deREferencing

deREferencing deReferencing is an IDA Pro plugin that implements new registers and stack views. Adds dereferenced pointers, colors and other useful information, similar to some GDB plugins e.g: PEDA, GEF, pwndbg, etc. Supports following architectures: x86, x86-64, ARM, ARM64, MIPS32 and MIPS64...

IDAssist

IDAssist AI-Powered Reverse Engineering Plugin for IDA Pro Author: Jason Tang Description IDAssist is an IDA Pro plugin that integrates LLM-powered analysis directly into IDA's interface, providing AI-assisted binary reverse engineering through configurable LLM providers, semantic knowledge graph...

findyara-ida

FindYara Use this IDA python plugin to scan your binary with yara rules. All the yara rule matches will be listed with their offset so you can quickly jump to them! 🍻 All credit for this plugin and the code goes to David Berard @p0ly 🍻 This plugin is copied from David's excellent findcrypt-yara...

uEmu

Overview uEmu is a tiny cute emulator plugin for IDA based on unicorn engine. Supports following architectures out of the box: x86 , x64 , ARM , ARM64 , MIPS , MIPS64 What is it GOOD for? Emulate bare metal code bootloaders, embedded firmware etc Emulate standalone functions What is it BAD for?...

VulFi

VulFi v3.0 Introduction The VulFi Vulnerability Finder tool is a plugin to IDA Pro which can be used to assist during bug hunting in binaries. Its main objective is to provide a single view with all cross-references to the most interesting functions such as strcpy, sprintf, system, etc.. For case...

AlphaGolang

AlphaGolang by Juan Andres Guerrero-Saade JAG-S @ SentinelLabs Description: AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the...

Kam1n0-Community

What Is Kam1n0 v2? Kam1n0 v2.x is a scalable assembly management and analysis platform. It allows a user to first index a large collection of binaries into different repositories and provide different analytic services such as clone search and classification. It supports multi-tenancy access and...

yarasafe

YARASAFE - Automatic Binary Function Similarity Checks with Yara SAFE is a tool developed to create Binary Functions Embedding developed by Massarelli L., Di Luna G.A., Petroni F., Querzoni L. and Baldoni R. You can use SAFE to create your function embedding to use inside yara rules. If you are...

IDA2Obj

IDA2Obj IDA2Obj is a tool to implement SBI Static Binary Instrumentation. The working flow is simple: Dump object files COFF directly from one executable binary. Link the object files into a new binary, almost the same as the old one. During the dumping process, you can insert any data/code at an...

sylvia

iOS AArch64 Syscall Analyzer An IDA Pro script that scans an AArch64 binary for SVC instructions, resolves the BSD syscall number from the X16 register, and presents every result in a rich dockable UI, with per-syscall occurrence navigation and live man-page documentation fetching. Built for iOS ...

flare-emu

flare-emu flare-emu marries a supported binary analysis framework, such as IDA Pro or Radare2, with Unicorn’s emulation framework to provide the user with an easy to use and flexible interface for scripting emulation tasks. It is designed to handle all the housekeeping of setting up a flexible an...

RESim

RESim Reverse engineering using a full system simulator. Dynamic analysis by instrumenting simulated hardware using Simics1 Trace process trees, system calls and individual programs Reverse execution to selected breakpoints and events Integrated with IDA Protm debugging client Ghidra plugins for...

ida_kernelcache

idakernelcache: عدة IDA لتحليل نوى iOS kernelcaches Cellebrite Fork تم تحديث هذا الفرع ليعمل على IDA 9.x / Python 3 / iOS 27.0 beta 1 Original Readme وحدة idakernelcache هي وحدة IDAPython لـ IDA Pro لتسهيل العمل مع نوى iOS kernelcaches. توفر الوحدة دوالً من أجل: تحويل المؤشرات الثابتة الموسومة...

Ponce

Ponce Ponce pronounced 'poN θe pon-they is an IDA Pro plugin that provides users the ability to perform taint analysis and symbolic execution over binaries in an easy and intuitive fashion. With Ponce you are one click away from getting all the power from cutting edge symbolic execution. Entirely...

hashdb-ida

HashDB IDA Plugin Malware string hash lookup plugin for IDA Pro. This plugin connects to the OALABS HashDB Lookup Service. Adding New Hash Algorithms The hash algorithm database is open source and new algorithms can be added on GitHub here. Pull requests are mostly automated and as long as our...

diaphora

δiaphora التثبيت ثبّت باستخدام مدير إضافات Hex-Rays: hcli plugin install https://github.com/joxeankoret/diaphora/archive/refs/tags/3.4.2.zip تعليمات التثبيت اليدوي أدناه. Diaphora διαφορά، كلمة يونانية تعني 'الاختلاف' الإصدار 3.4 هو الأداة الأكثر تقدمًا لمقارنة البرامج تعمل كإضافة لـ IDA المتوفرة...

allthingsida

Système d'exploitation MS Windows Scripts d'énumération PEB/LDRDATATABLEENTRY Structures PEB/TEB x64 Structures PEB/TEB x86...

lst2x64dbg

lst2x64dbg يستخرج هذا الأمر جميع التسميات الموجودة في ملف LST المعطى كوسيطة واحدة. يتم إنشاء قاعدة بيانات x64dbg في الدليل الحالي بناءً على التسميات المستخرجة. يمكن إنشاء ملف LST في IDA من قائمة File : Produce file - Create LST file... مثال $ lst2x64dbg sample.lst ghidra2x64dbg يستخرج هذا الأمر...

ida_kernelcache

idakernelcache: مجموعة أدوات IDA لتحليل نوى iOS kernelcaches idakernelcache هي وحدة IDAPython لـ IDA Pro بهدف تسهيل العمل مع نوى iOS kernelcaches. توفر الوحدة دوال من أجل: تحويل المؤشرات الثابتة الموسومة static tagged pointers الجديدة في iOS 12 إلى مؤشرات نواة عادية. تحليل مقطع PRELINKINFO الخاص...

patching

التصحيح - التصحيح الثنائي التفاعلي لـ IDA Pro نظرة عامة ليس من غير المألوف تعديل كود التجميع لتغيير سلوك برنامج قائم في تحليل البرمجيات الضارة وهندسة البرمجيات العكسية ومجالات أوسع من أبحاث الأمان. يمتد هذا المشروع من برنامج التفكيك الشهير IDA Pro لإنشاء سير عمل تفاعلي أكثر متانة للتصحيح الثنائي...