插件框架

字段名 功能
flags 插件的状态
comment 描述信息
help 帮助信息
wanted_name 菜单中显示的名字
wanted_hotkey 希望注册的快捷键 
  1. class UnknowClass(idaapi.plugin_t):
  2.     '''
  3.         给插件接口,实例的类定义
  4.     '''
  5.     flags = idaapi.PLUGIN_KEEP  # 插件的状态, 当前状态保持在Plugin菜单中
  6.     comment = "XXX"             # 描述信息
  8.     help = ""                   # 帮助信息
  9.     wanted_name = "XXX"         # 菜单中显示的名字
  10.     #wanted_hotkey = "Ctrl+Alt+Shift+F12"   # 希望注册的快捷键
  11.     wanted_hotkey = ""
  13.     #_PREFIX_NAME = 'carveSelectedBytes'
  14.     #_MIN_MAX_MATH_OPS_TO_ALLOW_RENAME = 11
  16.     def __init__(self):
  17.         '''
  18.             构造基类,一般没实名操作, 
  19.             记得给Super第一个参数更正为 当前类的名称
  20.         '''
  21.         super(UnknowClass, self).__init__()
  22.         self._data = None
  24.     def term(self):
  25.         '''
  26.             Destory函数, 同析构函数, 留待释放资源
  27.         '''
  28.         pass
  30.     def init(self):
  31.         '''
  32.             进行初始化操作,可在此输出一些描述信息
  33.         '''
  34.         self.view = None
  35.         # self._cfg = None
  36.         # print("=" * 80)
  37.         # print("carveSelectedBytes")
  38.         # print(u"保存所选的 HexData 到文件")
  39.         # print("=" * 80)
  42.         return idaapi.PLUGIN_OK
  44.     def run(self, arg):
  45.         '''
  46.             每次运行插件时, 执行的具体操作
  47.             功能代码在此编写
  48.         '''
  49.         pass
  51. def PLUGIN_ENTRY():
  52.     '''
  53.         插件入口,用于实例对象
  54.         返回的就是插件的功能等
  55.     '''
  56.     return carveSelectedBytes()

增加菜单

  1. #IDA7 定义 菜单的Handle, 其他版本直接传入函数均可
  2. class Kp_MC_Patcher(Kp_Menu_Context):       //继承
  3.         def activate(self, ctx):
  4.             self.plugin.patcher()
  5.             return 1
  1. class Kp_Menu_Context(ida_kernwin.action_handler_t)
  2.  |  Method resolution order:
  3.  |      Kp_Menu_Context
  4.  |      ida_kernwin.action_handler_t
  5.  |      __builtin__.object
  6.  |  
  7.  |  Class methods defined here:
  8.  |  
  9.  |  activate(self, ctx) from __builtin__.type # 当菜单激活时 Handle处理函数
  10.  |  
  11.  |  get_label(self) from __builtin__.type
  12.  |  
  13.  |  get_name(self) from __builtin__.type    # 获取Handle对象
  14.  |  
  15.  |  register(self, plugin, label) from __builtin__.type # 注册菜单
  16.  |  
  17.  |  unregister(self) from __builtin__.type
  18.  |      Unregister the action.
  19.  |      After unregistering the class cannot be used.
  20.  |  
  21.  |  update(self, ctx) from __builtin__.type
  2. # 一般在插件主类的 Init 中 注册菜单
  3. if idaapi.IDA_SDK_VERSION >= 700:
  4.     # Add menu IDA >= 7.0
  5.     # attach_action_to_menu(menupath, name, flags) -> bool
  6.     # 参数1: 要增加在哪个菜单路径下
  7.     # 参数2: 继承重写的类对象
  8.     # 参数3: 显示出来为 什么属性
  9.     idaapi.attach_action_to_menu("Edit/Keypatch/Patcher", Kp_MC_Patcher.get_name(), idaapi.SETMENU_APP)
  10. else:
  11.     # add Keypatch menu
  12.     # IDA 7 以下
  13.     menu = idaapi.add_menu_item("Edit/Keypatch/", "Patcher     (Ctrl-Alt-K)", "", 1, self.patcher, None)
  14.     if menu is not None:
  15.         #add_menu_item(menupath, name, hotkey, flags, pyfunc, args) -> PyObject *
  16.         # 菜单路径, 显示名称, 热键, 排序, 处理的Handle, 传入参数
  17.         idaapi.add_menu_item("Edit/Keypatch/", "About", "", 1, self.about, None)
  18.     elif idaapi.IDA_SDK_VERSION < 680:
  19.         # older IDAPython (such as in IDAPro 6.6) does add new submenu.
  20.         # in this case, put Keypatch menu in menu Edit \ Patch program
  21.         # not sure about v6.7, so to be safe we just check against v6.8
  22.         # 68以下 暂不关心
  23.         idaapi.add_menu_item("Edit/Patch program/", "-", "", 0, self.menu_null, None)

弹出菜单

  2. # 在插件Init函数中 注册弹出菜单
  3. # register popup menu handlers
  4. try:
  5.     # register(self, plugin, label) method of __builtin__.type instance
  6.     Kp_MC_Patcher.register(self, "Patcher    (Ctrl-Alt-K)")
  7. except:
  8.     pass
  10. # setup popup menu
  11. self.hooks = Hooks()
  12. self.hooks.hook()
  14. # hooks for popup menu
  15. class Hooks(idaapi.UI_Hooks):   # 名为HOOK 
  16.     def finish_populating_tform_popup(self, form, popup): #重写虚函数, popup 自传入
  17.         # We'll add our action to all "IDA View-*"s.
  18.         # If we wanted to add it only to "IDA View-A", we could
  19.         # also discriminate on the widget's title:
  20.         #
  21.         #  if idaapi.get_tform_title(form) == "IDA View-A":
  22.         #      ...
  23.         #
  24.         if idaapi.get_tform_type(form) == idaapi.BWN_DISASM:
  25.             try:
  26.                 # attach_action_to_popup(widget, popup_handle, name, popuppath=None, flags=0) -> bool
  27.                 # 目标窗口, 弹出处理Handle, 名称, 弹出菜单的位置
  29.                 idaapi.attach_action_to_popup(form, popup, Kp_MC_Patcher.get_name(), 'Keypatch/')
  30.             except:
  31.                 pass

IDA 界面库

IDA7 支持了PyQt5
而IDA6 却只支持PySide
则需兼容代码

  2. if idaapi.IDA_SDK_VERSION >= 700:
  3.     from PyQt5.Qt import QApplication
  4. else:
  5.     from PySide.QtGui import QApplication