diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index b2ff718..16ad4ed 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -20,16 +20,33 @@ jobs: include: - platform: windows-x86_64 runner: windows-2022 - preset: msvc-x64 - generator: Visual Studio 17 2022 - binary: build/msvc-x64/Release/oh-my-dump.dll + preset: windows-x86-64 + + - platform: windows-aarch64 + runner: windows-2022 + preset: windows-arm64 + + - platform: linux-x86_64 + runner: ubuntu-24.04 + preset: linux-x86-64 + + - platform: linux-aarch64 + runner: ubuntu-24.04-arm + preset: linux-arm64 + + - platform: macos-x86_64 + runner: macos-15-intel + preset: macos-x86-64 + + - platform: macos-aarch64 + runner: macos-15 + preset: macos-arm64 + runs-on: ${{ matrix.runner }} env: BUILD_PRESET: ${{ matrix.preset }} - CMAKE_GENERATOR: ${{ matrix.generator }} PLUGIN_PLATFORM: ${{ matrix.platform }} - PLUGIN_BINARY: ${{ matrix.binary }} defaults: run: @@ -67,7 +84,12 @@ jobs: - name: Prepare vcpkg run: | - git -C "$env:VCPKG_INSTALLATION_ROOT" fetch origin e1dfb369fc1c6e58d5850cf67c224caa955309e5 + if ($IsMacOS) { + $env:VCPKG_INSTALLATION_ROOT = "/usr/local/share/vcpkg" + } + + $manifest = Get-Content -Raw vcpkg.json | ConvertFrom-Json + git -C "$env:VCPKG_INSTALLATION_ROOT" fetch origin $manifest.'builtin-baseline' if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } "VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" >> $env:GITHUB_ENV @@ -82,21 +104,23 @@ jobs: - name: Package run: | + cmake --install "build/$env:BUILD_PRESET" --config Release --prefix package + if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE } + $binary = Get-ChildItem -LiteralPath package -File + New-Item -ItemType Directory -Force package/docs/images | Out-Null - New-Item -ItemType Directory -Force release-assets | Out-Null + New-Item -ItemType Directory -Force artifacts | Out-Null $metadata = Get-Content -Raw ida-plugin.json | ConvertFrom-Json $metadata.plugin.platforms = @($env:PLUGIN_PLATFORM) - Copy-Item $env:PLUGIN_BINARY package/ $metadata | ConvertTo-Json -Depth 20 | Set-Content -Encoding utf8 package/ida-plugin.json Copy-Item LICENSE package/ Copy-Item docs/images/omd-logo.png package/docs/images/ $version = $metadata.plugin.version - $archive = "release-assets/$($metadata.plugin.name)-v$version-$($env:PLUGIN_PLATFORM).zip" + $archive = "artifacts/$($metadata.plugin.name)-v$version-$($env:PLUGIN_PLATFORM).zip" Compress-Archive -Path package/* -DestinationPath $archive - $extension = [System.IO.Path]::GetExtension($env:PLUGIN_BINARY) - Copy-Item $env:PLUGIN_BINARY "release-assets/$($metadata.plugin.name)-$($env:PLUGIN_PLATFORM)$extension" + Copy-Item $binary.FullName "artifacts/$($metadata.plugin.name)-$($env:PLUGIN_PLATFORM)$($binary.Extension)" "RELEASE_ARCHIVE=$archive" >> $env:GITHUB_ENV - name: Set up Python @@ -115,7 +139,7 @@ jobs: uses: actions/upload-artifact@v4 with: name: oh-my-dump-${{ matrix.platform }} - path: release-assets/ + path: artifacts/ if-no-files-found: error release: diff --git a/CMakeLists.txt b/CMakeLists.txt index 74debcd..58ee39a 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -13,15 +13,44 @@ if (NOT EXISTS "${IDA_INCLUDE_DIR}/ida.hpp") message(FATAL_ERROR "Invalid IDA_SDK_DIR: ${IDA_SDK_DIR}") endif () +string(TOLOWER "${CMAKE_SYSTEM_PROCESSOR}" OMD_TARGET_PROCESSOR) +if (WIN32 AND CMAKE_VS_PLATFORM_NAME) + string(TOLOWER "${CMAKE_VS_PLATFORM_NAME}" OMD_TARGET_PROCESSOR) +elseif (APPLE AND CMAKE_OSX_ARCHITECTURES) + string(TOLOWER "${CMAKE_OSX_ARCHITECTURES}" OMD_TARGET_PROCESSOR) +endif () + +if (WIN32 AND OMD_TARGET_PROCESSOR MATCHES "^(amd64|x86_64|x64)$") + set(IDA_LIBRARY_SUFFIXES x64_win_64 x64_win_vc_64) + set(IDA_PLATFORM_DEFINITIONS __NT__) +elseif (WIN32 AND OMD_TARGET_PROCESSOR MATCHES "^(aarch64|arm64)$") + set(IDA_LIBRARY_SUFFIXES arm64_win_64) + set(IDA_PLATFORM_DEFINITIONS __NT__ __ARM__) +elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND OMD_TARGET_PROCESSOR MATCHES "^(amd64|x86_64|x64)$") + set(IDA_LIBRARY_SUFFIXES x64_linux_64) + set(IDA_PLATFORM_DEFINITIONS __LINUX__) +elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND OMD_TARGET_PROCESSOR MATCHES "^(aarch64|arm64)$") + set(IDA_LIBRARY_SUFFIXES arm64_linux_64) + set(IDA_PLATFORM_DEFINITIONS __LINUX__ __ARM__) +elseif (APPLE AND OMD_TARGET_PROCESSOR MATCHES "^(amd64|x86_64|x64)$") + set(IDA_LIBRARY_SUFFIXES x64_mac_64) + set(IDA_PLATFORM_DEFINITIONS __MAC__) +elseif (APPLE AND OMD_TARGET_PROCESSOR MATCHES "^(aarch64|arm64)$") + set(IDA_LIBRARY_SUFFIXES arm64_mac_64) + set(IDA_PLATFORM_DEFINITIONS __MAC__ __ARM__) +else () + message(FATAL_ERROR "Unsupported target: ${CMAKE_SYSTEM_NAME}/${OMD_TARGET_PROCESSOR}") +endif () + find_library(IDA_LIBRARY NAMES ida ida.lib "${IDA_LIBRARY_NAME}" PATHS "${IDA_SDK_DIR}/src/lib" - PATH_SUFFIXES x64_win_64 x64_win_vc_64 + PATH_SUFFIXES ${IDA_LIBRARY_SUFFIXES} NO_DEFAULT_PATH ) if (NOT IDA_LIBRARY) - message(FATAL_ERROR "IDA library not found under ${IDA_SDK_DIR}/src/lib (expected x64_win_64 or x64_win_vc_64).") + message(FATAL_ERROR "IDA library not found under ${IDA_SDK_DIR}/src/lib (expected ${IDA_LIBRARY_SUFFIXES}).") endif () get_filename_component(IDA_LIB_DIR "${IDA_LIBRARY}" DIRECTORY) @@ -38,6 +67,7 @@ add_library(oh-my-dump SHARED ${SOURCES}) set_target_properties(oh-my-dump PROPERTIES PREFIX "" + SKIP_BUILD_RPATH TRUE ) target_include_directories(oh-my-dump @@ -58,11 +88,13 @@ target_link_libraries(oh-my-dump ) target_compile_definitions(oh-my-dump PRIVATE - __NT__ + ${IDA_PLATFORM_DEFINITIONS} __IDP__ __EA64__ - _SILENCE_CXX20_IS_POD_DEPRECATION_WARNING + $<$:_SILENCE_CXX20_IS_POD_DEPRECATION_WARNING> dont_use_snprintf=snprintf dont_use_fgetc=fgetc _strtoui64=strtoull ) + +install(FILES "$" DESTINATION .) diff --git a/CMakePresets.json b/CMakePresets.json index 7ddeb27..d5cfec8 100644 --- a/CMakePresets.json +++ b/CMakePresets.json @@ -2,7 +2,7 @@ "version": 6, "cmakeMinimumRequired": { "major": 3, - "minor": 15, + "minor": 31, "patch": 0 }, "configurePresets": [ @@ -16,22 +16,115 @@ } }, { - "name": "msvc-x64", + "name": "windows-base", + "hidden": true, "inherits": "preset-base", - "displayName": "MSVC x64 Release", + "generator": "Visual Studio 17 2022", "toolset": "v143", "cacheVariables": { "CMAKE_C_COMPILER": "cl", - "CMAKE_CXX_COMPILER": "cl", + "CMAKE_CXX_COMPILER": "cl" + } + }, + { + "name": "windows-x86-64", + "inherits": "windows-base", + "displayName": "Windows x86-64 