OpenRCE

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Tuesday, March 29 2011 05:11.13 CDT

Modified: Tuesday, March 29 2011 05:12.10 CDT

Direct Link, View / Make / Edit Comments

Updated plug-ins, blogging moved to..

Author:

Sirmabus

# Views: 11387

I've updated many of my IDA Pro plug-ins and made a support section for them on my forum.
Download them here: Sirmabus PlugIns

Also moved my occasional blogging to here:
http://www.sirmabus.macromonkey.com

Created: Thursday, January 22 2009 03:42.28 CST

Modified: Tuesday, June 16 2009 00:57.15 CDT

Direct Link, View / Make / Edit Comments

Class Informer IDA plug-in

Author:

Sirmabus

# Views: 42683

My new IDA plug-in based on Igorsk's excellent article and IDC scripts.

[Download]

------------------------------------------------------------
Scans an MSVC 32bit target IDB for vftables with C++ RTTI, and MFC RTCI type data.
Places structure defs, names, labels, and comments to make more sense of class vftables ("Virtual Function Table") and make them read
easier as an aid to reverse engineering.
Creates a list window with found vftables for browsing.

RTTI ("Run-Time Type Identification"):
http://en.wikipedia.org/wiki/RTTI

RTCI ("Run Time Class Information") the MFC forerunner to "RTTI":
http://msdn.microsoft.com/en-us/library/fych0hw6(VS.80).aspx
------------------------------------------------------------

Example vftable output list:

.
.
Example vftable info set by plug-in:

.
.

Created: Thursday, August 7 2008 13:43.19 CDT

Modified: Thursday, August 7 2008 13:45.37 CDT

Direct Link, View / Make / Edit Comments

IDA2PAT Reloaded

Author:

Sirmabus

# Views: 13352

Like many others I like to generate signitures of functions I've RE'ed in a target so I can apply them to an update.
There are a lot of issues with the process.

This is yet another IDB2Sig/IDB2PAT plug-in for IDA Pro with some improvements to help with some of the problems.

Instead of relying on broken function types/tags, this uses function name text patterns.
Easier to go from one IDA DB to the next for updated targets, easier to update function names, don't have to combine multiple .PAT files, etc.
And as fast as TQN's version with out the huge buffer.

While IMHO this is an improvement in the process, but it certainly dosn't solve all the problems.
I think a whole new project is in order, something that will replace ".sigs" for update processes..

See the help file for more info..

http://www.openrce.org/repositories/users/Sirmabus/IDA2PAT_Reloaded.zip

Created: Tuesday, May 13 2008 03:15.32 CDT

Modified: Tuesday, May 13 2008 03:30.31 CDT

Direct Link, View / Make / Edit Comments

"Function String Associate" IDA Plug-in

Author:

Sirmabus

# Views: 13536

"Function String Associate"  IDA Plug-in:

I thought of this idea the other day based on the observation of "assert()", development, debug text strings, etc., that software developers often leave in programs I want to reverse.
As I'm sure others do, I look at these comments to help me determine what a particular function is for (x86 binary targets that is).
I thought, wouldn't be nice to somehow data mine this stuff and automatically put some of it as a function comment?

Based on this, what this plug-in does is iterate through every function in IDA and auto-comments every function that has these strings (unless it already has a comment).  It applies a little logic to it, to try to put the most relevant strings first.

Sort of a proof of concept thing.  It's hard to say how useful it is yet.
So far it does seem to help as I browse around a DB. I'm putting together things a bit faster because of it.

Of course it's only works as well as your target uses such messages mixed in it's code.
So far on programs I've used it it on, the plug-in finds such strings on about 15% of all functions.

With source. If you expand on the idea, add helpful modifications, etc., share it here please.

http://www.openrce.org/repositories/users/Sirmabus/IDA_FunctionStringAssociate_PlugIn.zip

Created: Friday, February 8 2008 21:26.48 CST

Modified: Friday, February 8 2008 22:35.05 CST

Direct Link, View / Make / Edit Comments

Updated ExtraPass plug-in 2.1, and APIScan

Author:

Sirmabus

# Views: 13860

Proud to say that IMHO it's working well now.
Really can clean up discombobulated code.

See:
https://www.openrce.org/blog/view/839/An_%22extra_pass%22_for_IDA_Pro

Also updated my "APIScan":
http://www.openrce.org/forums/posts/456

Archived Entries for Sirmabus

Subject	# Views	Created On
GUID-Finder IDA Plug-in	4722	Thursday, January 17 2008
Intrinsic "_ReturnAddress()" C/C++ WTF!	6839	Sunday, November 25 2007
An "extra pass" for IDA Pro	6018	Wednesday, August 1 2007
Real Time Tracing	3718	Tuesday, July 31 2007
Updated APIScan	4614	Wednesday, July 25 2007

There are 31,325 total registered users.

Recently Created Topics
	Oct/23
	Oct/23
	Oct/23
	Oct/23
	Oct/23
	Oct/23
	Oct/23
	Oct/23
	Oct/23
	Oct/23

Recent Forum Posts
Reverse Engineering ...	bytecod3r
Reverse Engineering ...	bytecod3r
Reverse Engineering ...	bytecod3r
Reverse Engineering ...	bytecod3r
Reverse Engineering ...	bytecod3r
let 'IDAPython' impo...	bytecod3r
Reverse Engineering ...	bytecod3r
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit