IDA是对Interactive Disassembler[交互式反汇编器](www.datarescue.com)的简称，它是软件逆向工程最常用的工具之一。IDA支持插件模块，因此客户能够扩充功能和自动化任务。为了写这本书我们创建了一个简单的IDA插件，它能扫描两个二进制文件并且比较它们。该插件会加亮任何被改变了的代码区域。这可以被用来比较打补丁前的和打补丁后的可执行文件，确定哪几行被修补过。

　　在许多情况下，软件厂商“秘密地”修补安全缺陷。我们在这里提供的工具能帮助一个攻击者找到这些秘密补丁。事先声明，这个插件可能会标注许多根本没有改变的位置。如果编译器选项被改变或者在函数之间的填充码被变更，该插件会返回相当多的假阳性[误报]。尽管如此，这仍是一个用来举例说明该如何开始编写IDA插件的很棒的例子。

　　我们的例子也强调与‘penetrate-and-patch[潜入和补丁]安全’相关的最大问题。补丁简直就是攻击地图，而且聪明的攻击者知道该如何读他们。为了编译这个代码，你需要有IDA软件开发工具箱（SDK），这可以从你的IDA产品中得到。它们在源代码行内有注解，而且都是标准的头文件。你需要包含其他哪些头文件，取决于你要使用哪些API调用。注意，我们禁止了某一个警告信息而且也包含了Windows头文件。因为这样我们才能够使用Windows图形用户接口（GUI）代码实现弹出对话框等等。当你使用标准模板库的时候，会抛出警告4273，所以习惯上我们禁止它。

#include <windows.h>

#pragma warning( disable:4273 )

#include <ida.hpp>

#include <idp.hpp>

#include <bytes.hpp>

#include <loader.hpp>

#include <kernwin.hpp>

#include <name.hpp>

　　因为我们的插件是以SDK提供的一个插件样本为基础，所以下列代码只是样本的一部份。这些都是必需要的函数，而且样本中已经有注解这部份。

//--------------------------------------------------------------------------

// This callback is called for UI notification events.

static int sample_callback(void * /*user_data*/, int event_id, va_list /*va*/)

{

 if ( event_id != ui_msg )   // Avoid recursion.

  if ( event_id != ui_setstate

   && event_id != ui_showauto

   && event_id != ui_refreshmarked ) // Ignore uninteresting events

     msg("ui_callback %d\n", event_id);

 return 0;           // 0 means "process the event";

                     // otherwise, the event would be ignored.

}

//--------------------------------------------------------------------------

// A sample of how to generate user-defined line prefixes

static const int prefix_width = 8;

static void get_user_defined_prefix(ea_t ea,

                                    int lnnum,

                                    int indent,

                                    const char *line,

                                    char *buf,

                                    size_t bufsize)

{

 buf[0] = '\0';    // Empty prefix by default

 // We want to display the prefix only on the lines which

 // contain the instruction itself.

 if ( indent != -1 ) return;       // A directive

 if ( line[0] == '\0' ) return;    // Empty line

 if ( *line == COLOR_ON ) line += 2;

 if ( *line == ash.cmnt[0] ) return;  // Comment line. . .

 // We don't want the prefix to be printed again for other lines of the

 // same instruction/data. For that we remember the line number

 // and compare it before generating the prefix.

 static ea_t old_ea = BADADDR;

 static int old_lnnum;

 if ( old_ea == ea && old_lnnum == lnnum ) return;

 // Let's display the size of the current item as the user-defined prefix.

 ulong our_size = get_item_size(ea);

 // Seems to be an instruction line. We don't bother with the width

 // because it will be padded with spaces by the kernel.

 _snprintf(buf, bufsize, " %d", our_size);

 // Remember the address and line number we produced the line prefix for.

 old_ea = ea;

 old_lnnum = lnnum;

}

//--------------------------------------------------------------------------

//

//   Initialize.

//

//   IDA will call this function only once.

//   If this function returns PLGUIN_SKIP, IDA will never load it again.

//   If this function returns PLUGIN_OK, IDA will unload the plugin but

//   remember that the plugin agreed to work with the database.

//   The plugin will be loaded again if the user invokes it by

//   pressing the hot key or by selecting it from the menu.