Release", + "cacheVariables": { "CMAKE_GENERATOR_PLATFORM": "x64", "VCPKG_TARGET_TRIPLET": "x64-windows" } + }, + { + "name": "windows-arm64", + "inherits": "windows-base", + "displayName": "Windows ARM64 Release", + "cacheVariables": { + "CMAKE_GENERATOR_PLATFORM": "ARM64", + "VCPKG_TARGET_TRIPLET": "arm64-windows" + } + }, + { + "name": "linux-base", + "hidden": true, + "inherits": "preset-base", + "generator": "Ninja Multi-Config" + }, + { + "name": "linux-x86-64", + "inherits": "linux-base", + "displayName": "Linux x86-64 Release", + "cacheVariables": { + "VCPKG_TARGET_TRIPLET": "x64-linux" + } + }, + { + "name": "linux-arm64", + "inherits": "linux-base", + "displayName": "Linux ARM64 Release", + "cacheVariables": { + "VCPKG_TARGET_TRIPLET": "arm64-linux" + } + }, + { + "name": "macos-base", + "hidden": true, + "inherits": "preset-base", + "generator": "Ninja Multi-Config", + "cacheVariables": { + "CMAKE_C_COMPILER": "/usr/bin/clang", + "CMAKE_CXX_COMPILER": "/usr/bin/clang++", + "CMAKE_OSX_DEPLOYMENT_TARGET": "15.0" + } + }, + { + "name": "macos-x86-64", + "inherits": "macos-base", + "displayName": "macOS x86-64 Release", + "cacheVariables": { + "CMAKE_OSX_ARCHITECTURES": "x86_64", + "VCPKG_TARGET_TRIPLET": "x64-osx" + } + }, + { + "name": "macos-arm64", + "inherits": "macos-base", + "displayName": "macOS ARM64 Release", + "cacheVariables": { + "CMAKE_OSX_ARCHITECTURES": "arm64", + "VCPKG_TARGET_TRIPLET": "arm64-osx" + } } ], "buildPresets": [ { - "name": "msvc-x64", - "configurePreset": "msvc-x64", + "name": "windows-x86-64", + "configurePreset": "windows-x86-64", + "configuration": "Release" + }, + { + "name": "windows-arm64", + "configurePreset": "windows-arm64", + "configuration": "Release" + }, + { + "name": "linux-x86-64", + "configurePreset": "linux-x86-64", + "configuration": "Release" + }, + { + "name": "linux-arm64", + "configurePreset": "linux-arm64", + "configuration": "Release" + }, + { + "name": "macos-x86-64", + "configurePreset": "macos-x86-64", + "configuration": "Release" + }, + { + "name": "macos-arm64", + "configurePreset": "macos-arm64", "configuration": "Release" } ] diff --git a/README.md b/README.md index 185e4a8..91d689c 100644 --- a/README.md +++ b/README.md @@ -18,6 +18,9 @@ That said, **Oh My Dump** is still useful because it handles cases that neither **Lumina** is primarily focused on function metadata, so it does not cover global variables or breakpoints. It also ties data to the function's **MD5** hash, which can be inconvenient when moving analysis between modified versions of a binary. +**Oh My Dump** is not intended to replace existing tools. It is simply another tool that helps you quickly annotate a binary +and export your analysis as signatures, or transfer information from your **pointers.hpp** into an **IDB**. + ## Limitations Unfortunately, **Oh My Dump** has a number of limitations that may be fixed in the future. For now, the project supports only **x86** and **x86-64** and does not work with other architectures. @@ -40,7 +43,15 @@ The rules are currently hardcoded and cannot be edited without recompiling, so i - Breakpoints; ## Installation -- Put it into plugins folder of **your** IDA installation. +### Package manager +With [HCLI](https://hcli.docs.hex-rays.com/) installed, run: + +```bash +hcli