Twenty-five plugins. Three winners. A long list of contributions that quietly make IDA more useful for the rest of us. Here's what won, why, and how to install everything in one command.
Three plugins stood out for elegantly solving interesting problems. Here they are.
First place
iOS · Apple platforms
01
iOSHelper
by Yoav Sternberg
iOSHelper is a wide-ranging toolkit aimed at reverse-engineering Apple platform binaries. It customizes the way IDA renders code, applies a number of microcode-level transformations that produce cleaner pseudocode for common Apple idioms, and bundles together small workflow improvements that streamline day-to-day vulnerability research on iOS targets.
Why it won
What makes iOSHelper stand out is the number of ways the plugin improves the IDA experience for such a frequent workflow. We are confident there will be many IDA users that more effectively research Apple software with iOSHelper. The plugin demonstrates strong command of the IDA Python SDK, stitching together a variety of capabilities including customized code rendering and microcode manipulation. The project is also actively maintained, with 188 commits, 132 stars, and 14 forks, and the codebase itself is concise and well-commented. We recommend iOSHelper to anyone who regularly works with Apple platform binaries.
by Zion Leonahenahe Basque (mahaloz), the angr team, and the SEFCOM Lab at Arizona State University
BinSync is a collaborative reverse-engineering tool that synchronizes annotations — names, types, comments, prototypes — between users working on the same binary, even when those users are working in different disassemblers. Built on a git-backed storage model and a cross-tool abstraction layer (LibBS), BinSync lets a team coordinate around a sample regardless of whether each member is in IDA, Ghidra, or Binary Ninja. A recent addition adds support for idalib, opening up headless and pipeline-style use cases.
Why it won
BinSync is a substantial open-source project with deep roots in the academic and CTF community, growing out of research led by mahaloz at ASU's SEFCOM lab in collaboration with the angr and Shellphish teams. The numbers reflect a healthy, active project: 563 commits with the most recent landing within the last day of judging, 691 stars, 53 forks, and contributions from 38 people across the broader codebase. The IDA-side integration is primarily mahaloz's work and benefits from the LibBS abstraction layer, which keeps things tidy across each of the supported disassemblers.
The design is thoughtful and the code quality is very good. We were particularly drawn to the idalib mode, which hints at a future where BinSync fits naturally inside automated analysis pipelines rather than being limited to interactive sessions. There is naturally some conceptual overlap with our own IDA Teams add-on, and collaborative analysis is a hard problem with plenty of edge cases we cannot fully account for from the outside. What we did see, however, was a project that handles common cases gracefully and has built up enough community momentum to keep making progress on the harder ones. We expect BinSync to remain active and valuable well into next year.
CrystalRE targets a niche but technically rich problem: reverse-engineering binaries produced by the Crystal programming language. As the author puts it:
Crystal uses a sophisticated symbol mangling scheme and custom runtime structures that IDA doesn't handle well on its own. This plugin automatically demangles symbols, applies type information, and identifies runtime structures to make Crystal binaries easier to analyze.
Beyond demangling, CrystalRE registers a custom__crystalcalling convention, walks the ctree, responds to decompiler events, and applies non-trivial structure manipulation to recover Crystal's runtime layout.
Why it won
Crystal is not yet a widely deployed language, and the plugin's GitHub stats reflect that: 38 commits with the most recent landing about two months before judging, 8 stars, and 1 fork. Despite that, CrystalRE delivers a wide array of tweaks to IDA, tuning the disassembler and decompiler for a specific set of file. Unlike other language/runtime-specific plugins, CrystalRE goes well beyond a simple symbol prettifier. It registers a custom calling convention, walks the ctree data structures, hooks into decompiler events, and recovers structures. We find that CrystalRE is one of the few public examples that brings all of these techniques together in a single plugin.
We would love to see automated tests added to demonstrate robustness across Crystal versions and guard against regressions. The audience is naturally limited today, but if Crystal sees broader adoption, the work here would be a strong candidate for upstreaming. More broadly, CrystalRE is an excellent reminder that IDA is open to deep, file-class-specific customization, and a useful reference for any author considering a similar project.
Drag-and-drop deobfuscation and string/data decryption. Toggleable modules, results written back into IDA comments, and clear before/after highlighting so the cleanup remains auditable.
AI assistant that reasons over the entire binary via a labeled graph database — multi-hop queries like "find a chain where argv length is miscomputed and then used in allocation." Install from source.
Function-triage for malware analysts: configurable signal patterns plus historical sample correlation to surface high-value functions in large binaries.
Detailed instruction info — mnemonic, operands, encoding — at the cursor, powered by Zydis.
hcli plugin install zydisinfo
Contestants entered as private individuals and were judged solely on the merits of their submissions. The contest outcome does not imply any affiliation between Hex-Rays and any winner's employer or affiliated organization, nor does it constitute an endorsement of any related products or services.
Want to enter next year?
Submissions for the 2026 contest open later this year.