//   After the second load, the plugin will stay in memory.

//   If this function returns PLUGIN_KEEP, IDA will keep the plugin

//   in memory. In this case the initialization function can hook

//   into the processor module and user interface notification points.

//   See the hook_to_notification_point() function.

//

//   In this example we check the input file format and make the decision.

//   You may or may not check any other conditions to decide what you do,

//   whether you agree to work with the database.

//

int init(void)

{

 if ( inf.filetype == f_ELF ) return PLUGIN_SKIP;

// Please uncomment the following line to see how the notification works:

// hook_to_notification_point(HT_UI, sample_callback, NULL);

// Please uncomment the following line to see how the user-defined prefix works:

// set_user_defined_prefix(prefix_width, get_user_defined_prefix);

 return PLUGIN_KEEP;

}

//--------------------------------------------------------------------------

//   Terminate.

//   Usually this callback is empty.

//   The plugin should unhook from the notification lists if

//   hook_to_notification_point() was used.

//

//   IDA will call this function when the user asks to exit.

//   This function won't be called in the case of emergency exits.

void term(void)

{

 unhook_from_notification_point(HT_UI, sample_callback);

 set_user_defined_prefix(0, NULL);

}

这里还要包含其他几个头文件和一些全局变量：

#include <process.h>

#include "resource.h"

DWORD g_tempest_state = 0;

LPVOID g_mapped_file = NULL;

DWORD g_file_size = 0;

这个函数把一个文件载入内存。这个文件将作为目标，和我们之前装入IDA的二进制文件做对比。典型地，你应该是先把未打补丁的文件装入IDA，然后用它比较打过补丁的文件：

bool load_file( char *theFilename )

{

    HANDLE aFileH =

        CreateFile( theFilename,

                    GENERIC_READ,

                    0,

                    NULL,

                    OPEN_EXISTING,

                    FILE_ATTRIBUTE_NORMAL,

                    NULL);

    if(INVALID_HANDLE_VALUE == aFileH)

    {

        msg("Failed to open file.\n");

        return FALSE;

    }

    HANDLE aMapH =

           CreateFileMapping( aFileH,

                              NULL,

                              PAGE_READONLY,

                              0,

                              0,

                              NULL);

    if(!aMapH)

    {

           msg("failed to open map of file\n");

           return FALSE;

    }

    LPVOID aFilePointer =

           MapViewOfFileEx(

                  aMapH,

                  FILE_MAP_READ,

                  0,

                  0,

                  0,

                  NULL);

    DWORD aFileSize = GetFileSize(aFileH, NULL);

    g_file_size = aFileSize;

    g_mapped_file = aFilePointer;

    return TRUE;

}

这个函数[根据用户提供的内存地址和长度从IDA的数据库中]取一串操作码，然后在目标文件中扫描这些字节。如果在目标文件中没能找到操作码，那个内存位置将会被标记为有改变。显然这是简单的技术，但是它在许多情况下是有效力的。由于存在这一小节开始处所列出的那些问题，这种方式会引起假阳性问题。

bool check_target_for_string(ea_t theAddress, DWORD theLen)

{

    bool ret = FALSE;

    if(theLen > 4096)

    {

        msg("skipping large buffer\n");

        return TRUE;

    }

    try

    {

        // Scan the target binary for the string.

        static char g_c[4096];

        // I don't know any other way to copy the data string

        // out of the IDA database?!

        for(DWORD i=0;i<theLen;i++)

        {

            g_c[i] = get_byte(theAddress + i);

        }

        // Here we have the opcode string; perform a search.

        LPVOID curr = g_mapped_file;

        DWORD sz = g_file_size;

        while(curr && sz)

        {

            LPVOID tp = memchr(curr, g_c[0], sz);

            if(tp)

            {

                sz -= ((char *)tp - (char *)curr);

            }

            if(tp && sz >= theLen)

            {

                if(0 == memcmp(tp, g_c, theLen))

                {

                    // We found a match!

                    ret = TRUE;

                    break;

                }

                if(sz > 1)

                {

                    curr = ((char *)tp)+1;

                }

                else

                {

                    break;

                }

            }

            else

            {

                break;

            }

        }

    }

    catch(...)

