Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
48 changes: 36 additions & 12 deletions .github/workflows/build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -20,16 +20,33 @@ jobs:
include:
- platform: windows-x86_64
runner: windows-2022
preset: msvc-x64
generator: Visual Studio 17 2022
binary: build/msvc-x64/Release/oh-my-dump.dll
preset: windows-x86-64

- platform: windows-aarch64
runner: windows-2022
preset: windows-arm64

- platform: linux-x86_64
runner: ubuntu-24.04
preset: linux-x86-64

- platform: linux-aarch64
runner: ubuntu-24.04-arm
preset: linux-arm64

- platform: macos-x86_64
runner: macos-15-intel
preset: macos-x86-64

- platform: macos-aarch64
runner: macos-15
preset: macos-arm64

runs-on: ${{ matrix.runner }}

env:
BUILD_PRESET: ${{ matrix.preset }}
CMAKE_GENERATOR: ${{ matrix.generator }}
PLUGIN_PLATFORM: ${{ matrix.platform }}
PLUGIN_BINARY: ${{ matrix.binary }}

defaults:
run:
Expand Down Expand Up @@ -67,7 +84,12 @@ jobs:

- name: Prepare vcpkg
run: |
git -C "$env:VCPKG_INSTALLATION_ROOT" fetch origin e1dfb369fc1c6e58d5850cf67c224caa955309e5
if ($IsMacOS) {
$env:VCPKG_INSTALLATION_ROOT = "/usr/local/share/vcpkg"
}

$manifest = Get-Content -Raw vcpkg.json | ConvertFrom-Json
git -C "$env:VCPKG_INSTALLATION_ROOT" fetch origin $manifest.'builtin-baseline'
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

"VCPKG_ROOT=$env:VCPKG_INSTALLATION_ROOT" >> $env:GITHUB_ENV
Expand All @@ -82,21 +104,23 @@ jobs:

- name: Package
run: |
cmake --install "build/$env:BUILD_PRESET" --config Release --prefix package
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
$binary = Get-ChildItem -LiteralPath package -File

New-Item -ItemType Directory -Force package/docs/images | Out-Null
New-Item -ItemType Directory -Force release-assets | Out-Null
New-Item -ItemType Directory -Force artifacts | Out-Null
$metadata = Get-Content -Raw ida-plugin.json | ConvertFrom-Json
$metadata.plugin.platforms = @($env:PLUGIN_PLATFORM)

Copy-Item $env:PLUGIN_BINARY package/
$metadata | ConvertTo-Json -Depth 20 | Set-Content -Encoding utf8 package/ida-plugin.json
Copy-Item LICENSE package/
Copy-Item docs/images/omd-logo.png package/docs/images/

$version = $metadata.plugin.version
$archive = "release-assets/$($metadata.plugin.name)-v$version-$($env:PLUGIN_PLATFORM).zip"
$archive = "artifacts/$($metadata.plugin.name)-v$version-$($env:PLUGIN_PLATFORM).zip"
Compress-Archive -Path package/* -DestinationPath $archive
$extension = [System.IO.Path]::GetExtension($env:PLUGIN_BINARY)
Copy-Item $env:PLUGIN_BINARY "release-assets/$($metadata.plugin.name)-$($env:PLUGIN_PLATFORM)$extension"
Copy-Item $binary.FullName "artifacts/$($metadata.plugin.name)-$($env:PLUGIN_PLATFORM)$($binary.Extension)"
"RELEASE_ARCHIVE=$archive" >> $env:GITHUB_ENV

- name: Set up Python
Expand All @@ -115,7 +139,7 @@ jobs:
uses: actions/upload-artifact@v4
with:
name: oh-my-dump-${{ matrix.platform }}
path: release-assets/
path: artifacts/
if-no-files-found: error

release:
Expand Down
40 changes: 36 additions & 4 deletions CMakeLists.txt
Original file line number Diff line number Diff line change
Expand Up @@ -13,15 +13,44 @@ if (NOT EXISTS "${IDA_INCLUDE_DIR}/ida.hpp")
message(FATAL_ERROR "Invalid IDA_SDK_DIR: ${IDA_SDK_DIR}")
endif ()

