Skip to content

Latest commit

 

History

History
1909 lines (1395 loc) · 156 KB

Readme_en.md

File metadata and controls

1909 lines (1395 loc) · 156 KB
Raw

ida

IDA Resource Collection. 450+ open source tools, ~300 blog posts.

说明

中文版本

Directory

Tools

  • Mainly from Github

RecentAdd

NoCategory

Structure&&Class

NoCategory

C++Class&&VirtualTable

  • [595Star][2m] [Py] 0xgalz/virtuailor IDAPython tool for creating automatic C++ virtual tables in IDA Pro

    • Also In Section: Tools/Debug&&DynamicData/DebuggerData |

      View Details

      静态部分:

      • 检测非直接调用
      • 利用条件断点, Hook非直接调用的值赋值过程

      动态 部分

      • 创建虚表结构
      • 重命名函数和虚表地址
      • 给反汇编非直接调用添加结构偏移
      • 给非直接调用到虚表之间添加交叉引用

      使用

      • File -> Script File -> Main.py(设置断点) -> IDA调试器执行

  • [168Star][9m] [C++] ecx86/classinformer-ida7 ClassInformer backported for IDA Pro 7.0

  • [128Star][2y] [Py] nccgroup/susanrtti Another RTTI Parsing IDA plugin

  • [91Star][1y] [C++] rub-syssec/marx Uncovering Class Hierarchies in C++ Programs

  • [68Star][7y] [C] nektra/vtbl-ida-pro-plugin Identifying Virtual Table Functions using VTBL IDA Pro Plugin + Deviare Hooking Engine

  • [35Star][5y] [C++] nihilus/ida_classinformer IDA ClassInformer PlugIn

  • [32Star][2y] [Py] krystalgamer/dec2struct Python plugin to easily setup vtables in IDA using declaration files

  • [16Star][2y] [C++] mwl4/ida_gcc_rtti Class informer plugin for IDA which supports parsing GCC RTTI

Collection

Skin&&Theme

Firmware&&EmbedDevice

Signature(FLIRT...)&&Diff&&Match

NoCategory

FLIRT

FLIRTSignatureCollection

FLIRTSignatureGenerate

Diff&&Match

  • [1525Star][24d] [Py] joxeankoret/diaphora Diaphora, the most advanced Free and Open Source program diffing tool.
  • [353Star][3m] [Py] checkpointsw/karta Karta - source code assisted fast binary matching plugin for IDA
  • [328Star][11m] [Py] joxeankoret/pigaios A tool for matching and diffing source codes directly against binaries.
  • [136Star][12m] [Py] nirizr/rematch REmatch, a complete binary diffing framework that is free and strives to be open source and community driven.
  • [94Star][6m] [Visual Basic] dzzie/idacompare IDA disassembly level diffing tool, - read more->
  • [74Star][4y] [C] nihilus/ida_signsrch IDA Signsrch
  • [72Star][5y] [Py] binsigma/binsourcerer BinSourcerer
  • [71Star][3y] vrtadmin/first None
  • [52Star][5y] [C++] filcab/patchdiff2 IDA binary differ. Since code.google.com/p/patchdiff2/ seemed abandoned, I did the obvious thing…
  • [14Star][3y] [Py] 0x00ach/idadiff IDAPython script in order to auto-rename subs
  • [14Star][5y] [C++] binsigma/binclone None

Yara

IDB

  • [312Star][5m] [Py] williballenthin/python-idb Pure Python parser and analyzer for IDA Pro database files (.idb).
  • [144Star][14d] [Py] nccgroup/idahunt idahunt is a framework to analyze binaries with IDA Pro and hunt for things in IDA Pro
  • [84Star][4m] [C++] nlitsme/idbutil Library and tool for reading IDApro databases.
  • [78Star][3m] [Py] nlitsme/pyidbutil A python library for reading IDA pro databases.
  • [18Star][1y] [Py] kkhaike/tinyidb Some python scripts are used to export userdata from huge idb(ida's database)，ida 7.0 support only
  • [0Star][4y] [C] hugues92/idaextrapassplugin None

