15

I'm a bit of a novice with IDA Pro, and have been discovering some of the excellent plugins available from the RE community as well as its vendors. My small list of plugins that I have found extremely valuable to me are:

Granted, this is a very short list. What IDA Pro scripts/plugins do you find essential?

closed as not constructive by Gilles, user187, JMcAfreak, Mick, Jesper.Reenberg Mar 20 '13 at 19:37

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 6
    This question is pretty subjective and more like a poll. However, there probably are many plugins and scripts that would be helpful to many so this could be a community wiki. – Henry Heikkinen Mar 20 '13 at 13:24
  • 1
    @HenryHeikkinen Using community wiki to shoehorn polls into a questions and answers platform turned out to be a mistake, it is no longer done. See The future of community wiki. Polls are not accepted on Stack Exchange, and I voted to close accordingly. – Gilles Mar 20 '13 at 18:59
  • 1
    Perhaps such a subjective list could be added to the tag wiki of [idapro]. – Jesper.Reenberg Mar 20 '13 at 19:47
  • 6
    If we take StackExchange lore out of the equation, it seems very difficult to argue that such a question is in fact "not constructive". So at best we should say "closed as not conforming to the whims of the StackExchange metamoderation community."" – Rolf Rolles Mar 20 '13 at 20:28
  • 1
    This is not a constructive question in its current form and I dont think it should be reopened. If users do feel this is an important discussion, then I suggest dealing with this as discussed here meta.reverseengineering.stackexchange.com/questions/53/… . The discussion should be moved to meta and the best/essential plugins can be added to the Tag Wiki based on agreement/votes. – asheeshr Mar 28 '13 at 8:39
10

There are binary diffing plugins also that are very handy to analyse vulnerabilities: patchdiff2 and zynamics bindiff. They can help you analyse the patches that the binary had and very usefull to analyse i.e. why the application was vulnerable before the patch and how the vendor fixed it.

Besides these two plugins for IDA there's DarunGrim, another excellent binary diffing tool.

  • 1
    Have you tried this one? I'd be interested in your opinion. – Igor Skochinsky Mar 20 '13 at 14:51
  • @IgorSkochinsky it sounds really interesting. I'll take a deep look at it. Thanks! – jyz Mar 20 '13 at 16:46
8

Here's a few I use regularly:

  • Microsoft VC++ RTTI and EH parser scripts. There is a reimplementation as a plugin (but I haven't tried it).

  • memcpy.idc from IDA's idc directory. Very simple but useful when dealing with firmwares that copy code around.

  • renimp.idc when doing PE unpacking. Though recently it's been supplanted by UUNP's manual reconstruct feature.

  • a tiny script to save selected bytes to a file. Useful for extracting embedded binaries from droppers.


#include <idc.idc>
static main()
{
  auto s,e,f,name;
  s = SelStart();
  e = SelEnd();
  if (s==BADADDR || e==BADADDR)
    return;
  name = form("dump_%08X.bin", s);
  f = fopen(name,"wb");
  Message("Saving %a-%a to %s...", s, e, name);
  savefile(f,0,s,e-s);
  Message("done.\n");
  fclose(f);
}

Also, I often write small IDC or Python snippets that do something specific to the binary I'm reversing, e.g. parsing a custom symbol table, or converting some specific byte sequence to code. These are usually not reused much.

6

For analysing RPC I use mIDA: mIDA is a plugin for the IDA disassembler that can extract RPC interfaces from a binary file and recreate the associated IDL definition. mIDA is free and fully integrates with the latest version of IDA (5.2 or later). This plugin can be used to :

* Navigate to RPC functions in IDA
* Analyze RPC function arguments
* Understand RPC structures
* Reconstruct an IDL definition file

The IDL code generated by mIDA can be, most of the time, recompiled with the MIDL compiler from Microsoft (midl.exe).

mIDA is freely distributed to the community by Tenable in the hope it will be useful to you and help research engineers to work more effectively on RPC programs. However, Tenable does not provide support for this tool and offers no guarantee regarding its use or output. Please read the end-user license agreement before using this program.

Sample output of mIDA

3

I'd like to add collabREate - plugin, which allow to do reverse engineering in the small team, all share the same IDA session.

Not the answer you're looking for? Browse other questions tagged or ask your own question.