    {

        msg("[!] critical failure.");

        return TRUE;

    }

    return ret;

}

这个线程[从装入IDA的二进制文件中]找出所有函数，并且拿它们和目标二进制文件做比较：

void __cdecl _test(void *p)

{

    // Wait for start signal.

    while(g_tempest_state == 0)

    {

        Sleep(10);

    }

我们调用get_func_qty()求得装入IDA的二进制文件中函数的个数：

    /////////////////////////////////////

    // Enumerate through all functions.

    /////////////////////////////////////

    int total_functions = get_func_qty();

    int total_diff_matches = 0;

我们现在循环处理每个函数。我们为每个函数调用getn_func()取得函数结构。函数结构是func_t类型数据。ea_t类型即是“有效地址”，它实际上只是一个无符号长整型。我们从函数结构中取得函数的开始地址和结束地址。然后我们把这个字节序列与目标二进制文件做比较：

    for(int n=0;n<total_functions;n++)

    {

        // msg("getting next function \n");

        func_t *f = getn_func(n);

        ///////////////////////////////////////////////

        // The start and end addresses of the function

        // are in the structure.

        ///////////////////////////////////////////////

        ea_t myea = f->startEA;

        ea_t last_location = myea;

        while((myea <= f->endEA) && (myea != BADADDR))

        {

            // If the user has requested a stop we should return here.

            if(0 == g_tempest_state) return;

            ea_t nextea = get_first_cref_from(myea);

            ea_t amloc = get_first_cref_to(nextea);

            ea_t amloc2 = get_next_cref_to(nextea, amloc);

            // The cref will be the previous instruction, but we

            // also check for multiple references.

            if((amloc == myea) && (amloc2 == BADADDR))

            {

                // I was getting stuck in loops, so I added this hack

                // to force an exit to the next function.

                if(nextea > myea)

                {

                    myea = nextea;

                    // ----------------------------------------------

                    // Uncomment the next two lines to get "cool"

                    // scanning effect in the GUI. Looks sweet but slows

                    // down the scan.

                    // ----------------------------------------------

                    // jumpto(myea);

                    // refresh_idaview();

                }

                else myea = BADADDR;

            }

            else

            {

                // I am a location. Reference is not last instruction _OR_

                // I have multiple references.

                // Diff from the previous location to here and make a comment

                // if we don't match

                // msg("diffing location... \n");

如果目标文件没有包含我们的操作码字串，我们就在[装入IDA的二进制文件的]静止代码列表中放上一个注解（用add_long_cmt函数）：

                bool pause_for_effect = FALSE;

                int size = myea - last_location;

                if(FALSE == check_target_for_string(last_location, size))

                {

                    add_long_cmt(last_location, TRUE,

                           "====================================================\n"

                           "= ** This code location differs from the target ** =\n" 

                           "====================================================\n");

                    msg("Found location 0x%08X that didn't match target!\n", last_location);

                    total_diff_matches++;

                }

                if(nextea > myea)

                {

                    myea = nextea;

                }

                else myea = BADADDR;

                // goto next address.

                jumpto(myea);

                refresh_idaview();

            }

        }

    }

    msg("Finished! Found %d locations that diff from the target.\n", total_diff_matches);

}

这个函数显示一个对话框提示用户输入一个文件名。这是一个外观漂亮的文件选择对话框：

char * GetFilenameDialog(HWND theParentWnd)

{

    static TCHAR szFile[MAX_PATH] = "\0";

    strcpy( szFile, "");

    OPENFILENAME OpenFileName;

    OpenFileName.lStructSize = sizeof (OPENFILENAME);

    OpenFileName.hwndOwner = theParentWnd;

    OpenFileName.hInstance = GetModuleHandle("diff_scanner.plw");

    OpenFileName.lpstrFilter = "w00t! all files\0*.*\0\0";

    OpenFileName.lpstrCustomFilter = NULL;

    OpenFileName.nMaxCustFilter = 0;

    OpenFileName.nFilterIndex = 1;

    OpenFileName.lpstrFile = szFile;

    OpenFileName.nMaxFile = sizeof(szFile);

    OpenFileName.lpstrFileTitle = NULL;

    OpenFileName.nMaxFileTitle = 0;

    OpenFileName.lpstrInitialDir = NULL;

    OpenFileName.lpstrTitle = "Open";

