10

I am just starting to use IDA Pro. After discussing a bit with the community, it seems that IDA Pro plugins and scripts are quite important to reach a good level of productivity while analyzing a program.

What are some must have plugins for IDApro that you would recommend for an everyday usage.

closed as not constructive by asheeshr Apr 18 '13 at 1:50

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

  • what kind of program? what kind of analysis? that's an extremely broad question so far. – Ange Apr 17 '13 at 10:11
  • 2
    possible duplicate of What are the essential IDA Plugins or IDA Python scripts that you use? – Remko Apr 17 '13 at 10:14
  • IMHO, most useful plugin - one You familiar with and one that automate and help in YOUR work with IDA. When You'll learn IDA a bit more, You'll find out Your methods, and then - choose Your plugins to automate process. – Denis Laskov Apr 17 '13 at 10:28
  • I converted it into a community wiki so that anyone can edit it and add a list of plugins as I think the question is very common. – Peter Andersson Apr 17 '13 at 11:12
  • I edited the question to reflect the two main tasks for which I intend to use IDApro. – perror Apr 17 '13 at 11:36
10

By Architecture

Generic helpers for reverse engineering of a specific architecture.

ia32

amd64

ARM


By Operating System

Generic helpers for reverse engineering of a specific operating system.

Windows

Linux


By Compiler

Generic helpers for reverse engineering of binaries generated using a specific compiler.

Microsoft Visual Studio

Microsoft Visual C++ Reversing Helpers

These IDC scripts help with the reversing of MSVC programs. One script scans the whole program for typical SEH/EH code sequences and comments all related structures and fields. The other script scans the whole program for RTTI structures and vftables.

GCC

Delphi

Delphi RTTI script

This script deals with Delphi RTTI structures

Borland

Borland C++ Builder RTTI

Borland C++ Builder Run Time Type Information (RTTI) support for IDA Pro


By Technology

Generic helpers for reverse engineering of a technology.

COM

COM Plugin

The plugin tries to extract the symbol information from the typelibrary of the COM component. It will then set the function names of interface methods and their parameters, and finally add a comment with the MIDL-style declaration of the interface method.

Remote Procedure Call

mIDA

mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later)


Cryptography

Generic helpers for reverse engineering of encryption and decryption algorithms.

Signature Based

FindCrypt2

The idea behind it pretty simple: since almost all crypto algorithms use magic constants, we will just look for these constants in the program body. The plugin supports virtually all crypto algorithms and hash functions.


Deobfuscation

Plugins and scripts for removing obfuscations from disassembly.

ia32

Optimice

Optimice applies common optimization techniques on obfuscated code to make it more readable/user friendly. This plugin enables you to remove some common obfuscations and rewrite code to a new segment.

  • I started with this small template. I have more that I want to add but I don't have time right now. Anyone else, edit away. – Peter Andersson Apr 17 '13 at 11:45
  • is there a reliable mirror for the mida plugin? It'd be nice if we could ensure all download links work. – broadway Apr 17 '13 at 15:19
  • @broadway: send it to IDAPalace?! – 0xC0000022L Apr 30 '13 at 23:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.