What are the essential IDA Plugins or IDA Python scripts that you use?

Question

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely valuable to me are:

Hex-Rays Decompiler (commercial) - convert program to pseudo-C
IDA Toolbag - Adds too much awesome functionality to IDA to list. Just see/read about it.
IDAscope - Function tagging/inspection, WinAPI lookup, Crypto identification

Granted, this is a very short list. What IDA Pro scripts/plugins do you find essential?

This question is pretty subjective and more like a poll. However, there probably are many plugins and scripts that would be helpful to many so this could be a community wiki. — Henry Heikkinen, Mar 20 '13 at 13:24
I intended to make this a community wiki, but it does not appear to be an option. — Mick, Mar 20 '13 at 13:57
@HenryHeikkinen Using community wiki to shoehorn polls into a questions and answers platform turned out to be a mistake, it is no longer done. See The future of community wiki. Polls are not accepted on Stack Exchange, and I voted to close accordingly. — Gilles 'SO- stop being evil', Mar 20 '13 at 18:59
@KenB There aren't any restrictions for the private beta. CW polls were a youthful mistake on SO, now fixed. — Gilles 'SO- stop being evil', Mar 20 '13 at 19:01
Perhaps such a subjective list could be added to the tag wiki of [idapro]. — Jesper.Reenberg, Mar 20 '13 at 19:47
If we take StackExchange lore out of the equation, it seems very difficult to argue that such a question is in fact "not constructive". So at best we should say "closed as not conforming to the whims of the StackExchange metamoderation community."" — Rolf Rolles, Mar 20 '13 at 20:28
This is not a constructive question in its current form and I dont think it should be reopened. If users do feel this is an important discussion, then I suggest dealing with this as discussed here http://meta.reverseengineering.stackexchange.com/questions/53/how-should-book-tutorial-questions-be-dealt-with . The discussion should be moved to meta and the best/essential plugins can be added to the Tag Wiki based on agreement/votes. — asheeshr, Mar 28 '13 at 08:39
It's worth visiting plugin contest HP. https://www.hex-rays.com/contests/2018/index.shtml — kirin, Nov 16 '18 at 13:26

score 11 · Accepted Answer · answered Mar 20 '13 at 14:18

11

There are binary diffing plugins also that are very handy to analyse vulnerabilities: patchdiff2 and zynamics bindiff. They can help you analyse the patches that the binary had and very usefull to analyse i.e. why the application was vulnerable before the patch and how the vendor fixed it.

Besides these two plugins for IDA there's DarunGrim, another excellent binary diffing tool.

answered Mar 20 '13 at 14:18

jyz

498
2
12

1

Have you tried this one? I'd be interested in your opinion. – Igor Skochinsky Mar 20 '13 at 14:51
@IgorSkochinsky it sounds really interesting. I'll take a deep look at it. Thanks! – jyz Mar 20 '13 at 16:46

score 9 · Answer 2 · answered Mar 20 '13 at 13:51

Here's a few I use regularly:

Microsoft VC++ RTTI and EH parser scripts. There is a reimplementation as a plugin (but I haven't tried it).
memcpy.idc from IDA's idc directory. Very simple but useful when dealing with firmwares that copy code around.
renimp.idc when doing PE unpacking. Though recently it's been supplanted by UUNP's manual reconstruct feature.
a tiny script to save selected bytes to a file. Useful for extracting embedded binaries from droppers.

#include <idc.idc>
static main()
{
  auto s,e,f,name;
  s = SelStart();
  e = SelEnd();
  if (s==BADADDR || e==BADADDR)
    return;
  name = form("dump_%08X.bin", s);
  f = fopen(name,"wb");
  Message("Saving %a-%a to %s...", s, e, name);
  savefile(f,0,s,e-s);
  Message("done.\n");
  fclose(f);
}

Also, I often write small IDC or Python snippets that do something specific to the binary I'm reversing, e.g. parsing a custom symbol table, or converting some specific byte sequence to code. These are usually not reused much.

score 7 · Answer 3 · edited Apr 17 '13 at 05:07

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later). This plugin can be used to :

* Navigate to RPC functions in IDA
* Analyze RPC function arguments
* Understand RPC structures
* Reconstruct an IDL definition file

The IDL code generated by mIDA can be, most of the time, recompiled with the MIDL compiler from Microsoft (midl.exe).

mIDA is freely distributed to the community by Tenable in the hope it will be useful to you and help research engineers to work more effectively on RPC programs. However, Tenable does not provide support for this tool and offers no guarantee regarding its use or output. Please read the end-user license agreement before using this program.

Sample output of mIDA

score 4 · Answer 4 · answered Mar 20 '13 at 18:16

4

I'd like to add collabREate - plugin, which allow to do reverse engineering in the small team, all share the same IDA session.

answered Mar 20 '13 at 18:16

Anton Kochkov

696
4
10

What are the essential IDA Plugins or IDA Python scripts that you use?

4 Answers4

Linked