deREferencing

deREferencing deReferencing is an IDA Pro plugin that implements new registers and stack views. Adds dereferenced pointers, colors and other useful information, similar to some GDB plugins e.g: PEDA, GEF, pwndbg, etc. Supports following architectures: x86, x86-64, ARM, ARM64, MIPS32 and MIPS64...

IDAssistMCP

IDAssistMCP Standalone MCP Model Context Protocol server plugin for IDA Pro 9.x that exposes IDA's analysis capabilities to LLM clients like Claude Desktop. Features 41 MCP tools covering binary analysis, decompilation, cross-references, symbol management, type system, navigation, patching, expor...

sylvia

iOS AArch64 Syscall Analyzer An IDA Pro script that scans an AArch64 binary for SVC instructions, resolves the BSD syscall number from the X16 register, and presents every result in a rich dockable UI, with per-syscall occurrence navigation and live man-page documentation fetching. Built for iOS ...

crauEmu

Mascot designed by@kottsarapkin crauEmu is an uEmu extension for developing and analyzing payloads for code-reuse attacks. Slides from ZeroNights 2019 Demo 1 - X32-64, Edge, rop-gadgets from pwnjs Demo 2 - ARM64, checkm8 callback-chain RopEditor Installation 1. Put the file crauEmu.py in same...

ida-pro-mcp

IDA Pro MCP Simple MCP Server to allow vibe reversing in IDA Pro. https://github.com/user-attachments/assets/6ebeaa92-a9db-43fa-b756-eececce2aca0 The binaries and prompt for the video are available in the mcp-reversing-dataset repository. Prerequisites Python 3.11 or higher Use idapyswitch to...

diaphora-mcp

Читать на русском языке Diaphora MCP Diaphora MCP is an MCP Model Context Protocol server for automated binary diffing. It connects Diaphora the diffing engine and IDA Pro the disassembler via the MCP protocol, allowing AI agents such as Claude Code to perform binary file comparison, find securit...

oregami

Oregami """ 这个寄存器是做什么用的？ 嗯……我就把它重命名为 veryuniquename，然后做个文本搜索，找到所有引用！ 好的……等待搜索结束……马上就好……完成！ 现在只需要理解搜索结果中哪些与当前寄存器的使用帧相关。 应该不难，对吧？ """ 如果你遇到过这种情况（或许不止一次），那你有福了！ 只需按下 Shift-X，你的烦恼就会消失！ 你也可以在使用的帧中重命名寄存器。只需按下 Shift-N，然后按照指示操作！ 还有——与其逐个修改所有用法的类型，不如只按一次 Shift-T。 最后但同样重要的是——如果你想为这个寄存器的所有用法设置偏移量（就像做 Ctrl-R...

patching

Patching - Interactive Binary Patching for IDA Pro Overview Patching assembly code to change the behavior of an existing program is not uncommon in malware analysis, software reverse engineering, and broader domains of security research. This project extends the popular IDA Pro disassembler to...

patching

Patching - IDA Pro的交互式二进制补丁工具 概述 在恶意软件分析、软件逆向工程以及更广泛的安全研究领域中，通过修改汇编代码来改变现有程序的行为并不罕见。本项目扩展了流行的 IDA Pro 反汇编器，打造了一个更强大的交互式二进制补丁工作流，旨在支持快速迭代。 本项目目前基于普遍使用的 Keystone Engine 的一个小型 fork，支持 x86/x64 和 Arm/Arm64 架构的补丁，并计划在未来的版本中启用剩余的 Keystone 架构。 特别感谢 Hex-Rays 对本插件开发的支持。 版本发布 v0.2 —— 重要错误修复，IDA 9 兼容性 v0.1 —...

Kam1n0-Community

What Is Kam1n0 v2?...

IDAssist

IDAssist AI-Powered Reverse Engineering Plugin for IDA Pro Author: Jason Tang Description IDAssist is an IDA Pro plugin that integrates LLM-powered analysis directly into IDA's interface, providing AI-assisted binary reverse engineering through configurable LLM providers, semantic knowledge graph...

AlphaGolang

AlphaGolang by Juan Andres Guerrero-Saade JAG-S @ SentinelLabs Description: AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the...

flare-floss

FLOSS 脚本 FLOSS 支持将其输出转换为各种工具的脚本。请参见此目录中的渲染脚本。 此外，还有一个 IDA 插件，允许 FLOSS 自动提取混淆字符串并将其应用于 IDA 中当前加载的模块。idaplugin.py 是一个 IDAPython 脚本，您可以直接在 IDA Pro 中运行（文件 - 脚本文件... ALT + F7）。 安装 这些脚本可以从 FLOSS GitHub 仓库与源码一起下载，这是脚本运行所必需的。 要从源码安装 FLOSS，请参阅此处的文档。 用法 将 FLOSS 输出转换为其他工具使用 使用 -j 或 --json 参数在所需可执行文件上运行...

tenet

Tenet - 逆向工程师的追踪浏览器 概述 Tenet 是一款用于探索执行轨迹的 IDA Pro 插件。该插件的目标是提供更自然、更人性化的控制方式，以便在给定二进制文件中导航执行轨迹。这项工作的基础源于研究新的或创新方法来检查和提炼软件中复杂执行模式的愿望。 关于该项目的更多背景，请阅读其初始发布时的博客文章。 特别感谢 QIRA / geohot 等人带来的灵感。 发布版本 v0.2 -- 映像基址检测、单元格可视化、断点重构、错误修复。 v0.1 -- 初始版本 安装 Tenet 是一个跨平台（Windows、macOS、Linux）的 Python 3...

Ponce

Ponce Ponce pronounced 'poN θe pon-they is an IDA Pro plugin that provides users the ability to perform taint analysis and symbolic execution over binaries in an easy and intuitive fashion. With Ponce you are one click away from getting all the power from cutting edge symbolic execution. Entirely...

ida_kernelcache

idakernelcache：用于分析 iOS kernelcache 的 IDA 工具包 idakernelcache 是一个适用于 IDA Pro 的 IDAPython 模块，旨在简化对 iOS kernelcache 的分析工作。 该模块提供以下功能： 将 iOS 12 新的静态标记指针（tagged pointer）转换为普通内核指针。 将内核的 PRELINKINFO 段解析为 Python 字典。 根据内核扩展名、Mach-O 段和 Mach-O section 重命名 IDA 中的段。 将某些段中可识别的指针转换为 IDA 偏移量。 基于 OSMetaClass 信息重建...

IDA2Obj

IDA2Obj IDA2Obj is a tool to implement SBI Static Binary Instrumentation. The working flow is simple: Dump object files COFF directly from one executable binary. Link the object files into a new binary, almost the same as the old one. During the dumping process, you can insert any data/code at an...

uEmu

Overview uEmu is a tiny cute emulator plugin for IDA based on unicorn engine. Supports following architectures out of the box: x86 , x64 , ARM , ARM64 , MIPS , MIPS64 What is it GOOD for? Emulate bare metal code bootloaders, embedded firmware etc Emulate standalone functions What is it BAD for?...

hashdb-ida

HashDB IDA Plugin Malware string hash lookup plugin for IDA Pro. This plugin connects to the OALABS HashDB Lookup Service. Adding New Hash Algorithms The hash algorithm database is open source and new algorithms can be added on GitHub here. Pull requests are mostly automated and as long as our...

auto_re

AutoRE Features 1. Auto-renaming dummy-named functions, which have one API call or jump to the imported API Before After 2. Assigning TAGS to functions accordingly to called API-indicators inside Sets tags as repeatable function comments and displays TAG tree in the separate view Some screenshots...