Leaderboard

IDA Palette (or its project name: ifred) is a plugin which provides fast search on IDA Pro's commands/menu items or searches through its strings output! This plugin provides 2 keyboard shortcuts: Ctrl + P : Searched through IDA's commands Ctrl + Shift +P : Searched through IDA's string output

The Hex-Rays Decompiler plugin for better code navigation in RE process. CodeXplorer automates code REconstruction of C++ applications or modern malware like Stuxnet, Flame, Equation, Animal Farm ... Features: Automatic type REconstruction for C++ objects. To be able to reconstruct a type using HexRaysCodeXplorer one needs to select the variable holding pointer to the instance of position independed code or to an object and by right-button mouse click select from the context menu «REconstruct Type» option. Virtual function table identification - automatically identifies references to virtual function tables during type reconstruction. When a reference to a virtual function table is identified the plugin generates a corresponding C-structure. As shown below during reconstructing struct_local_data_storage two virtual function tables were identified and, as a result, two corresponding structures were generated: struct_local_data_storage_VTABLE_0 and struct_local_data_storage_VTABLE_4. C-tree graph visualization – a special tree-like structure representing a decompiled routine in citem_t terms (hexrays.hpp). Useful feature for understanding how the decompiler works. The highlighted graph node corresponds to the current cursor position in the HexRays Pseudocode window Ctree Item View – show ctree representation for highlighted element Extract Types to File – dump all types information (include reconstructed types) into file. Navigation through virtual function calls in HexRays Pseudocode window. After representing C++ objects by C-structures this feature make possible navigation by mouse clicking to the virtual function calls as structure fields Jump to Disasm - small feature for navigate to assembly code into "IDA View window" from current Pseudocode line position. It is help to find a place in assembly code associated with decompiled line. Object Explorer – useful interface for navigation through virtual tables (VTBL) structures. Object Explorer outputs VTBL information into IDA custom view window. The output window is shown by choosing «Object Explorer» option in right-button mouse click context menu Support auto parsing RTTI objects This plugin is recompiled by disauto UPDATE 29.10.2024 Recompiled for IDA Pro v9.0 Windows x86_64

OllyICE patched to work with TheMida, this was made by the prestigious team SnD member EvOlUtIoN. This debugger took me a long time to find on the net and since most of the links that were on the net were dead it took me like around 3 weeks to find. I hope you guys enjoy. QUOTE BY EvOlUtIoN: So, by popular demand here is the debugger I normally use to "play" with programs protected with TheMida / WinLicense. My patch is very simple but it is good to remember that OllyICE was created for the first time since Hachno, a guru when it comes to Armadillo and unpacking in general. This version has basically 2 patches that differ from the normal OllyICE: One. We do not crash when you load a file protected 2. If you add a context menu creates an entry called "TheMida OllyDbg", so depending on the target, you can open a olly or another. In the plugin folder there are all those necessary, the most important are: 1. PHANTOM plugin 2. HideOD Without these you do not ever riusicrà to load a target with TheMida without being detected. In addition there are 2 scripts, neither Dumpa the VM but at least find the OEP and aaggiustano the IAT.