• Stars
    star
    736
  • Rank 59,216 (Top 2 %)
  • Language
    C++
  • License
    MIT License
  • Created over 6 years ago
  • Updated 2 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

RetDec plugin for IDA

RetDec IDA plugin

RetDec plugin for IDA (Interactive Disassembler).

The plugin is compatible with the IDA 7.5+ versions. The plugin does NOT work with IDA 6.x, IDA 7.0-7.4, or freeware version of IDA 7.0. The plugin comes at both 32-bit and 64-bit address space variants (both are 64-bit binaries). I.e. it works in both ida and ida64. At the moment, it can decompile the following architectures:

  • 32-bit: x86, arm, mips, and powerpc.
  • 64-bit: x86-64, arm64.

Installation and Use

Currently, we officially support only Windows and Linux. It may be possible to build macOS version from the sources, but since we do not own a macOS version of IDA, we cannot create a pre-built package, or continually make sure the macOS build is not broken.

  1. Either download and unpack a pre-built package from the latest release, or build and install the RetDec IDA plugin by yourself (the process is described below).
  2. Follow the user guide (user_guide.pdf) that is part of the downloaded package, or use the current version from this repository.
  3. Don't forget to install the required dependencies mentioned in the user guide.

Build and Installation

Requirements

Note: These are requirements to build the RetDec IDA plugin, not to run it. See our User Guide for information on plugin installation, configuration, and use.

  • A compiler supporting C++17
    • On Windows, only Microsoft Visual C++ is supported (version >= Visual Studio 2017).
  • CMake (version >= 3.6)
  • IDA SDK (version >= 7.7)

Process

  • Clone the repository:
    • git clone https://github.com/avast/retdec-idaplugin.git
  • Linux:
    • cd retdec-idaplugin
    • mkdir build && cd build
    • cmake .. -DIDA_SDK_DIR=<path>
    • make
    • make install (if IDA_DIR was set, see below)
  • Windows:
    • Open a command prompt (e.g. C:\msys64\msys2_shell.cmd from MSYS2)
    • cd retdec-idaplugin
    • mkdir build && cd build
    • cmake .. -DIDA_SDK_DIR=<path> -G<generator>
    • cmake --build . --config Release -- -m
    • cmake --build . --config Release --target install (if IDA_DIR was set, see below)
    • Alternatively, you can open retdec-idaplugin.sln generated by cmake in Visual Studio IDE.

You must pass the following parameters to cmake:

  • -DIDA_SDK_DIR=</path/to/idasdk> to tell cmake where the IDA SDK directory is located.
  • (Windows only) -G<generator> is -G"Visual Studio 15 2017 Win64" for 64-bit build using Visual Studio 2017. Later versions of Visual Studio may be used. Only 64-bit build is supported.

You can pass the following additional parameters to cmake:

  • -DIDA_DIR=</path/to/ida> to tell cmake where to install the plugin. If specified, installation will copy plugin binaries into IDA_DIR/plugins, and content of scripts/idc directory into IDA_DIR/idc. If not set, installation step does nothing.
  • -DRETDEC_IDAPLUGIN_DOC=ON to enable the user-guide target which generates the user guide document (disabled by default, the target needs to be explicitly invoked).

User Guide

The User Guide in a PDF form is located in doc/user_guide/user_guide.pdf.

You can build your own guide by enabling and invoking the user-guide target:

  • cmake .. -DRETDEC_IDAPLUGIN_DOC=ON
  • Linux: make user-guide
  • Windows: cmake --build . --config Release --target user-guide
  • Requires LaTeX, LaTeX packages, and related tools.
  • The resulting PDF will overwrite the original user_guide.pdf in doc/user_guide.

License

Copyright (c) 2020 Avast Software, licensed under the MIT license. See the LICENSE file for more details.

RetDec IDA plugin uses third-party libraries or other resources listed, along with their licenses, in the LICENSE-THIRD-PARTY file.

Contributing

See RetDec contribution guidelines.

