Mac IDA Pro7.0安装keypatch

亦凉 2022-12-27 08:26 531阅读 0赞

## 什么是keypatch ##

keypatch 可以在IDA中直接修改二进制代码的插件， [项目地址][Link 1]

## 安装 ##

由于我用的IDA是2017年泄露的7.0版本，因此使用的是Python2，那么首先使用pip2安装keystone-engine

> sudo pip install keystone-engine
    Password:
    DEPRECATION: Python 2.7 reached the end of its life on January 1st, 2020. Please upgrade your Python as Python 2.7 is no longer maintained. pip 21.0 will drop support for Python 2.7 in January 2021. More details about Python 2 support in pip, can be found at https://pip.pypa.io/en/latest/development/release-process/#python-2-support
    WARNING: The directory '/Users/xmly/Library/Caches/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag.
    Collecting keystone-engine
      Downloading keystone_engine-0.9.2-py2.py3-none-macosx_10_14_x86_64.whl (3.0 MB)
         |████████████████████████████████| 3.0 MB 802 kB/s
    Installing collected packages: keystone-engine
    Successfully installed keystone-engine-0.9.2

之后拷贝git项目中的keypatch.py到ida pro的路径下：

> git clone https://github.com/keystone-engine/keypatch.git
    > cd keypatch
    > sudo cp keypatch.py /Applications/IDA\ Pro/ida.app/Contents/MacOS/plugins/

之后重启IDA Pro即可使用插件。  
右键菜单入口：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lvdXNoYW9kdW8_size_16_color_FFFFFF_t_70]  
Edit菜单入口：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lvdXNoYW9kdW8_size_16_color_FFFFFF_t_70 1]

[Link 1]: https://github.com/keystone-engine/keypatch#appendix-install-keystone-for-ida-pro
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lvdXNoYW9kdW8_size_16_color_FFFFFF_t_70]: /images/20221120/96ae359ece0f42d382ecaed43394844f.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L3lvdXNoYW9kdW8_size_16_color_FFFFFF_t_70 1]: /images/20221120/b9ee1411c10d4df2a812c5b309b4ebe0.png