string(TOLOWER "${CMAKE_SYSTEM_PROCESSOR}" OMD_TARGET_PROCESSOR)
if (WIN32 AND CMAKE_VS_PLATFORM_NAME)
string(TOLOWER "${CMAKE_VS_PLATFORM_NAME}" OMD_TARGET_PROCESSOR)
elseif (APPLE AND CMAKE_OSX_ARCHITECTURES)
string(TOLOWER "${CMAKE_OSX_ARCHITECTURES}" OMD_TARGET_PROCESSOR)
endif ()

if (WIN32 AND OMD_TARGET_PROCESSOR MATCHES "^(amd64|x86_64|x64)$")
set(IDA_LIBRARY_SUFFIXES x64_win_64 x64_win_vc_64)
set(IDA_PLATFORM_DEFINITIONS __NT__)
elseif (WIN32 AND OMD_TARGET_PROCESSOR MATCHES "^(aarch64|arm64)$")
set(IDA_LIBRARY_SUFFIXES arm64_win_64)
set(IDA_PLATFORM_DEFINITIONS __NT__ __ARM__)
elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND OMD_TARGET_PROCESSOR MATCHES "^(amd64|x86_64|x64)$")
set(IDA_LIBRARY_SUFFIXES x64_linux_64)
set(IDA_PLATFORM_DEFINITIONS __LINUX__)
elseif (CMAKE_SYSTEM_NAME STREQUAL "Linux" AND OMD_TARGET_PROCESSOR MATCHES "^(aarch64|arm64)$")
set(IDA_LIBRARY_SUFFIXES arm64_linux_64)
set(IDA_PLATFORM_DEFINITIONS __LINUX__ __ARM__)
elseif (APPLE AND OMD_TARGET_PROCESSOR MATCHES "^(amd64|x86_64|x64)$")
set(IDA_LIBRARY_SUFFIXES x64_mac_64)
set(IDA_PLATFORM_DEFINITIONS __MAC__)
elseif (APPLE AND OMD_TARGET_PROCESSOR MATCHES "^(aarch64|arm64)$")
set(IDA_LIBRARY_SUFFIXES arm64_mac_64)
set(IDA_PLATFORM_DEFINITIONS __MAC__ __ARM__)
else ()
message(FATAL_ERROR "Unsupported target: ${CMAKE_SYSTEM_NAME}/${OMD_TARGET_PROCESSOR}")
endif ()

find_library(IDA_LIBRARY
NAMES ida ida.lib "${IDA_LIBRARY_NAME}"
PATHS "${IDA_SDK_DIR}/src/lib"
PATH_SUFFIXES x64_win_64 x64_win_vc_64
PATH_SUFFIXES ${IDA_LIBRARY_SUFFIXES}
NO_DEFAULT_PATH
)

if (NOT IDA_LIBRARY)
message(FATAL_ERROR "IDA library not found under ${IDA_SDK_DIR}/src/lib (expected x64_win_64 or x64_win_vc_64).")
message(FATAL_ERROR "IDA library not found under ${IDA_SDK_DIR}/src/lib (expected ${IDA_LIBRARY_SUFFIXES}).")
endif ()

get_filename_component(IDA_LIB_DIR "${IDA_LIBRARY}" DIRECTORY)
Expand All @@ -38,6 +67,7 @@ add_library(oh-my-dump SHARED ${SOURCES})
set_target_properties(oh-my-dump
PROPERTIES
PREFIX ""
SKIP_BUILD_RPATH TRUE
)

target_include_directories(oh-my-dump
Expand All @@ -58,11 +88,13 @@ target_link_libraries(oh-my-dump
)

target_compile_definitions(oh-my-dump PRIVATE
__NT__
${IDA_PLATFORM_DEFINITIONS}
__IDP__
__EA64__
_SILENCE_CXX20_IS_POD_DEPRECATION_WARNING
$<$<CXX_COMPILER_ID:MSVC>:_SILENCE_CXX20_IS_POD_DEPRECATION_WARNING>
dont_use_snprintf=snprintf
dont_use_fgetc=fgetc
_strtoui64=strtoull
)