More Repositories

1

retdec

RetDec is a retargetable machine-code decompiler based on LLVM.
C++
7,718
star
2

android-butterknife-zelezny

Android Studio plug-in for generating ButterKnife injections from selected layout XML.
Java
3,385
star
3

retry-go

Simple golang library for retry mechanism
Go
2,170
star
4

android-styled-dialogs

Backport of Material dialogs with easy-to-use API based on DialogFragment
Java
2,153
star
5

gradle-docker-compose-plugin

Simplifies usage of Docker Compose for integration testing in Gradle environment.
Groovy
402
star
6

pytest-docker

Docker-based integration tests
Python
386
star
7

ioc

Threat Intel IoCs + bits and pieces of dark matter
C
338
star
8

scala-server-toolkit

Functional programming toolkit for building server applications in Scala.
Scala
194
star
9

hdfs-shell

HDFS Shell is a HDFS manipulation tool to work with functions integrated in Hadoop DFS
Java
151
star
10

yaramod

Parsing of YARA rules into AST and building new rulesets in C++.
C++
113
star
11

apkparser

APK manifest & resources parsing in Golang.
Go
109
star
12

topee

Google Chrome Extension API for Safari
JavaScript
103
star
13

yari

YARI is an interactive debugger for YARA Language.
Rust
84
star
14

apkverifier

APK Signature verification in Go. Supports scheme v1, v2 and v3 and passes Google apksig's testing suite.
Go
76
star
15

gradle-dependencies-viewer

A simple web UI to analyze dependencies for your project based on the text data generated from "gradle dependencies" command.
JavaScript
76
star
16

yls

YARA Language Server
Python
63
star
17

yarang

Alternative YARA scanning engine
C++
62
star
18

pelib

PE file manipulation library.
C++
61
star
19

datadog4s

Making great monitoring easy in functional Scala
Scala
60
star
20

pe_tools

A cross-platform Python toolkit for parsing/writing PE files.
Python
60
star
21

k8s-admission-webhook

A general-purpose Kubernetes admission webhook to aid with enforcing best practices within your cluster.
Go
54
star
22

yaracpp

C++ wrapper for YARA.
C++
45
star
23

grpc-java-jwt

JWT based authentication for gRPC-Java.
Java
44
star
24

hexrays-demo

IDA SDK tech demo
C++
34
star
25

rabbitmq-scala-client

Scala wrapper over standard RabbitMQ Java client library
Scala
32
star
26

marathon-vault-plugin

Marathon plugin which injects Vault secrets via environment variables
Scala
30
star
27

android-lectures

Class material for lectures about Android development
Kotlin
24
star
28

retdec-regression-tests-framework

A framework for writing and running regression tests for RetDec and related tools.
Python
23
star
29

capstone-dumper

Utility for dumping all the information Capstone has on given instructions.
C++
23
star
30

libdwarf

Library to provide access to DWARF debugging information.
C
22
star
31

PurpleDome

Simulation environment for attacks on computer networks
Python
20
star
32

avast-ctu-cape-dataset

Jupyter Notebook
19
star
33

llvm

An LLVM clone modified for use in RetDec and associated tools.
LLVM
18
star
34

wanna-ml

Complete MLOps framework for Vertex-AI
Python
17
star
35

authenticode-parser

Authenticode-parser is a simple C library for Authenticode format parsing using OpenSSL.
C
15
star
36

grpc-json-bridge

Library for exposing gRPC endpoints via HTTP (JSON) API
Scala
15
star
37

elfio

Library for reading and generating ELF files.
C++
14
star
38

vuei18n-po

transform gettext .po files for vue-i18n
JavaScript
14
star
39

ep-stats

Statistics for Experimentation Platform
Python
13
star
40

retdec-regression-tests

A collection of regression tests for RetDec and associated tools.
Python
11
star
41

cactus

Library for easy conversion between GPB and Scala case classes.
Scala
9
star
42

safariextz

Safari extension packer for node.js
JavaScript
9
star
43

bytes

Library providing universal interface for having an immutable representation of sequence of bytes.
Java
8
star
44

