-
-
Save seth1002/79cc8dd1bceec1a2b5d6bb8c28ca366f to your computer and use it in GitHub Desktop.
IDA Plugin for quickly copying disassembly as encoded hex bytes
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
############################################################################################ | |
## | |
## Quick IDA Hex Bytes Copy | |
## | |
## All credit for logic and code chunks: | |
## @tmr232 | |
## https://github.com/tmr232/Sark | |
## | |
## I simply removed dependencies and made it standalone. | |
## | |
## | |
## To install: | |
## Copy script into plugins directory, i.e: C:\Program Files(x86)\IDA 6.8\plugins | |
## | |
## To run: | |
## Highlight disassembly instructions and right click and select "Hex Copy" or press PLUGIN_HOTKEY | |
## The hex encoded bytes will be added to your clipboard | |
## | |
############################################################################################ | |
__VERSION__ = '0.1' | |
__AUTHOR__ = '@herrcore' | |
PLUGIN_NAME = "Hex Copy" | |
PLUGIN_HOTKEY = 'Ctrl+Alt+c' | |
import idaapi | |
import idc | |
if idaapi.IDA_SDK_VERSION >= 690: | |
from PyQt5.Qt import QApplication | |
else: | |
from PySide.QtGui import QApplication | |
class HexCopy(): | |
@classmethod | |
def __copy_to_clip(cls, data): | |
QApplication.clipboard().setText(data) | |
@classmethod | |
def __get_selection(cls): | |
''' | |
Copied from Sark | |
https://github.com/tmr232/Sark/blob/30abd3fbba67389c9b1a30ede724e2fd96c7534f/sark/code/base.py | |
''' | |
start = idc.SelStart() | |
end = idc.SelEnd() | |
if idaapi.BADADDR in (start, end): | |
ea = idc.here() | |
start = idaapi.get_item_head(ea) | |
end = idaapi.get_item_end(ea) | |
return start, end | |
@classmethod | |
def copy_selection(cls): | |
try: | |
start, end = cls.__get_selection() | |
data = idc.GetManyBytes(start, end-start) | |
cls.__copy_to_clip(data.encode('hex')) | |
print "Bytes copied!" | |
except Exception as e: | |
idaapi.msg(PLUGIN_NAME + " ERROR: " + str(e)) | |
return | |
class HexCopyHandler(idaapi.action_handler_t): | |
def activate(self, ctx): | |
HexCopy.copy_selection() | |
def update(self, ctx): | |
return idaapi.AST_ENABLE_ALWAYS | |
class HexCopyHooks(idaapi.UI_Hooks): | |
def finish_populating_tform_popup(self, form, popup): | |
tft = idaapi.get_tform_type(form) | |
if tft == idaapi.BWN_DISASM: | |
# Note the 'None' as action name (1st parameter). | |
# That's because the action will be deleted immediately | |
# after the context menu is hidden anyway, so there's | |
# really no need giving it a valid ID. | |
desc = idaapi.action_desc_t(None, 'Copy Hex', HexCopyHandler()) | |
idaapi.attach_dynamic_action_to_popup(form, popup, desc, None) | |
class QuickHexCopy(idaapi.plugin_t): | |
flags = idaapi.PLUGIN_UNL | |
comment = "Copy Hex Bytes" | |
help = "Highlight Assembly and right-click 'Copy Hex'" | |
wanted_name = PLUGIN_NAME | |
wanted_hotkey = PLUGIN_HOTKEY | |
def init(self): | |
idaapi.msg("Initializing: %s\n" % PLUGIN_NAME) | |
global hooks | |
hooks = HexCopyHooks() | |
re = hooks.hook() | |
return idaapi.PLUGIN_OK | |
def run(self, arg): | |
HexCopy.copy_selection() | |
pass | |
def term(self): | |
pass | |
def PLUGIN_ENTRY(): | |
return QuickHexCopy() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment