ida_kernelcache

idakernelcache: An IDA Toolkit for analyzing iOS kernelcaches Cellebrite Fork This fork was updated to work on IDA 9.x / Python 3 / iOS 27.0 beta 1 Original Readme idakernelcache is an IDAPython module for IDA Pro to make working with iOS kernelcaches easier. The module provides functions to:...

dsync

dsync IDAPython plugin that synchronizes decompiled and disassembled code views. Please refer to comments in source code for more details. Requires IDA Pro 7.3 N.B.: You may want to use the official synchronization feature introduced with IDA 7.3 instead...

dsync

dsync Plugin de IDAPython que sincroniza las vistas de código descompilado y desensamblado. Consulte los comentarios en el código fuente para más detalles. Requiere IDA Pro 7.3 N.B.: Puede que quieras usar la función de sincronización oficial introducida con IDA 7.3 en su lugar...

ScratchABit

ScratchABit ScratchABit es un desensamblador incremental interactivo con capacidades de análisis de flujo de datos/control. ScratchABit está dedicado a los esfuerzos de la comunidad de ingeniería inversa de código abierto ingeniería inversa para producir controladores/firmware de código abierto...

COM-Code-Helper

COM-Code-Helper Dos scripts IDAPython te ayudan a reconstruir código Microsoft COM Component Object Model Especialmente los reversers de malware encontrarán esto útil, ya que el código COM se sigue encontrando regularmente en malware. ClassAndInterfaceToNames.py Este script IDAPython escanea un...

Virtuailor

Virtuailor - IDAPython tool for C++ vtables reconstruction Virtuailor is an IDAPython tool that reconstructs vtables for C++ code written for intel architecture, both 32bit and 64bit code and AArch64 New!. The tool constructed from 2 parts, static and dynamic. The first is the static part, contai...

IDAPython-Malware-Scripts

IDAPython-Malware-Scripts I have included the scripts that I use to automate analysis. Feel free to use them and submit issues/PRs if you think I miss anything or make mistakes!...

AlphaGolang

AlphaGolang by Juan Andres Guerrero-Saade JAG-S @ SentinelLabs Description: AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the...

ida_kernelcache

idakernelcache: Un kit de herramientas de IDA para analizar kernelcaches de iOS Fork de Cellebrite Este fork se actualizó para funcionar con IDA 9.x / Python 3 / iOS 27.0 beta 1 README original idakernelcache es un módulo de IDAPython para IDA Pro que facilita el trabajo con kernelcaches de iOS. ...

ida_kernelcache

idakernelcache: Un kit de IDA para analizar kernelcaches de iOS idakernelcache es un módulo de IDAPython para IDA Pro que facilita el trabajo con kernelcaches de iOS. El módulo proporciona funciones para: Convertir los nuevos punteros estáticos etiquetados de iOS 12 en punteros de kernel normales...

IDAPython

This repository does not have a README...

DriverBuddy

Quickstart DriverBuddy Installation Instructions 1. Copy DriverBuddy folder and DriverBuddy.py file into the IDA plugins folder C:\Program Files x86\IDA 6.8\plugins or wherever you installed IDA DriverBuddy Usage Instructions 1. Start IDA and open a Windows kernel driver 2. Go to Edit-Plugins and...

EUVD-2011-4701

Malware in sbrugna...

AlphaGolang - IDApython Scripts For Analyzing Golang Binaries

AlphaGolang is a collection of IDAPython scripts to help malware reverse engineers master Go binaries. The idea is to break the scripts into concrete steps, thus avoiding brittle monolithic scripts, and mimicking the methodology an analyst might follow when tackling a Go binary. Scripts are...

Uchihash - A Small Utility To Deal With Malware Embedded Hashes

Uchihash is a small utility that can save malware analysts the time of dealing with embedded hash values used for various things such as: Dynamically importing APIs especially in shellcode Checking running process used by analysts Anti-Analysis Checking VM or Antivirus artifacts Anti-Analysis...

COM-Code-Helper - Two IDAPython Scripts Help You To Reconstruct Microsoft COM (Component Object Model) Code

Two IDAPython Scripts help you to reconstruct Microsoft COM Component Object Model Code Especially malware reversers will find this useful, as COM Code is still regularly found in malware. ClassAndInterfaceToNames.py This IDAPython script scans an idb file for class and interfaces UUIDs and creat...

Thinking Outside the Bochs: Code Grafting to Unpack Malware in Emulation

This blog post continues the FLARE script series with a discussion of patching IDA Pro database files IDBs to interactively emulate code. While the fastest way to analyze or unpack malware is often to run it, malware won’t always successfully execute in a VM. I use IDA Pro’s Bochs integration in...

Virtuailor - IDAPython Tool For Creating Automatic C++ Virtual Tables In IDA Pro

Virtuailor is an IDAPython tool that reconstructs vtables for C++ code written for intel architecture, both 32bit and 64bit code and AArch64 New!. The tool constructed from 2 parts, static and dynamic. The first is the static part, contains the following capabilities: Detects indirect calls. Hook...

macOS / iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances

When deserializing NSObjects with the NSArchiver API 1, one can supply a whitelist of classes that are allowed to be unarchived. In that case, any object in the archive whose class is not whitelisted will not be deserialized. Doing so will also cause the NSKeyedUnarchiver to "requireSecureCoding"...

macOS iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances

macOS iOS NSKeyedUnarchiver - Use-After-Free of ObjC Objects when Unarchiving OITSUIntDictionary Instances When deserializing NSObjects with the NSArchiver API 1, one can supply a whitelist of classes that are allowed to be unarchived. In that case, any object in the archive whose class is not...