install(FILES "$<TARGET_FILE:oh-my-dump>" DESTINATION .)
105 changes: 99 additions & 6 deletions CMakePresets.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
"version": 6,
"cmakeMinimumRequired": {
"major": 3,
"minor": 15,
"minor": 31,
"patch": 0
},
"configurePresets": [
Expand All @@ -16,22 +16,115 @@
}
},
{
"name": "msvc-x64",
"name": "windows-base",
"hidden": true,
"inherits": "preset-base",
"displayName": "MSVC x64 Release",
"generator": "Visual Studio 17 2022",
"toolset": "v143",
"cacheVariables": {
"CMAKE_C_COMPILER": "cl",
"CMAKE_CXX_COMPILER": "cl",
"CMAKE_CXX_COMPILER": "cl"
}
},
{
"name": "windows-x86-64",
"inherits": "windows-base",
"displayName": "Windows x86-64 Release",
"cacheVariables": {
"CMAKE_GENERATOR_PLATFORM": "x64",
"VCPKG_TARGET_TRIPLET": "x64-windows"
}
},
{
"name": "windows-arm64",
"inherits": "windows-base",
"displayName": "Windows ARM64 Release",
"cacheVariables": {
"CMAKE_GENERATOR_PLATFORM": "ARM64",
"VCPKG_TARGET_TRIPLET": "arm64-windows"
}
},
{
"name": "linux-base",
"hidden": true,
"inherits": "preset-base",
"generator": "Ninja Multi-Config"
},
{
"name": "linux-x86-64",
"inherits": "linux-base",
"displayName": "Linux x86-64 Release",
"cacheVariables": {
"VCPKG_TARGET_TRIPLET": "x64-linux"
}
},
{
"name": "linux-arm64",
"inherits": "linux-base",
"displayName": "Linux ARM64 Release",
"cacheVariables": {
"VCPKG_TARGET_TRIPLET": "arm64-linux"
}
},
{
"name": "macos-base",
"hidden": true,
"inherits": "preset-base",
"generator": "Ninja Multi-Config",
"cacheVariables": {
"CMAKE_C_COMPILER": "/usr/bin/clang",
"CMAKE_CXX_COMPILER": "/usr/bin/clang++",
"CMAKE_OSX_DEPLOYMENT_TARGET": "15.0"
}
},
{
"name": "macos-x86-64",
"inherits": "macos-base",
"displayName": "macOS x86-64 Release",
"cacheVariables": {
"CMAKE_OSX_ARCHITECTURES": "x86_64",
"VCPKG_TARGET_TRIPLET": "x64-osx"
}
},
{
"name": "macos-arm64",
"inherits": "macos-base",
"displayName": "macOS ARM64 Release",
"cacheVariables": {
"CMAKE_OSX_ARCHITECTURES": "arm64",
"VCPKG_TARGET_TRIPLET": "arm64-osx"
}
}
],
"buildPresets": [
{
"name": "msvc-x64",
"configurePreset": "msvc-x64",
"name": "windows-x86-64",
"configurePreset": "windows-x86-64",
"configuration": "Release"
},
{
"name": "windows-arm64",
"configurePreset": "windows-arm64",
"configuration": "Release"
},
{
"name": "linux-x86-64",
"configurePreset": "linux-x86-64",
"configuration": "Release"
},
{
"name": "linux-arm64",
"configurePreset": "linux-arm64",
"configuration": "Release"
},
{
"name": "macos-x86-64",
"configurePreset": "macos-x86-64",
"configuration": "Release"
},
{
"name": "macos-arm64",
"configurePreset": "macos-arm64",
"configuration": "Release"
}
]
Expand Down
39 changes: 25 additions & 14 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,9 @@ That said, **Oh My Dump** is still useful because it handles cases that neither
**Lumina** is primarily focused on function metadata, so it does not cover global variables or breakpoints.
It also ties data to the function's **MD5** hash, which can be inconvenient when moving analysis between modified versions of a binary.

**Oh My Dump** is not intended to replace existing tools. It is simply another tool that helps you quickly annotate a binary
and export your analysis as signatures, or transfer information from your **pointers.hpp** into an **IDB**.

