Dbg插件编写与DLL调试

向你扔鸡爪

已于 2025-02-23 11:06:04 修改

阅读量466

点赞数 10

CC 4.0 BY-SA版权

分类专栏：补丁文章标签：汇编

于 2025-02-19 14:07:22 首次发布

本文链接：https://blog.csdn.net/weixin_48257887/article/details/145728092

补丁专栏收录该内容

3 篇文章

订阅专栏

OD:

ASM:

.386
.model flat,stdcall
option casemap :none

include windows.inc
include msvcrt.inc
include kernel32.inc
include user32.inc
include Plugin.INC

includelib msvcrt.lib
includelib kernel32.lib
includelib user32.lib
includelib Ollydbg.lib



.data
    g_szbuff db "MyDll",0
    g_szModuleName db "KernelBase.dll",0
    g_szFuncName db "UnhandledExceptionFilter",0
    
.code
    
    _ODBG_Plugindata proc C myshortname: ptr SBYTE
    
       invoke crt_strcpy,myshortname,addr g_szbuff
       mov eax,PLUGIN_VERSION
       ret
        
    _ODBG_Plugindata endp 
  


    _ODBG_Plugininit proc C ollydbgversion:DWORD,hw:HWND,features:ptr ulong
        
        mov eax,0
        ret

    _ODBG_Plugininit endp
    

    
    _ODBG_Paused proc C reason:DWORD,reg:ptr t_reg
        local   @pro:DWORD
        local   @bt:BYTE

        mov eax,reason
        .if eax==0
            
           invoke GetModuleHandle,addr g_szModuleName
           invoke GetProcAddress,eax,addr g_szFuncName
           mov @pro,eax
           add @pro,0beh
           mov @bt,84h
           
           invoke Writememory,addr @bt,@pro,1,2

        .endif
        mov eax,0
        ret

    _ODBG_Paused endp
    

    DllMain proc hinstDLL:HINSTANCE ,fdwReason:DWORD ,lpvReserved :LPVOID 
        
        mov eax,TRUE
        ret
    DllMain endp
end DllMain

C\C++:

//说明：
        1.头文件和Lib放到工程目录下面，代码中包含.h和.lib
        2.ODBG_Plugindata函数只用来给插件取名    ->必写
        3.ODBG_Plugininit函数做一些初始化工作    ->必写
        4.ODBG_Paused插件的回调


#include <windows.h>

#include "Plugin.h"
#pragma comment(lib,"Ollydbg.lib")


int ODBG_Plugindata(char* shortname)
{
    strcpy_s(shortname, 31, "Exception Filter");
    return PLUGIN_VERSION;
}

int ODBG_Plugininit(int ollydbgversion, HWND hw, ulong* features)
{
    return 0;
}

int ODBG_Paused(int reason, t_reg* reg)
{
    if (reason == PP_EVENT)
    {
        PBYTE pro = (PBYTE)GetProcAddress(GetModuleHandle(L"KernelBase.dll"), "UnhandledExceptionFilter");
        pro += 0xbe;

        BYTE bt = 0x84;
        Writememory(&bt, (long)pro, sizeof(BYTE), MM_SILENT);
    }
    return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule,DWORD  ul_reason_for_call,LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

x64dbg：

以下是pluginmain.h 和pluginmain.cpp的模板内容

pluginmain.h ：

#pragma once

// Plugin information
#define PLUGIN_NAME "Mydll"
#define PLUGIN_VERSION 1

#include "pluginsdk/bridgemain.h"
#include "pluginsdk/_plugins.h"

#include "pluginsdk/_scriptapi_argument.h"
#include "pluginsdk/_scriptapi_assembler.h"
#include "pluginsdk/_scriptapi_bookmark.h"
#include "pluginsdk/_scriptapi_comment.h"
#include "pluginsdk/_scriptapi_debug.h"
#include "pluginsdk/_scriptapi_flag.h"
#include "pluginsdk/_scriptapi_function.h"
#include "pluginsdk/_scriptapi_gui.h"
#include "pluginsdk/_scriptapi_label.h"
#include "pluginsdk/_scriptapi_memory.h"
#include "pluginsdk/_scriptapi_misc.h"
#include "pluginsdk/_scriptapi_module.h"
#include "pluginsdk/_scriptapi_pattern.h"
#include "pluginsdk/_scriptapi_register.h"
#include "pluginsdk/_scriptapi_stack.h"
#include "pluginsdk/_scriptapi_symbol.h"