CollaborativeRE

  • [504Star][10m] [Py] idarlingteam/idarling Collaborative Reverse Engineering plugin for IDA Pro & Hex-Rays
  • [257Star][1y] [C++] dga-mi-ssi/yaco YaCo is an Hex-Rays IDA plugin. When enabled, multiple users can work simultaneously on the same binary. Any modification done by any user is synchronized through git version control.
  • [88Star][5y] [Py] cubicalabs/idasynergy A combination of an IDAPython Plugin and a control version system that result in a new reverse engineering collaborative addon for IDA Pro. By
  • [71Star][20d] [C++] cseagle/collabreate Collaborative reverse engineering plugin for IDA Pro. Latest version, including IDA 7.0 support, is not back ward compatible with earlier versions. Substantial changes have been made to the protocol and database.
  • [4Star][2y] [Py] argussecurity/psida None

SyncWithDebugger

ImportExport&&SyncWithOtherTools

NoCategory

Ghidra

BinNavi

  • [378Star][17d] [C++] google/binexport Export disassemblies into Protocol Buffers and to BinNavi databases
  • [213Star][3y] [PLpgSQL] cseagle/freedom capstone based disassembler for extracting to binnavi
  • [25Star][7y] [Py] tosanjay/bopfunctionrecognition This python/jython script is used as plugin to BinNavi tool to analyze a x86 binanry file to find buffer overflow prone functions. Such functions are important for vulnerability analysis.

BinaryNinja

  • [67Star][8m] [Py] lunixbochs/revsync realtime cross-tool collaborative reverse engineering
  • [60Star][5m] [Py] zznop/bnida Suite of plugins that provide the ability to transfer analysis data between Binary Ninja and IDA
  • [14Star][5m] [Py] cryptogenic/idc_importer A Binary Ninja plugin for importing IDC database dumps from IDA.

Radare2

Frida

IntelPin

SpecificTarget

NoCategory

GoLang

WindowsDriver

  • [303Star][1y] [Py] fsecurelabs/win_driver_plugin A tool to help when dealing with Windows IOCTL codes or reversing Windows drivers.
  • [216Star][1y] [Py] nccgroup/driverbuddy DriverBuddy is an IDA Python script to assist with the reverse engineering of Windows kernel drivers.
  • [73Star][4y] [Py] tandasat/winioctldecoder IDA Plugin which decodes Windows Device I/O control code into DeviceType, FunctionCode, AccessType and MethodType.
  • [23Star][1y] [C] ioactive/kmdf_re Helper idapython code for reversing kmdf drivers

PS3&&PS4

Loader&Processor

PDB

Flash&&SWF

MalwareFamily

CTF

IDAPython

NoCategory

cheatsheets

InstructRef&&Doc

ScriptWritting

NoCategory

  • [383Star][3y] [Py] 36hours/idaemu idaemu is an IDA Pro Plugin - use for emulating code in IDA Pro.
  • [271Star][10d] [Py] fireeye/flare-emu None
  • [135Star][11d] [Py] arizvisa/ida-minsc IDA-minsc is a plugin for IDA Pro that assists a user with scripting the IDAPython plugin that is bundled with the disassembler. This plugin groups the different aspects of the IDAPython API into a simpler format which allows a reverse engineer to script aspects of their work with very little investment. Smash that "Star" button if you like this.
  • [97Star][26d] [Py] patois/idapyhelper IDAPyHelper is a script for the Interactive Disassembler that helps writing IDAPython scripts and plugins.
  • [74Star][3m] [C++] 0xeb/ida-qscripts An IDA plugin to increase productivity when developing scripts for IDA
  • [42Star][5m] [C++] 0xeb/ida-climacros Create and use macros in IDA's CLIs
  • [32Star][2y] [CMake] zyantific/ida-cmake IDA plugin CMake build-script
  • [22Star][1y] [Py] nirizr/idasix IDAPython compatibility library. idasix aims to create a smooth ida development process and allow a single codebase to function with multiple IDA/IDAPython versions
  • [4Star][6m] inndy/idapython-cheatsheet scripting IDA like a Pro