## Limitations
Unfortunately, **Oh My Dump** has a number of limitations that may be fixed in the future.
For now, the project supports only **x86** and **x86-64** and does not work with other architectures.
Expand All @@ -40,7 +43,15 @@ The rules are currently hardcoded and cannot be edited without recompiling, so i
- Breakpoints;

## Installation
- Put it into plugins folder of **your** IDA installation.
### Package manager
With [HCLI](https://hcli.docs.hex-rays.com/) installed, run:

```bash
hcli plugin install oh-my-dump
```

### Manual installation
Copy the binary or extracted ZIP contents for your platform from [Releases](https://github.com/nevergiveupcpp/oh-my-dump/releases) into **IDA's plugins** folder.

## Usage
> To avoid repeating the same information, the import workflow is shown below. The same steps also apply to export.
Expand Down Expand Up @@ -73,17 +84,17 @@ Select ***.omd.json** with signatures and wait for the search and signing to com
The plugin uses **JSON files** to define signature patterns and their associated metadata. Each pattern is an object in a JSON array.

## Field reference
| Field | Required | Type | Description |
|----------------------------|----------|------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `signature` | + | string | Byte pattern with wildcards (`?` or `??` for unknown bytes) |
| `name` | - | string | Sets name for function/variable at the found address |
| `declaration` | - | string | Sets function/variable type and name |
| `comment` | - | string | Adds comment to address or function |
| `color` | - | number | Sets background color (RGB value in decimal format) |
| `operations` | - | array | Array with data (`offset`, `insn_format`) for calculating final effective address. Possible fields: offset, insn_format. Fields can be arranged in any order and repeated.Operations executed sequentially from lower to higher index |
| `operations[].offset` | - | number | Is used for calculating final effective address by using basic operation (to current address += offset) |
| `operations[].insn_format` | - | array | Is used for obtaining relative offset. Calculation is performed as follows: for instruction at 0x1000 `"E8 12 34 56 78"` with format `[1,4]`: `rip = 0x1000 + 1 + 4`, `rel_offset = read_dword(0x1000 + 1)`, `final_address = rip + rel_offset` |
| `breakpoint` | - | array | Breakpoint configuration `[exist, type, size]`. Type: 0=software+execute (default), 1=write, 2=read, 3=read/write, 4=software, 8=execute, 12=default. Size is irrelevant for software breakpoints. For hardware breakpoints size matters but can't always be set to arbitrary values |
| Field | Type | Description | Required |
|:------|:----:|:------------|:--------:|
| `signature` | string | Byte pattern with wildcards (`?` or `??` for unknown bytes) | + |
| `name` | string | Sets name for function/variable at the found address | - |
| `declaration` | string | Sets function/variable type and name | - |
| `comment` | string | Adds comment to address or function | - |
| `color` | number | Sets background color (RGB value in decimal format) | - |
| `operations` | array | Array with data (`offset`, `insn_format`) for calculating final effective address. Possible fields: offset, insn_format. Fields can be arranged in any order and repeated.Operations executed sequentially from lower to higher index | - |
| `operations[].offset` | number | Is used for calculating final effective address by using basic operation (to current address += offset) | - |
| `operations[].insn_format` | array | Is used for obtaining relative offset. Calculation is performed as follows: for instruction at 0x1000 `"E8 12 34 56 78"` with format `[1,4]`: `rip = 0x1000 + 1 + 4`, `rel_offset = read_dword(0x1000 + 1)`, `final_address = rip + rel_offset` | - |
| `breakpoint` | array | Breakpoint configuration `[exist, type, size]`. Type: 0=software+execute (default), 1=write, 2=read, 3=read/write, 4=software, 8=execute, 12=default. Size is irrelevant for software breakpoints. For hardware breakpoints size matters but can't always be set to arbitrary values | - |

## Example configuration
```json
Expand Down Expand Up @@ -151,8 +162,8 @@ The plugin uses **JSON files** to define signature patterns and their associated
1. Install `vcpkg` and set the `VCPKG_ROOT` environment variable.
2. Fetch baseline: `cd $VCPKG_ROOT && git fetch origin e1dfb369fc1c6e58d5850cf67c224caa955309e5`.
3. Set `IDA_ROOT` to your IDA installation directory.
4. Configure: `cmake --preset msvc-x64`.
5. Build: `cmake --build --preset msvc-x64 --config Release`.
4. Configure: `cmake --preset <platform>`.
5. Build: `cmake --build --preset <platform> --config Release`.

## License
**oh-my-dump** is distributed under the [MIT License](LICENSE).
Loading
Loading