    OpenFileName.nFileOffset = 0;

    OpenFileName.nFileExtension = 0;

    OpenFileName.lpstrDefExt = "*.*";

    OpenFileName.lCustData = 0;

    OpenFileName.lpfnHook           = NULL;

    OpenFileName.lpTemplateName  = NULL;

    OpenFileName.Flags = OFN_EXPLORER | OFN_NOCHANGEDIR;

    if(GetOpenFileName( &OpenFileName ))

    {

        return(szFile);

    }

    return NULL;

}

与所有“自定义的”对话框一样，我们需要DialogProc处理窗口消息：

BOOL CALLBACK MyDialogProc(HWND hDlg, UINT msg, WPARAM wParam, LPARAM lParam)

{

    switch(msg)

    {

        case WM_COMMAND:

            if (LOWORD(wParam) == IDC_BROWSE)

            {

                char *p = GetFilenameDialog(hDlg);

                SetDlgItemText(hDlg, IDC_EDIT_FILENAME, p);

            }

            if (LOWORD(wParam) == IDC_START)

            {

                char filename[255];

                GetDlgItemText(hDlg, IDC_EDIT_FILENAME, filename, 254);

                if(0 == strlen(filename))

                {

                    MessageBox(hDlg, "You have not selected a target file", "Try again", MB_OK);

                }

                else if(load_file(filename))

                {

                    g_tempest_state = 1;

                    EnableWindow( GetDlgItem(hDlg, IDC_START), FALSE);

                }

                else

                {

                    MessageBox(hDlg, "The target file could not be opened", "Error", MB_OK);

                }

            }

            if (LOWORD(wParam) == IDC_STOP)

            {

                g_tempest_state = 0;

            }

            if (LOWORD(wParam) == IDOK || LOWORD(wParam) == IDCANCEL)

            {

                if(LOWORD(wParam) == IDOK)

                {

                }

                EndDialog(hDlg, LOWORD(wParam));

                return TRUE;

            }

            break;

        default:

            break;

    }

    return FALSE;

}

void __cdecl _test2(void *p)

{

    DialogBox( GetModuleHandle("diff_scanner.plw"), MAKEINTRESOURCE(IDD_DIALOG1), NULL, MyDialogProc);

}

//--------------------------------------------------------------------------

//

//   The plugin method.

//

//   This is the main function of plugin.

//

//   It will be called when the user selects the plugin.

//

//       Arg - the input argument. It can be specified in the

//          plugins.cfg file. The default is zero.

//

//

当用户激活插件的时候，run函数被调用。在本例中我们启动两个线程，同时给log窗口发送一个短消息：

void run(int arg)

{

    // Testing.

    msg("starting diff scanner plugin\n");

    _beginthread(_test, 0, NULL);

    _beginthread(_test2, 0, NULL);

}

这些全局数据项给IDA用来显示关于插件的信息。

//--------------------------------------------------------------------------

char comment[] = "Diff Scanner Plugin, written by Greg Hoglund (www.rootkit.com)";

char help[] =

    "A plugin to find diffs in binary code\n"

    "\n"

    "This module highlights code locations that have changed.\n"

    "\n";

//--------------------------------------------------------------------------

// This is the preferred name of the plugin module in the menu system.

// The preferred name may be overridden in the plugins.cfg file.

char wanted_name[] = "Diff Scanner";

// This is the preferred hot key for the plugin module.

// The preferred hot key may be overridden in the plugins.cfg file.

// Note: IDA won't tell you if the hot key is not correct.

//    It will just disable the hot key.

char wanted_hotkey[] = "Alt-0";

//--------------------------------------------------------------------------

//

//   PLUGIN DESCRIPTION BLOCK

//

//--------------------------------------------------------------------------

extern "C" plugin_t PLUGIN = {

 IDP_INTERFACE_VERSION,

 0,               // Plugin flags.

 init,            // Initialize.

 term,            // Terminate. This pointer may be NULL.

 run,             // Invoke plugin.

 comment,         // Long comment about the plugin

                  // It could appear in the status line

                  // or as a hint.

 help,            // Multiline help about the plugin

 wanted_name,     // The preferred short name of the plugin

 wanted_hotkey    // The preferred hot key to run the plugin

};