Qt

Console&&GUI

Template

OtherLang

Ancient

Debug&&DynamicData

NoCategory

  • [390Star][11m] [C++] cseagle/sk3wldbg Debugger plugin for IDA Pro backed by the Unicorn Engine
  • [184Star][5y] [C++] nihilus/scyllahide None
  • [105Star][2m] [Py] danielplohmann/apiscout This project aims at simplifying Windows API import recovery on arbitrary memory dumps
  • [81Star][4y] [C++] wjp/idados Eric Fry's IDA/DOSBox debugger plugin
  • [56Star][7y] [Py] cr4sh/ida-vmware-gdb Helper script for Windows kernel debugging with IDA Pro on VMware + GDB stub
  • [42Star][5y] [Py] nihilus/idasimulator IDASimulator is a plugin that extends IDA's conditional breakpoint support, making it easy to augment / replace complex executable code inside a debugged process with Python code. Specifically, IDASimulator makes use of conditional breakpoints in the IDA debugger to hijack the execution flow of a process and invoke Python handler functions whene…
  • [38Star][2y] [Py] thecjw/ida_android_script some idapython scripts for android debugging.
  • [22Star][5y] [Py] techbliss/scylladumper Ida Plugin to Use the Awsome Scylla plugin
  • [14Star][5y] [Py] techbliss/free_the_debuggers Free_the_Debuggers
  • [0Star][2y] [Py] benh11235/ida-windbglue Humble suite of scripts to assist with remote debugging using IDA pro client and winDBG server.

DBIData

DebuggerData

  • [595Star][2m] [Py] 0xgalz/virtuailor IDAPython tool for creating automatic C++ virtual tables in IDA Pro

    • Also In Section: Tools/Structure&&Class/C++Class&&VirtualTable |

      View Details

      静态部分:

      • 检测非直接调用
      • 利用条件断点, Hook非直接调用的值赋值过程

      动态 部分

      • 创建虚表结构
      • 重命名函数和虚表地址
      • 给反汇编非直接调用添加结构偏移
      • 给非直接调用到虚表之间添加交叉引用

      使用

      • File -> Script File -> Main.py(设置断点) -> IDA调试器执行

  • [383Star][4m] [Py] ynvb/die Dynamic IDA Enrichment

  • [378Star][4y] [Py] deresz/funcap IDA Pro script to add some useful runtime info to static analysis

  • [103Star][3y] [Py] c0demap/codemap Codemap

Decompiler&&AST

DeObfuscate

Nav&&QuickAccess&&Graph&&Image

NoCategory

GUIEnhencement

Graph

  • [2562Star][4m] [Java] google/binnavi BinNavi is a binary analysis IDE that allows to inspect, navigate, edit and annotate control flow graphs and call graphs of disassembled code.
  • [231Star][2y] [C++] fireeye/simplifygraph IDA Pro plugin to assist with complex graphs
  • [39Star][8m] [Py] rr-/ida-images Image preview plugin for IDA disassembler.

Search

Android

Apple&&macOS&&iXxx&&Objective-C&&SWift&&Mach-O

NoCategory

kernelCache

Mach-O

  • [47Star][7m] [C] gdbinit/extractmacho IDA plugin to extract Mach-O binaries located in the disassembly or data
  • [18Star][3y] [C] cocoahuke/iosdumpkernelfix This tool will help to fix the Mach-O header of iOS kernel which dump from the memory. So that IDA or function symbol-related tools can loaded function symbols of ios kernel correctly
  • [17Star][8y] [C] gdbinit/machoplugin IDA plugin to Display Mach-O headers

Swift

ELF

Microcode

Emulator

PartOfOtherTool

Vul

NoCategory

ROP

  • [53Star][3y] [Py] patois/drgadget dr.rer.oec.gadget IDAPython plugin for the Interactive Disassembler
  • [19Star][1y] [Py] lucasg/idarop ROP database plugin for IDA

Patch

Other

Function

NoCategory

Rename&&Prefix&&Tag

Nav&&Search

demangle

TaintAnalysis&&SymbolicExecution

string

encrypt&&decrypt

TODO

  • Add more tools and posts

Video&&Post

NoCategory

Tips&&Tricks

Malware

Series-LabelessIntroduction

Series-ReversingWithIDAFromScrach

Series-UsingIDAPythonToMakeYourLifeEasier

Original

ZH

Series-ReversingCCodeWithIDA

Tool&&Plugin&&Script

Translate-TheIDAProBook

Translate-ReverseEngineeringCodeWithIDAPro

REPractice

Contribute

Contents auto exported by Our System, please raise Issue if you have any question.