11

I am just starting to use IDA Pro. After discussing a bit with the community, it seems that IDA Pro plugins and scripts are quite important to reach a good level of productivity while analyzing a program.

What are some must have plugins for IDApro that you would recommend for an everyday usage.

8
  • what kind of program? what kind of analysis? that's an extremely broad question so far.
    – Ange
    Commented Apr 17, 2013 at 10:11
  • 2
    possible duplicate of What are the essential IDA Plugins or IDA Python scripts that you use?
    – Remko
    Commented Apr 17, 2013 at 10:14
  • IMHO, most useful plugin - one You familiar with and one that automate and help in YOUR work with IDA. When You'll learn IDA a bit more, You'll find out Your methods, and then - choose Your plugins to automate process. Commented Apr 17, 2013 at 10:28
  • I converted it into a community wiki so that anyone can edit it and add a list of plugins as I think the question is very common. Commented Apr 17, 2013 at 11:12
  • I edited the question to reflect the two main tasks for which I intend to use IDApro.
    – perror
    Commented Apr 17, 2013 at 11:36

1 Answer 1

10

By Architecture

Generic helpers for reverse engineering of a specific architecture.

ia32

amd64

ARM


By Operating System

Generic helpers for reverse engineering of a specific operating system.

Windows

Linux


By Compiler

Generic helpers for reverse engineering of binaries generated using a specific compiler.

Microsoft Visual Studio

Microsoft Visual C++ Reversing Helpers

These IDC scripts help with the reversing of MSVC programs. One script scans the whole program for typical SEH/EH code sequences and comments all related structures and fields. The other script scans the whole program for RTTI structures and vftables.

GCC

Delphi

Delphi RTTI script

This script deals with Delphi RTTI structures

Borland

Borland C++ Builder RTTI

Borland C++ Builder Run Time Type Information (RTTI) support for IDA Pro


By Technology

Generic helpers for reverse engineering of a technology.

COM

COM Plugin

The plugin tries to extract the symbol information from the typelibrary of the COM component. It will then set the function names of interface methods and their parameters, and finally add a comment with the MIDL-style declaration of the interface method.

Remote Procedure Call

mIDA

mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later)


Cryptography

Generic helpers for reverse engineering of encryption and decryption algorithms.

Signature Based

FindCrypt2

The idea behind it pretty simple: since almost all crypto algorithms use magic constants, we will just look for these constants in the program body. The plugin supports virtually all crypto algorithms and hash functions.


Deobfuscation

Plugins and scripts for removing obfuscations from disassembly.

ia32

Optimice

Optimice applies common optimization techniques on obfuscated code to make it more readable/user friendly. This plugin enables you to remove some common obfuscations and rewrite code to a new segment.

3
  • I started with this small template. I have more that I want to add but I don't have time right now. Anyone else, edit away. Commented Apr 17, 2013 at 11:45
  • is there a reliable mirror for the mida plugin? It'd be nice if we could ensure all download links work.
    – broadway
    Commented Apr 17, 2013 at 15:19
  • @broadway: send it to IDAPalace?!
    – 0xC0000022L
    Commented Apr 30, 2013 at 23:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.