Intended audience IDAPython plugin writers who are using the PySide Qt bindings. PySide: some background For some time now it has been possible, through IDAPython, to use PySide bindings to the Qt libraries that are shipped with IDA. Those PySide bindings were first placed on Hex-Rays’s website and, since we noticed a considerable interest for them, we later […]
Read MoreIntended audience Plugin writers, either using the C SDK or IDAPython, who would like to add actions/commands to IDA UI in order to augment its capabilities. Rationale: before 6.7 APIs galore Depending on what type of context you were in, various APIs were available to you: Want to add a main menu item? add_menu_item(const char *menupath, const char *name, const char […]
Read MoreOne of the new features of IDA 6.6 is the Dalvik debugger, which allows us to debug Dalvik binaries on the bytecode level. Let us see how it can help when analysing Dalvik files. Encoded strings Let us consider the package with the encrypted strings: STRINGS:0001F143 unk_1F143:.byte 0x30 # 0 # DATA XREF: STR_IDS:off_70 STRINGS:0001F144 aFda8sohchnidgh: .string “FDA8sOhCHNidghM2hzFxMXUsivl2k7hFOhkJrW7O2ml8qLVM”,0 STRINGS:0001F144 […]
Read MoreTarget audience You may want to read this if you have been writing an IDA C++ plugin, that itself uses the CPython runtime. Prior art In 2010, Elias Bachaalany wrote a blog post about extending IDAPython: http://www.hexblog.com/?p=126 Note that this is not about writing your own plugins in Python. Rather, that blog post instruct on how you may […]
Read MoreJust a short post to show you the current state of the x64 decompiler. In fact, it already mostly works but we still have to solve some minor problems. Let us consider this source code: struct color_t { short red; short green; short blue; short alpha; }; extern color_t lighten(color_t c); color_t func(int red, int green, […]
Read MoreI’m happy to present you a guest post by David Zimmer <dzzie@yahoo.com>. The approach he describes can be used to develop plugins more conveniently (but not limited to that): In this article we are going to discuss a mechanism that can be used to interact with IDA through external applications. The reason this technique was developed was […]
Read MoreJust a quick note for all IDA users. We published a fix for potential vulnerability in IDA. Please check out https://www.hex-rays.com/vulnfix.shtml. It does not seem to be exploitable but we prefer to be on the safe side. Feel free to download and copy it to your plugins subdirectory. The plugin will validate all opened […]
Read MoreTL;DR If you were using import to import your own “currently-in-development” modules from your IDAPython scripts, you may want to use idaapi.require(), starting with IDA 6.5. Rationale When using IDAPython scripts, users were sometimes facing the following issue Specifically: User loads script Script imports user’s module mymodule Script ends User modifies code of mymodule (Note: the module is modified, not the script) User […]
Read MoreRecently, one of our customers came to us asking how he should proceed to be able to install python packages, using PIP, and use those from IDA. The issue he was facing is that his system is a 64-bit Ubuntu 12.04 VM. Therefore using the Ubuntu-bundled PIP will just result in installing the desired package (let’s say […]
Read MoreThis year I again was lucky to present at Recon in Montreal. There were many great talks as usual. I combined the topic of my last year’s talk on C++ reversing and my OpenRCE article on Visual C++ internals. New material was implementation of exceptions and RTTI in MSVC x64 and GCC (including Apple’s […]
Read More