dsync

dsync Plugin IDAPython qui synchronise les vues de code décompilé et désassemblé. Veuillez vous référer aux commentaires dans le code source pour plus de détails. Nécessite IDA Pro 7.3 N.B.: Vous préférerez peut-être utiliser la fonctionnalité de synchronisation officielle introduite avec IDA 7.3...

ida_kernelcache

idakernelcache: инструментарий IDA для анализа ядерных кешей iOS Форк Cellebrite Этот форк обновлён для работы с IDA 9.x / Python 3 / iOS 27.0 beta 1 Исходный README idakernelcache — это модуль IDAPython для IDA Pro, упрощающий работу с ядерными кешами iOS. Модуль предоставляет функции для:...

AlphaGolang

AlphaGolang par Juan Andres Guerrero-Saade JAG-S @ SentinelLabs Description : AlphaGolang est une collection de scripts IDAPython pour aider les ingénieurs en rétro-ingénierie de malwares à maîtriser les binaires Go. L'idée est de diviser les scripts en étapes concrètes, évitant ainsi les scripts...

ScratchABit

ScratchABit ScratchABit — это интерактивный инкрементальный дизассемблер с возможностями анализа потоков данных и управления. ScratchABit посвящён усилиям сообщества разработчиков open-source в области реверс-инжиниринга реверс-инжиниринг для создания драйверов/прошивок с открытым исходным кодом...

COM-Code-Helper

COM-Code-Helper Deux scripts IDAPython vous aident à reconstruire le code Microsoft COM Component Object Model Les rétro-ingénieurs de logiciels malveillants trouveront cela particulièrement utile, car le code COM se trouve encore régulièrement dans les malwares. ClassAndInterfaceToNames.py Ce...

Virtuailor

Virtuailor - Outil IDAPython pour la reconstruction des vtables C++ Virtuailor est un outil IDAPython qui reconstruit les vtables pour du code C++ écrit pour architecture Intel, aussi bien en 32 bits qu'en 64 bits, et pour AArch64 Nouveau !. L'outil est composé de 2 parties, statique et dynamique...

IDAPython

В этом репозитории нет README...

IDAPython-Malware-Scripts

IDAPython-Malware-Scripts Я включил скрипты, которые использую для автоматизации анализа. Не стесняйтесь использовать их и отправлять issues/PRs, если считаете, что я что-то упустил или допустил ошибки!...

dsync

dsync IDAPython plugin that synchronizes decompiled and disassembled code views. Please refer to comments in source code for more details. Requires IDA Pro 7.3 N.B.: You may want to use the official synchronization feature introduced with IDA 7.3 instead...

ida_kernelcache

idakernelcache: инструментарий IDA для анализа kernelcache iOS idakernelcache — это модуль IDAPython для IDA Pro, упрощающий работу с kernelcache iOS. Модуль предоставляет функции для: Преобразования новых статических тегированных указателей iOS 12 в обычные указатели ядра. Разбора сегмента...

EUVD-2011-4701

Malware in sbrugna...

AlphaGolang - IDApython Scripts For Analyzing Golang Binaries

AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the methodology an analyst might follow when tackling a Go binary. Scripts are...

Uchihash - A Small Utility To Deal With Malware Embedded Hashes

Uchihash is a small utility that can save malware analysts the time of dealing with embedded hash values used for various things such as: Dynamically importing APIs especially in shellcode Checking running process used by analysts Anti-Analysis Checking VM or Antivirus artifacts Anti-Analysis...

COM-Code-Helper - Two IDAPython Scripts Help You To Reconstruct Microsoft COM (Component Object Model) Code

Two IDAPython Scripts help you to reconstruct Microsoft COM Component Object Model Code Especially malware reversers will find this useful, as COM Code is still regularly found in malware. ClassAndInterfaceToNames.py This IDAPython script scans an idb file for class and interfaces UUIDs and creat...

Thinking Outside the Bochs: Code Grafting to Unpack Malware in Emulation

This blog post continues the FLARE script series with a discussion of patching IDA Pro database files IDBs to interactively emulate code. While the fastest way to analyze or unpack malware is often to run it, malware won’t always successfully execute in a VM. I use IDA Pro’s Bochs integration in...

Virtuailor - IDAPython Tool For Creating Automatic C++ Virtual Tables In IDA Pro

Virtuailor is an IDAPython tool that reconstructs vtables for C++ code written for intel architecture, both 32bit and 64bit code and AArch64 New!. The tool constructed from 2 parts, static and dynamic. The first is the static part, contains the following capabilities: Detects indirect calls. Hook...

macOS / iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances

When deserializing NSObjects with the NSArchiver API 1, one can supply a whitelist of classes that are allowed to be unarchived. In that case, any object in the archive whose class is not whitelisted will not be deserialized. Doing so will also cause the NSKeyedUnarchiver to "requireSecureCoding"...

macOS iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances

macOS iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances When deserializing NSObjects with the NSArchiver API 1, one can supply a whitelist of classes that are allowed to be unarchived. In that case, any object in the archive whose class is not...

Router 0day vulnerability discovery practical-vulnerability warning-the black bar safety net

! Last year 7 month in the company's internal share over this issue, said to also almost a year, too lazy to now only issued to. In 2018, 3, 4 on more than two or three months time, spent more and more time to engage in a domestic router, dug some holes, after also don't get it. Also wrote a litt...

HexRaysCodeXplorer - Hex-Rays Decompiler Plugin For Better Code Navigation

The Hex-Rays Decompiler plugin for better code navigation in RE process. CodeXplorer automates code REconstruction of C++ applications or modern malware like Stuxnet, Flame, Equation, Animal Farm ... The CodeXplorer plugin is one of the first publicly available Hex-Rays Decompiler plugins. We kee...