1.5 为x64dbg编写插件( 二 )


PLUG_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct){hwndDlg = setupStruct->hwndDlg;hMenu = setupStruct->hMenu;hMenuDisasm = setupStruct->hMenuDisasm;hMenuDump = setupStruct->hMenuDump;hMenuStack = setupStruct->hMenuStack;// 增加二级菜单char sub_menu[] = { "PowerBy LyShark" };_plugin_menuaddentry(setupStruct->hMenu, 2, sub_menu);pluginSetup();}
当菜单被点击是则会触发函数,执行该函数内的流程,如上就是插件的加载流程 。
(2)开发插件实战
在本节,笔者将带领大家实现一个简单的插件,该插件的功能很简单,当用户点击菜单栏中的选项是,我们让其弹出一个消息框,此处为了开发方便,我做了精简化,你可以直接使用我的方法来新建文件,建出来的文件只有两个非常简洁 。
首先在头文件部分新建一个.h并增加替换成自己项目的名字 。
#pragma once// Plugin information#define PLUGIN_NAME "LySharkBlog"#define PLUGIN_VERSION 1#include "./bridgemain.h"#include "./_plugins.h"#include "./_scriptapi_argument.h"#include "./_scriptapi_assembler.h"#include "./_scriptapi_bookmark.h"#include "./_scriptapi_comment.h"#include "./_scriptapi_debug.h"#include "./_scriptapi_flag.h"#include "./_scriptapi_function.h"#include "./_scriptapi_gui.h"#include "./_scriptapi_label.h"#include "./_scriptapi_memory.h"#include "./_scriptapi_misc.h"#include "./_scriptapi_module.h"#include "./_scriptapi_pattern.h"#include "./_scriptapi_register.h"#include "./_scriptapi_stack.h"#include "./_scriptapi_symbol.h"#include "./DeviceNameResolver/DeviceNameResolver.h"#include "./jansson/jansson.h"#include "./lz4/lz4file.h"#include "./TitanEngine/TitanEngine.h"#include "./XEDParse/XEDParse.h"#ifdef _WIN64#pragma comment(lib, "./x64dbg.lib")#pragma comment(lib, "./x64bridge.lib")#pragma comment(lib, "./DeviceNameResolver/DeviceNameResolver_x64.lib")#pragma comment(lib, "./jansson/jansson_x64.lib")#pragma comment(lib, "./lz4/lz4_x64.lib")#pragma comment(lib, "./TitanEngine/TitanEngine_x64.lib")#pragma comment(lib, "./XEDParse/XEDParse_x64.lib")#else#pragma comment(lib, "./x32dbg.lib")#pragma comment(lib, "./x32bridge.lib")#pragma comment(lib, "./DeviceNameResolver/DeviceNameResolver_x86.lib")#pragma comment(lib, "./jansson/jansson_x86.lib")#pragma comment(lib, "./lz4/lz4_x86.lib")#pragma comment(lib, "./TitanEngine/TitanEngine_x86.lib")#pragma comment(lib, "./XEDParse/XEDParse_x86.lib")#endif //_WIN64#define Cmd(x) DbgCmdExecDirect(x)#define Eval(x) DbgValFromString(x)#define dprintf(x, ...) _plugin_logprintf("[" PLUGIN_NAME "] " x, __VA_ARGS__)#define dputs(x) _plugin_logprintf("[" PLUGIN_NAME "] %s\n", x)#define PLUG_EXPORT extern "C" __declspec(dllexport)//superglobal variablesextern int pluginHandle;extern HWND hwndDlg;extern int hMenu;extern int hMenuDisasm;extern int hMenuDump;extern int hMenuStack;//functionsbool pluginInit(PLUG_INITSTRUCT* initStruct);void pluginStop();void pluginSetup();
其次新建一个实现文件.cpp并写入以下代码,多数情况下我为了方便调试会使用这段代码,当我们点击菜单时会触发菜单功能,以此可以快速测试特定函数是否正常 。
#include "pluginmain.h"#include #include int pluginHandle;HWND hwndDlg;int hMenu;int hMenuDisasm;int hMenuDump;int hMenuStack;// 导出函数extern "C" __declspec(dllexport) void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info);extern "C" __declspec(dllexport) void plugsetup(PLUG_SETUPSTRUCT* setupStruct);extern "C" __declspec(dllexport) bool pluginit(PLUG_INITSTRUCT* initStruct);// 在这里初始化插件数据 。bool pluginInit(PLUG_INITSTRUCT* initStruct){// 返回false以取消加载插件 。return true;}// 在此处取消初始化插件数据 。void pluginStop(){}// 在这里做GUI/菜单相关的事情 。void pluginSetup(){}// 菜单被点击回调void CBMENUENTRY(CBTYPE cbType, PLUG_CB_MENUENTRY* info){// 此菜单用于实现功能,并测试MessageBox(0, L"hello lyshark", 0, 0);}PLUG_EXPORT bool pluginit(PLUG_INITSTRUCT* initStruct){initStruct->pluginVersion = PLUGIN_VERSION;initStruct->sdkVersion = PLUG_SDKVERSION;strncpy_s(initStruct->pluginName, PLUGIN_NAME, _TRUNCATE);pluginHandle = initStruct->pluginHandle;// 插件初始化initStruct->sdkVersion = PLUG_SDKVERSION;initStruct->pluginVersion = 1;const char *name = "CheckME -->";memset(initStruct->pluginName, 0, 128);memcpy(initStruct->pluginName, name, strlen(name));return pluginInit(initStruct);}PLUG_EXPORT bool plugstop(){pluginStop();return true;}PLUG_EXPORT void plugsetup(PLUG_SETUPSTRUCT* setupStruct){hwndDlg = setupStruct->hwndDlg;hMenu = setupStruct->hMenu;hMenuDisasm = setupStruct->hMenuDisasm;hMenuDump = setupStruct->hMenuDump;hMenuStack = setupStruct->hMenuStack;// 增加二级菜单char sub_menu[] = { "PowerBy LyShark" };_plugin_menuaddentry(setupStruct->hMenu, 2, sub_menu);pluginSetup();}