编程技术-IDA9-protobuf插件修复_游戏逆向|游戏安全|yxfzedu.com

工具还原

IDApython插件Protobuf-finder(https://github.com/Accenture/protobuf-finder)
是一款逆向protobuf程序比较好用的工具，可以还原.proto文件
但是IDA9删除了ida_bytes.bin_search()

def bin_search(*args) -> "ea_t":
    bin_search(start_ea, end_ea, image, imask, step, flags) -> ea_t
    Search for a set of bytes in the program
 
    @param start_ea: linear address, start of range to search
    @param end_ea: linear address, end of range to search (exclusive)
    @param image: the set of bytes to search for
    @param imask: a bitfield representing the mask in 'image' (can be None)
    @param step: either BIN_SEARCH_FORWARD, or BIN_SEARCH_BACKWARD
    @param flags: combination of BIN_SEARCH_* flags
    @return: the address of a match, or ida_idaapi.BADADDR  if not found
return _ida_bytes.bin_search(*args)

更改为了ida_bytes.bin_search3()

def bin_search3(*args) -> "ea_t":
    bin_search3(start_ea, end_ea, data, flags) -> ea_t
    @param start_ea: ea_t
    @param end_ea: ea_t
    @param data: compiled_binpat_vec_t const &
    @param flags: int
 
    bin_search3(start_ea, end_ea, image, mask, len, flags) -> ea_t
 
    @param start_ea: ea_t
    @param end_ea: ea_t
    @param image: uchar const *
    @param mask: uchar const *
    @param len: size_t
    @param flags: int
 
return _ida_bytes.bin_search3(*args)

有两种继承，第二种跟之前的比较像，但是我尝试许久，没修改成功，但是第一种修改成功了
修改如下

1	`import` `ida_nalt`

图片描述

pattern = ida_bytes.compiled_binpat_vec_t()
ida_bytes.parse_binpat_str(pattern,0x0,'2E 70 72 6F 74 6F',16,ida_nalt.BPU_2B)
r,_ =ida_bytes.bin_search3(0x0,0xffff,pattern,1)

图片描述
还原如下

总结

善用github搜索

最后于 1小时前被OYyunshen编辑，原因：

更多【编程技术-IDA9-protobuf插件修复】相关视频教程：www.yxfzedu.com

编程技术-IDA9-protobuf插件修复

工具还原

总结

相关文章推荐

Markdown Editor

友情链接

课程目录

技术交流QQ群