - - - false - $(TargetName)x64 - - - - WIN32;_DEBUG;_WINDOWS;%(PreprocessorDefinitions) - - - Console - - - - - _DEBUG;_WINDOWS;%(PreprocessorDefinitions) - - - Console - - - - - WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions) - - - Console - - - - - NDEBUG;_WINDOWS;%(PreprocessorDefinitions) - - - Console - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + Debug + Win32 + + + Debug + x64 + + + Release + Win32 + + + Release + x64 + + + + 16.0 + {4506D672-19C3-439B-8E1B-F1BA8BE28844} + Win32Proj + ScyllaHideIDAServer + 10.0 + + + + Application + true + Unicode + v143 + false + false + + + Application + true + Unicode + v143 + false + false + + + Application + false + true + Unicode + v143 + false + false + + + Application + false + true + Unicode + v143 + false + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + false + $(TargetName)x86 + + + false + $(TargetName)x64 + + + false + $(TargetName)x86 + + + false + $(TargetName)x64 + + + + WIN32;_DEBUG;_WINDOWS;%(PreprocessorDefinitions) + + + Console + + + + + _DEBUG;_WINDOWS;%(PreprocessorDefinitions) + + + Console + + + + + WIN32;NDEBUG;_WINDOWS;%(PreprocessorDefinitions) + + + Console + + + + + NDEBUG;_WINDOWS;%(PreprocessorDefinitions) + + + Console + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file