#include "pluginsdk/DeviceNameResolver/DeviceNameResolver.h"
#include "pluginsdk/jansson/jansson.h"
#include "pluginsdk/lz4/lz4file.h"
#include "pluginsdk/TitanEngine/TitanEngine.h"
#include "pluginsdk/XEDParse/XEDParse.h"

#ifdef _WIN64
#pragma comment(lib, "pluginsdk/x64dbg.lib")
#pragma comment(lib, "pluginsdk/x64bridge.lib")
#pragma comment(lib, "pluginsdk/DeviceNameResolver/DeviceNameResolver_x64.lib")
#pragma comment(lib, "pluginsdk/jansson/jansson_x64.lib")
#pragma comment(lib, "pluginsdk/lz4/lz4_x64.lib")
#pragma comment(lib, "pluginsdk/TitanEngine/TitanEngine_x64.lib")
#pragma comment(lib, "pluginsdk/XEDParse/XEDParse_x64.lib")
#else
#pragma comment(lib, "pluginsdk/x32dbg.lib")
#pragma comment(lib, "pluginsdk/x32bridge.lib")
#pragma comment(lib, "pluginsdk/DeviceNameResolver/DeviceNameResolver_x86.lib")
#pragma comment(lib, "pluginsdk/jansson/jansson_x86.lib")
#pragma comment(lib, "pluginsdk/lz4/lz4_x86.lib")
#pragma comment(lib, "pluginsdk/TitanEngine/TitanEngine_x86.lib")
#pragma comment(lib, "pluginsdk/XEDParse/XEDParse_x86.lib")
#endif //_WIN64

#define Cmd(x) DbgCmdExecDirect(x)
#define Eval(x) DbgValFromString(x)
#define dprintf(x, ...) _plugin_logprintf("[" PLUGIN_NAME "] " x, __VA_ARGS__)
#define dputs(x) _plugin_logprintf("[" PLUGIN_NAME "] %s\n", x)
#define PLUG_EXPORT extern "C" __declspec(dllexport)

//superglobal variables
extern int pluginHandle;
extern HWND hwndDlg;
extern int hMenu;
extern int hMenuDisasm;
extern int hMenuDump;
extern int hMenuStack;

//functions
bool pluginInit(PLUG_INITSTRUCT* initStruct);
void pluginStop();
void pluginSetup();

pluginmain.cpp：

#include "pluginmain.h"
#include <Windows.h>
#include <process.h>

int pluginHandle;
HWND hwndDlg;
int hMenu;
int hMenuDisasm;
int hMenuDump;
int hMenuStack;

// 导出函数
extern "C" __declspec(dllexport) void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY * info);
extern "C" __declspec(dllexport) void plugsetup(PLUG_SETUPSTRUCT * setupStruct);
extern "C" __declspec(dllexport) bool pluginit(PLUG_INITSTRUCT * initStruct);

// 在这里初始化插件数据。
bool pluginInit(PLUG_INITSTRUCT* initStruct)
{
    // 返回false以取消加载插件。
    return true;
}

// 在此处取消初始化插件数据。
void pluginStop()
{
}

// 在这里做GUI/菜单相关的事情。
void pluginSetup()
{
}

// 菜单被点击回调
void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info)
{
    // 此菜单用于实现功能，并测试
    if (info->hEntry == 0)
    {
        _plugin_logprint("enable UEH\n");
    }
    else if (info->hEntry == 1)
    {
        _plugin_logprint("disable UEH\n");
    } 
}

PLUG_EXPORT bool pluginit(PLUG_INITSTRUCT* initStruct)
{
    initStruct->pluginVersion = PLUGIN_VERSION;
    initStruct->sdkVersion = PLUG_SDKVERSION;
    strncpy_s(initStruct->pluginName, PLUGIN_NAME, _TRUNCATE);
    pluginHandle = initStruct->pluginHandle;

    return pluginInit(initStruct);
}

PLUG_EXPORT bool plugstop()
{
    pluginStop();
    return true;
}

PLUG_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct)
{
    hwndDlg = setupStruct->hwndDlg;
    hMenu = setupStruct->hMenu;
    hMenuDisasm = setupStruct->hMenuDisasm;
    hMenuDump = setupStruct->hMenuDump;
    hMenuStack = setupStruct->hMenuStack;

    _plugin_menuaddentry(setupStruct->hMenu, 0, "enable UEH");
    _plugin_menuaddentry(setupStruct->hMenu, 1, "disable UEH");

    pluginSetup();
}