plugin install oh-my-dump +``` + +### Manual installation +Copy the binary or extracted ZIP contents for your platform from [Releases](https://github.com/nevergiveupcpp/oh-my-dump/releases) into **IDA's plugins** folder. ## Usage > To avoid repeating the same information, the import workflow is shown below. The same steps also apply to export. @@ -73,17 +84,17 @@ Select ***.omd.json** with signatures and wait for the search and signing to com The plugin uses **JSON files** to define signature patterns and their associated metadata. Each pattern is an object in a JSON array. ## Field reference -| Field | Required | Type | Description | -|----------------------------|----------|------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| `signature` | + | string | Byte pattern with wildcards (`?` or `??` for unknown bytes) | -| `name` | - | string | Sets name for function/variable at the found address | -| `declaration` | - | string | Sets function/variable type and name | -| `comment` | - | string | Adds comment to address or function | -| `color` | - | number | Sets background color (RGB value in decimal format) | -| `operations` | - | array | Array with data (`offset`, `insn_format`) for calculating final effective address. Possible fields: offset, insn_format. Fields can be arranged in any order and repeated.Operations executed sequentially from lower to higher index | -| `operations[].offset` | - | number | Is used for calculating final effective address by using basic operation (to current address += offset) | -| `operations[].insn_format` | - | array | Is used for obtaining relative offset. Calculation is performed as follows: for instruction at 0x1000 `"E8 12 34 56 78"` with format `[1,4]`: `rip = 0x1000 + 1 + 4`, `rel_offset = read_dword(0x1000 + 1)`, `final_address = rip + rel_offset` | -| `breakpoint` | - | array | Breakpoint configuration `[exist, type, size]`. Type: 0=software+execute (default), 1=write, 2=read, 3=read/write, 4=software, 8=execute, 12=default. Size is irrelevant for software breakpoints. For hardware breakpoints size matters but can't always be set to arbitrary values | +| Field | Type | Description | Required | +|:------|:----:|:------------|:--------:| +| `signature` | string | Byte pattern with wildcards (`?` or `??` for unknown bytes) | + | +| `name` | string | Sets name for function/variable at the found address | - | +| `declaration` | string | Sets function/variable type and name | - | +| `comment` | string | Adds comment to address or function | - | +| `color` | number | Sets background color (RGB value in decimal format) | - | +| `operations` | array | Array with data (`offset`, `insn_format`) for calculating final effective address. Possible fields: offset, insn_format. Fields can be arranged in any order and repeated.Operations executed sequentially from lower to higher index | - | +| `operations[].offset` | number | Is used for calculating final effective address by using basic operation (to current address += offset) | - | +| `operations[].insn_format` | array | Is used for obtaining relative offset. Calculation is performed as follows: for instruction at 0x1000 `"E8 12 34 56 78"` with format `[1,4]`: `rip = 0x1000 + 1 + 4`, `rel_offset = read_dword(0x1000 + 1)`, `final_address = rip + rel_offset` | - | +| `breakpoint` | array | Breakpoint configuration `[exist, type, size]`. Type: 0=software+execute (default), 1=write, 2=read, 3=read/write, 4=software, 8=execute, 12=default. Size is irrelevant for software breakpoints. For hardware breakpoints size matters but can't always be set to arbitrary values | - | ## Example configuration ```json @@ -151,8 +162,8 @@ The plugin uses **JSON files** to define signature patterns and their associated 1. Install `vcpkg` and set the `VCPKG_ROOT` environment variable. 2. Fetch baseline: `cd $VCPKG_ROOT && git fetch origin e1dfb369fc1c6e58d5850cf67c224caa955309e5`. 3. Set `IDA_ROOT` to your IDA installation directory. -4. Configure: `cmake --preset msvc-x64`. -5. Build: `cmake --build --preset msvc-x64 --config Release`. +4. Configure: `cmake --preset `. +5. Build: `cmake --build --preset --config Release`. ## License **oh-my-dump** is distributed under the [MIT License](LICENSE). diff --git a/ida-plugin.json b/ida-plugin.json index e8b343c..41fbcda 100644 --- a/ida-plugin.json +++ b/ida-plugin.json @@ -4,25 +4,38 @@ "plugin": { "name": "oh-my-dump", "entryPoint": "oh-my-dump", - "version": "1.0.16", + "version": "1.0.17", "idaVersions": [ - ">=9.0" + "9.0", + "9.1", + "9.2", + "9.3", + "9.4", + "9.5" ], "platforms": [ - "windows-x86_64" + "windows-x86_64", + "windows-aarch64", + "linux-x86_64", + "linux-aarch64", + "macos-x86_64", + "macos-aarch64" ], "description": "IDA Pro plugin for transferring analysis data between different versions of the same binary.", "license": "MIT", "logoPath": "./docs/images/omd-logo.png", "categories": [ - "api-scripting-and-automation" + "api-scripting-and-automation", + "collaboration-and-productivity" ], "keywords": [ - "automatic", - "binary-analysis", - "reverse-engineering", - "ida-pro", - "ida" + "idb", + "metadata", + "signatures", + "annotations", + "pattern-matching", + "analysis-transfer", + "omd" ], "urls": { "repository": "https://github.com/nevergiveupcpp/oh-my-dump" @@ -30,10 +43,6 @@ "authors": [{ "name": "nevergiveupcpp", "email": "nevergiveupcxx@gmail.com" - }], - "maintainers": [{ - "name": "nevergiveupcpp", - "email": "nevergiveupcxx@gmail.com" }] } } diff --git a/idaplugin/internals/export/export_filters.h b/idaplugin/internals/export/export_filters.h index 1619690..4aba593 100644 --- a/idaplugin/internals/export/export_filters.h +++ b/idaplugin/internals/export/export_filters.h @@ -12,7 +12,7 @@ namespace omd::export_filters { }; struct rule { - match match{}; + omd::export_filters::match match{}; std::string_view pattern{}; }; diff --git a/idaplugin/version.h b/idaplugin/version.h index 8db5e55..9bfa7dd 100644 --- a/idaplugin/version.h +++ b/idaplugin/version.h @@ -2,7 +2,7 @@ #define NGU_OMD_VERSION_H #define PLUGIN_NAME "Oh My Dump" -#define PLUGIN_VERSION "1.0.16" +#define PLUGIN_VERSION "1.0.17" #define PLUGIN_HOTKEY "Ctrl+Shift+F10" #endif // NGU_OMD_VERSION_H diff --git a/vcpkg.json b/vcpkg.json index 44fdfb0..2b44b7c 100644 --- a/vcpkg.json +++ b/vcpkg.json @@ -1,6 +1,6 @@ { "name": "oh-my-dump", - "version": "1.0.6", + "version": "1.0.17", "builtin-baseline": "e1dfb369fc1c6e58d5850cf67c224caa955309e5", "dependencies": [ "nlohmann-json"