IDA7.0安装keypatch和findcrypt-yara插件

快来打我* 2022-05-13 17:33 360阅读 0赞

谢天谢地终于装上了，赶紧把方法写一下。找了半天网上的安装方法又繁琐有坑人，偏偏这个插件利用keystone对版本要求很高。

**Keypatch ****可以直接修改二进制代码的插件**

链接：[https://github.com/keystone-engine/keypatch][https_github.com_keystone-engine_keypatch]

安装：

1、 下载Keypatch.py复制到插件目录

**IDA 7.0\\plugins\\Keypatch.py**

2、 下载安装keystone python模块，64位系统只需要安装这一个就行

[https://github.com/keystone-engine/keystone/releases/download/0.9.1/keystone-0.9.1-python-win64.msi][https_github.com_keystone-engine_keystone_releases_download_0.9.1_keystone-0.9.1-python-win64.msi]

然后你就能发现在IDA里的Edit->Keypatch

**findcrypt-yara ****找加密方式的插件**

链接：[https://github.com/polymorf/findcrypt-yara][https_github.com_polymorf_findcrypt-yara]

简介：IDA pro plugin to find crypto constants (and more)

安装：

1、 安装yara-python，最简单的方式是使用：**pip install yara-python**

yara-python地址：[https://github.com/VirusTotal/yara-python][https_github.com_VirusTotal_yara-python]

2、 下载findcrypt.py复制到插件目录

**IDA 7.0\\plugins\\findcrypt3.rules**

**IDA 7.0\\plugins\\findcrypt3.py**

然后你就能发现在IDA里的Edit->plugins->findcrypt

转自：[https://www.cnblogs.com/zhaijiahui/p/7978897.html][https_www.cnblogs.com_zhaijiahui_p_7978897.html]

[https_github.com_keystone-engine_keypatch]: https://github.com/keystone-engine/keypatch
[https_github.com_keystone-engine_keystone_releases_download_0.9.1_keystone-0.9.1-python-win64.msi]: https://github.com/keystone-engine/keystone/releases/download/0.9.1/keystone-0.9.1-python-win64.msi
[https_github.com_polymorf_findcrypt-yara]: https://github.com/polymorf/findcrypt-yara
[https_github.com_VirusTotal_yara-python]: https://github.com/VirusTotal/yara-python
[https_www.cnblogs.com_zhaijiahui_p_7978897.html]: https://www.cnblogs.com/zhaijiahui/p/7978897.html