Navigation Menu

Skip to content

Instantly share code, notes, and snippets.

@Jinmo
Created May 5, 2019 14:10
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Jinmo/58d6d163a31b8d0244c77546e5400fbf to your computer and use it in GitHub Desktop.
Save Jinmo/58d6d163a31b8d0244c77546e5400fbf to your computer and use it in GitHub Desktop.
Force unloading IDA plugin (or not)
from pkg.internal_api import _ida_lib
import ctypes
functype, lib = _ida_lib()
class qstring(ctypes.Structure):
_fields_ = [
('array', ctypes.c_void_p),
('n', ctypes.c_size_t),
('alloc', ctypes.c_size_t)
]
call_func_type = functype(ctypes.c_bool, ctypes.c_void_p, ctypes.c_char_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(qstring))
call_method_type = functype(ctypes.c_bool, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_char_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(qstring))
class method_type(ctypes.Union):
_fields_ = [
('ptr', ctypes.c_void_p),
('func', call_method_type)
]
class _extlang_t(ctypes.Structure):
_fields_ = [
('size', ctypes.c_size_t),
('flags', ctypes.c_uint),
('refcnt', ctypes.c_int),
('name', ctypes.c_char_p),
('fileext', ctypes.c_char_p),
('highlighter', ctypes.c_void_p),
('compile_expr', ctypes.c_void_p),
('compile_file', ctypes.c_void_p),
('call_func', call_func_type),
('eval_expr', ctypes.c_void_p),
('eval_snippet', ctypes.c_void_p),
('create_object', ctypes.c_void_p),
('get_attr', ctypes.c_void_p),
('set_attr', ctypes.c_void_p),
('call_method', method_type),
('load_procmod', ctypes.c_void_p),
('unload_procmod', ctypes.c_void_p)
]
class plugin_t(ctypes.Structure):
_fields_ = [
('version', ctypes.c_int32),
('flags', ctypes.c_int32),
('init', functype(ctypes.c_int32)),
('term', functype(None)),
('run', functype(ctypes.c_bool, ctypes.c_size_t)),
('comment', ctypes.c_char_p),
('help', ctypes.c_char_p),
('wanted_name', ctypes.c_char_p),
('wanted_hotkey', ctypes.c_char_p),
('reserved1', ctypes.c_void_p),
('reserved2', ctypes.c_void_p),
('reserved3', ctypes.c_void_p),
('extlang', ctypes.POINTER(_extlang_t))
]
@functype(ctypes.c_bool, ctypes.c_size_t)
def nop(arg):
print arg
return True
def nop_extlang(extlang, original):
@call_method_type
def handler(*args):
extlang.call_method.ptr = original
return True
return handler
find_plugin = lib.find_plugin
find_plugin.restype = ctypes.POINTER(plugin_t)
find_plugin.argtypes = [ctypes.c_char_p, ctypes.c_bool]
run_plugin = lib.run_plugin
run_plugin.restype = ctypes.c_bool
run_plugin.argtypes = [ctypes.POINTER(plugin_t), ctypes.c_size_t]
path = os.path.join(pkg.local('community-headers').path, 'plugins', 'main.py')
p = find_plugin(path, False)
if p:
if p[0].flags & 0x8000:
call_method = p[0].extlang[0].call_method.ptr
p[0].extlang[0].call_method.func = nop_extlang(p[0].extlang[0], call_method)
else:
p[0].run = nop
p[0].flags &= ~0x20
p[0].flags |= 8
run_plugin(p, 0)
print p
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment