Raised This Month: $248 Target: $400
 62% 

IDA Scripts


Post New Thread Reply   
 
Thread Tools Display Modes
Author Message
Scag
AlliedModders Donor
Previously known as:
Ragenewb
Join Date: May 2017
Location: Crashing Hale
Old 08-06-2020 , 04:59   IDA Scripts
Reply With Quote #1

I think I've gotten the hang of writing IDA scripts recently so I thought I'd share them with you all.

I've got a couple of basic scripts in this repo, but the more fun one is the Netprop Importer. It parses a netprop dump (given by sm_dump_netprops_xml) and is able to build IDA structs and insert members at the provided offsets. It kinda shits the bed when it comes to datatables but it's very very useful regardless. You should also, obviously, dump and import the proper dump for your OS.

The importer also provides virtual table importing as well. This does what you think it does, imports the vtables of the provided classes from the same dump and adds its type to the struct at offset 0.

It should be noted that the vtable part of the importer only works in Linux, Windows would not be fun to try and do. Also, it kinda makes IDA flip its shit when it comes to globals; e.g. engine thinks its a CBaseEntity occasionally. But other than that, it really cleans up those ugly dereferences. Another caveat is that member offsets, when viewing through pseudocode, show up as gap and then a trailing number. It should be straightforward in telling that the trailing number is the raw offset.

Spoiler


Grab the netprop importer here

Next is Symbol Smasher.

Symbol Smasher is an IDA script(s) that compares Linux (symboled) and Windows binaries and attempts to interpret the stripped functions on the Windows side.

To be specific, it runs through Linux's strings and stores all of their xrefs. Then it runs through the same strings on Windows and understands that if a unique string has a single xref to a stripped (sub_) function, then that function must be the same as that of the xref found while running through Linux.

Once the script figures out what the sub_ function is, it renames it to the mangled, Linux name. IDA then unmangles it for you so you can search it in your Functions window. Now you have a nice handful of symbols on your Windows binary.

It doesn't find every function, though. Only ones with a unique reference to a string. Secondly, not all found functions are guaranteed to be correct. It is unpredictable how Linux functionality (mainly inlining) translates to Windows. If all else fails you can simply makesig it yourself.

Lastly, you have the option of dumping the found functions and their signatures to a json file (dump.json). It dumps regardless, but all those signatures take a loooooong time to get, so you can choose. I dumped 3000 TF2 functions and it took ~40 minutes. YMMV.

You can even use the symbol smasher alongside the netprop importer to really, really clean up your Windows pseudocode.

Grab the symbol smasher here

For non-pro users
Fret not! I have a few included dumps on the Github from the smasher and plan on dumping more games if possible. You should also browse the .yml files as .json double escapes SM signatures.

You'll find dumps here or here and I'll try to keep them reasonably updated. If you have a dump of a game that isn't included or is outdated please open a pull request!
__________________
Over-engineering is underrated.

GitHub

Last edited by Scag; 08-17-2020 at 06:59. Reason: https://www.youtube.com/watch?v=GwILD1BjbQs
Scag is offline
Lux
Veteran Member
Join Date: Jan 2015
Location: Brexit
Old 08-06-2020 , 06:52   Re: [IDA] Symbol Smasher
Reply With Quote #2

Spoiler
yay brilliant job!
__________________

Last edited by Lux; 08-06-2020 at 06:54. Reason: add spoiler since it's huge
Lux is offline
Scag
AlliedModders Donor
Previously known as:
Ragenewb
Join Date: May 2017
Location: Crashing Hale
Old 08-17-2020 , 07:03   Re: IDA Scripts
Reply With Quote #3

Instead of making a whole new post, I've opted to just recycle this one and expand on it.

I've been messing around with IDA's API a lot recently and have been writing a few useful things to help with reversing, the most recent of those is the Netprop Importer. You'll see the details at the top but it just runs through a netprop dump and gives you some structs and prettier pseudocode.

__________________
Over-engineering is underrated.

GitHub
Scag is offline
manicogaming
AlliedModders Donor
Join Date: Aug 2014
Old 08-17-2020 , 17:49   Re: IDA Scripts
Reply With Quote #4

I took a look at your signature dumps and I'm pretty sure the signature you have for CBaseAnimating::LookupBone

Here's the signature that I'm pretty sure is the correct one.

Code:
"CBaseAnimating::LookupBone"
{
	// Has 'weapon_bone' string
	"library"	"server"
	"windows"	"\x55\x8B\xEC\x56\x57\x8B\xF9\x83\xBF\xC0\x04\x00\x00\x00\x75\x2A\xA1\x2A\x2A\x2A\x2A\x8B\x30\x8B\x07\xFF\x50\x18\x8B\x0D\x2A\x2A\x2A\x2A\x50\xFF\x56\x04\x85\xC0\x74\x2A\x8B\xCF\xE8\x2A\x2A\x2A\x2A\x8B\x8F\xC0\x04\x00\x00\x85\xC9\x0F\x84\x2A\x2A\x2A\x2A"
}
__________________
manicogaming is offline
Scag
AlliedModders Donor
Previously known as:
Ragenewb
Join Date: May 2017
Location: Crashing Hale
Old 08-17-2020 , 18:05   Re: IDA Scripts
Reply With Quote #5

What game?
__________________
Over-engineering is underrated.

GitHub
Scag is offline
manicogaming
AlliedModders Donor
Join Date: Aug 2014
Old 08-17-2020 , 19:33   Re: IDA Scripts
Reply With Quote #6

Quote:
Originally Posted by Ragenewb View Post
What game?
CS:GO windows
__________________
manicogaming is offline
Scag
AlliedModders Donor
Previously known as:
Ragenewb
Join Date: May 2017
Location: Crashing Hale
Old 08-17-2020 , 21:29   Re: IDA Scripts
Reply With Quote #7

Quote:
Originally Posted by manicogaming View Post
CS:GO windows
Yeah I see what's wrong, it's not wildcarding offsets. Give me a day or 2 and I'll re-dump everything

But the provided signatures should work, they'll just all break after the next update.
__________________
Over-engineering is underrated.

GitHub
Scag is offline
Reply


Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -4. The time now is 23:26.


Powered by vBulletin®
Copyright ©2000 - 2020, vBulletin Solutions, Inc.
Theme made by Freecode