qt5classdump, 辅助逆向qt5程序的小工具

最新推荐文章于 2024-05-25 13:17:02 发布

weixin_30569033

最新推荐文章于 2024-05-25 13:17:02 发布

阅读量1.4k

点赞数

文章标签： c/c++

原文链接：http://www.cnblogs.com/tieyan/p/11418170.html

版权

qt5classdump是一款用于辅助逆向QT5程序的小工具，能尝试静态定位函数和属性的响应地址，支持ELF64、MACHO64、PE32、PE64格式。由于编译器指令复杂，找到的virtual_address可能不准确，需要通过在类的static_metacall地址下断点进行人肉分析。目前提供mac命令行程序，Windows版本待编译。

摘要由CSDN通过智能技术生成

辅助逆向qt5程序的小工具，尝试静态找出函数和属性的响应地址。支持elf64,macho64,pe32,pe64。
由于编译器指令比较复杂，找到的virtual_address地址不一定正确，不正确的情况下可尝试在类的static_metacall地址上下断点，人肉再分析。

例如分析ida.exe

./qt5classdump /Users/ye/work/tools/IDA_Pro_v7.0_Portable/ida.exe

输出

q5classdump 0.0.1, author : vmtest
for x86 x64 : elf64,macho64,pe32,pe64


//image_base 0x140000000


class DockArea{
    //static_metacall dispatch:0x1401d4a80
Q_SIGNALS:
    //virtual_address maybe:0x1402060c0
    void docksClosed(QList<DockWidget*> list);

    //virtual_address maybe:0x1402060c0
    void dragOccurred();

private slots:
    //virtual_address maybe:0x140008aa0
    void hideDragArrowsTimeout();

    //virtual_address maybe:0x14000ce30
    void tabDragRequest(BaseDockWidget* widget);

}

class DockAreaDragTitle{
    //static_metacall dispatch:0x1400443a0
}

class BaseDockWidget{
    //static_metacall dispatch:0x1400443a0
}

class DockWidgetTitleButton{
    //static_metacall dispatch:0x1400443a0
}

class DockWidgetTitle{
    //static_metacall dispatch:0x1400443a0
}

class DockTabBar{
    //static_metacall dispatch:0x1400443a0
}

class DockArrow{
    //static_metacall dispatch:0x1400443a0
}

class DockArrowArea{
    //static_metacall dispatch:0x1400443a0
}

class MainMsgList{
    //static_metacall dispatch:0x1401d5450
public slots:
    //virtual_address maybe:0x1400163f0
    void append(QString text);

    //virtual_address maybe:0x140209c78
    void scrollToCursor();

private slots:
    //virtual_address maybe:0x140016920
    void form_activate();

    //virtual_address maybe:0x140016930
    void form_deactivate();

    //get virtual_address maybe:0x1401d54f0
    //set virtual_address maybe:0x1400163f0
    QString append;

}

class IDAToolBar{
    //static_metacall dispatch:0x1400443a0
}

class ConsoleWidget{
    //static_metacall dispatch:0x1401d58f0
private slots:
    //virtual_address maybe:0x0
    bool form_activate();

    //virtual_address maybe:0x0
    bool form_deactivate();

    //virtual_address maybe:0x14001ea80
    bool form_help();

}

class IDAMainWindow{
    //static_metacall dispatch:0x1401d5930
Q_SIGNALS:
    //virtual_address maybe:0x1402060c0
    void srcviewChanged(QWidget* to);

    //virtual_address maybe:0x1401d5540
    void caretBlinkIntervalChanged(int was,int now);

    //virtual_address maybe:0x1402060c0
    void beginTraceBufChange();

    //virtual_address maybe:0x1402060c0
    void endTraceBufChange();

public slots:
    //virtual_address maybe:0x14001f7d0
    bool make_full_screen(DockWidget* dock);

public slots:
    //virtual_address maybe:0x14001f7d0
    bool make_full_screen();

public slots:
    //virtual_address maybe:0x14001f720
    bool leave_full_screen();

    //virtual_address maybe:0x0
    bool is_full_screen();

    //virtual_address maybe:0x14001e3d0
    void execute_action(QString command);

    //virtual_address maybe:0x140088ac0
    void execute_current_action();

    //virtual_address maybe:0x140088ce0
    void execute_selected_plugin();

    //virtual_address maybe:0x14001e3c0
    void exec_requests();

    //virtual_address maybe:0x1400c03b0
    void run_debugger();

    //virtual_address maybe:0x1400a3670
    void attach_debugger();

    //virtual_address maybe:0x1400443a0
    void buyIDA();

private slots:
    //virtual_address maybe:0x14001ea70
    void focusChanged(QWidget* old,QWidget* now);

    //virtual_address maybe:0x140129d90
    void popup_operation_clicked();

    //virtual_address maybe:0x14001b080
    void console_widget_destroyed();

    //virtual_address maybe:0x14001db60
    void docksClosed(QList<DockWidget*> list);

    //virtual_address maybe:0x140019ce0
    void actionDestroyed(QObjectStar obj);

    //virtual_address maybe:0x14001e410
    void fileMenuToShow();

    //virtual_address maybe:0x1400232a0
    void toolBarsMenuToShow();

    //virtual_address maybe:0x140023650
    void windowsMenuToShow();

    //virtual_address maybe:0x1400226c0
    void returnMenuToShow();

    //virtual_address maybe:0x140023430
    void undoReturnMenuToShow();

    //virtual_address maybe:0x1