ida_kernelcache

idakernelcache: Un kit de herramientas de IDA para analizar kernelcaches de iOS Fork de Cellebrite Este fork se actualizó para funcionar con IDA 9.x / Python 3 / iOS 27.0 beta 1 README original idakernelcache es un módulo de IDAPython para IDA Pro que facilita el trabajo con kernelcaches de iOS. ...

ida_kcpp

idakcpp An IDAPython module for way more convienent way to Reverse Engineering iOS kernelcaches. Big part of the iOS kernelcache is written by C++, which compiled into complicated binary code use many virtual table derefences rather than explicit direct calls.idakcpp takes the advanteage of...

COM-Code-Helper

COM-Code-Helper 两个 IDAPython 脚本，帮助你重构 Microsoft COM（组件对象模型）代码。 恶意软件逆向工程师尤其会发现此工具非常有用，因为 COM 代码仍然常见于恶意软件中。 ClassAndInterfaceToNames.py 此 IDAPython 脚本扫描 idb 文件中的类和接口 UUID，并创建相应的结构及其名称。 请确保 interfaces.txt + classes.txt 与 ClassAndInterfaceToNames.py 位于同一目录下。 Microsoft-SDK-Vtable-Structs.py 此 IDAPytho...

AlphaGolang

AlphaGolang 作者：Juan Andres Guerrero-Saade JAG-S @ SentinelLabs 描述： AlphaGolang 是一组 IDAPython 脚本，旨在帮助恶意软件逆向工程师掌握 Go 二进制文件。其理念是将脚本拆分为具体的步骤，从而避免脆弱的单体脚本，并模拟分析人员在处理 Go 二进制文件时可能遵循的方法。 脚本根据 GPL 许可发布（感谢 Tim Strazzere 的原始 GolangLoaderAssist，我们对其进行了重构并更新为 Python3，向 Tim 致敬 :）。欢迎并鼓励贡献！ 要求：IDA Pro（理想版本 v7.6+）...

ScratchABit

ScratchABit ScratchABit 是一个交互式增量反汇编器，具备数据流/控制流分析功能。ScratchABit 致力于支持开源逆向工程社区的努力（即通过逆向工程为未得到厂商适当支持的硬件生成开源驱动/固件，以实现硬件与软件的互操作性，并用于安全研究）。 ScratchABit 支持社区中广为人知的 IDAPython API，用于编写反汇编/扩展模块。 ScratchABit 仍在开发中，功能按需添加，欢迎贡献。 ScratchABit 根据 GNU 通用公共许可证 v3 GPLv3 的条款发布。 需求/宣言 1...

Virtuailor

Virtuailor - 用于C++虚表重构的IDAPython工具 Virtuailor 是一个 IDAPython 工具，用于重构为 Intel 架构（包括 32 位和 64 位代码）以及 AArch64（新增！）编写的 C++ 代码中的虚表。 该工具由两部分组成：静态部分和动态部分。 首先是静态部分，包含以下功能： 检测间接调用。 使用条件断点（挂钩代码）挂钩间接调用的值赋值。 其次是动态部分，包含以下功能： 创建虚表结构。 重命名函数和虚表地址。 为汇编间接调用添加结构体偏移。 从间接调用添加交叉引用到其虚函数（多个交叉引用）。 对于 AArch64 -...

dsync

dsync IDAPython plugin that synchronizes decompiled and disassembled code views. Please refer to comments in source code for more details. Requires IDA Pro 7.3 N.B.: You may want to use the official synchronization feature introduced with IDA 7.3 instead...

dsync

dsync IDAPython 插件，用于同步反编译与反汇编代码视图。 更多详情请参阅源代码中的注释。 需要 IDA Pro 7.3 注意：你可能希望改用 IDA 7.3 引入的官方同步功能。...

ida_kernelcache

idakernelcache: Un kit de IDA para analizar kernelcaches de iOS idakernelcache es un módulo de IDAPython para IDA Pro que facilita el trabajo con kernelcaches de iOS. El módulo proporciona funciones para: Convertir los nuevos punteros estáticos etiquetados de iOS 12 en punteros de kernel normales...

IDAPython

This repository does not have a README...

DriverBuddy

Inicio rápido Instrucciones de instalación de DriverBuddy 1. Copia la carpeta DriverBuddy y el archivo DriverBuddy.py en la carpeta de plugins de IDA C:\Program Files x86\IDA 6.8\plugins o donde hayas instalado IDA Instrucciones de uso de DriverBuddy 1. Inicia IDA y abre un controlador de kernel ...

IDAPython-Malware-Scripts

IDAPython-Malware-Scripts He incluido los scripts que utilizo para automatizar el análisis. No dudes en usarlos y enviar issues/PRs si crees que me falta algo o que cometo errores...

ida_kcpp — Updated!

idakcpp An IDAPython module for way more convienent way to Reverse Engineering iOS kernelcaches. Big part of the iOS kernelcache is written by C++, which compiled into complicated binary code use many virtual table derefences rather than explicit direct calls.idakcpp takes the advanteage of...

EUVD-2011-4701

Malware in sbrugna...

AlphaGolang - IDApython Scripts For Analyzing Golang Binaries

AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the methodology an analyst might follow when tackling a Go binary. Scripts are...

Uchihash - A Small Utility To Deal With Malware Embedded Hashes

Uchihash is a small utility that can save malware analysts the time of dealing with embedded hash values used for various things such as: Dynamically importing APIs especially in shellcode Checking running process used by analysts Anti-Analysis Checking VM or Antivirus artifacts Anti-Analysis...

COM-Code-Helper - Two IDAPython Scripts Help You To Reconstruct Microsoft COM (Component Object Model) Code

Two IDAPython Scripts help you to reconstruct Microsoft COM Component Object Model Code Especially malware reversers will find this useful, as COM Code is still regularly found in malware. ClassAndInterfaceToNames.py This IDAPython script scans an idb file for class and interfaces UUIDs and creat...

Thinking Outside the Bochs: Code Grafting to Unpack Malware in Emulation

This blog post continues the FLARE script series with a discussion of patching IDA Pro database files IDBs to interactively emulate code. While the fastest way to analyze or unpack malware is often to run it, malware won’t always successfully execute in a VM. I use IDA Pro’s Bochs integration in...

Virtuailor - IDAPython Tool For Creating Automatic C++ Virtual Tables In IDA Pro

Virtuailor is an IDAPython tool that reconstructs vtables for C++ code written for intel architecture, both 32bit and 64bit code and AArch64 New!. The tool constructed from 2 parts, static and dynamic. The first is the static part, contains the following capabilities: Detects indirect calls. Hook...

macOS / iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances

When deserializing NSObjects with the NSArchiver API 1, one can supply a whitelist of classes that are allowed to be unarchived. In that case, any object in the archive whose class is not whitelisted will not be deserialized. Doing so will also cause the NSKeyedUnarchiver to "requireSecureCoding"...