hermes

SMTP honeypot built on top of the Salmon mail server
Python
8
star
45

kafka-tests

Integration test of Apache Kafka 0.9.0+ and Java clients.
Java
8
star
46

ctf-aca-brno-2020

Tasks from Avast Cyber Adventure 2020 Brno
Objective-C
6
star
47

Stor

HTTP API for SHA256 objects
Perl
5
star
48

clockwork

An adoption of the map-reduce paradigm based on the concept of coroutines to the world of stream data processing.
Java
5
star
49

covid-19-ioc

HTML
5
star
50

tlshc

TLSH library in C
C
5
star
51

decryptor-keys

Decryption keys for our ransomware decryptors
5
star
52

bytecompressor

Java and Scala abstractions for some compression algorithms.
Java
5
star
53

slog4s

Structured and contextual logging for Scala
Scala
5
star
54

retdec-support

Support packages for the RetDec decompiler.
5
star
55

hackcambridge-ccleaner-app

A custom build of CCleaner that enables the integration of Avast Secure Browser
Visual Basic
5
star
56

hackcambridge-ccleaner-extension

A stub for the CCleaner extension for Avast Secure Browser
JavaScript
5
star
57

metrics

Java/Scala library defining API for metrics publishing
Java
4
star
58

asio-mutex

Awaitable Mutex compatible with Boost.Asio
C++
4
star
59

machine-learning-python

Machine learning in Python Workshop
Jupyter Notebook
4
star
60

scala-hashes

Case-classes representing MD5, SHA1 and SHA256.
Scala
4
star
61

syringe

Syringe - Dependency Injection and Configuration Library from AVAST Software
Java
4
star
62

mongodb-oplog-stats

A tool for obtaining statistics about a MongoDB replica-set oplog
Rust
4
star
63

syringe-maven-plugin

Supporting Maven plugin for Syringe
Java
3
star
64

cargo-depdiff

Inspecting what changed around dependencies between versions
Rust
3
star
65

webtrails

Svelte
3
star
66

labmanager-unit-vsphere

REST service for vmWare vSphere virtual machine control
Python
3
star
67

BigMap

Scala Map that uses binary search in memory mapped sorted file. It makes possible usage of data sets bigger than available memory as a Map.
Scala
3
star
68

management-console-config

Sample configuration for Avast Business management console
2
star
69

boost-python-examples

Examples that show capabilities of Boost Python
C++
2
star
70

ndisdump

A no-dependencies network packet capture tool for Windows
C++
2
star
71

docker-centos_perl_cpanm

2
star
72

adblock

JavaScript
2
star
73

stor-client

Go
2
star
74

retdec-build-system-tests

Tests of RetDec build system. This can also serve as RetDec component usage examples.
C++
2
star
75

eslint-plugin-apklab-frida

ESLint plugin & config for the Frida scripts used in the apklab.io platform.
JavaScript
2
star
76

VSArchConv

Converts .sln/.vcxproj to support different architecture
C++
2
star
77

hackcambridge-challenge

Integrate the Avast Secure Browser (ASB) and CCleaner products to improve user privacy, prevent website tracking, and reduce the userโ€™s online footprint.
2
star
78

stepdance

Functional iterators for easy and elegant parsing, scanning, iterating etc. Written Scala.
Scala
1
star
79

docker-flume-hdfs

Shell
1
star
80

storage-client

Scala
1
star
81

vsphere-instaclone

Really quickly clone machines to be used as TeamCity agents
Kotlin
1
star
82

jmx-publisher

Tool to get properties and methods published via JMX easily.
Java
1
star
83

browser-extension-messaging-sample

JavaScript
1
star
84

instaprofiles-sync

application is used to regularly synchronize defined cloud profiles for [TeamCity plugin vsphere-instaclone](https://github.com/avast/vsphere-instaclone)
Java
1
star
85

continuity

Library for passing context between threads in multi-threaded applications
Scala
1
star
86

firefox-xpi

Firefox extension packer for node.js
JavaScript
1
star
87

jasmine-class-mock

Create a mock class for the Jasmine framework
JavaScript
1
star
88

jfrog-verisign

JFrog plugin to verify deploying artifacts signatures. It supports both JAR and RPM (PGP) verification
Java
1
star
89

https-encryption

Avast HTTPS Encryption powered by HTTPSEverywhere
JavaScript
1
star
90

kluzo

Library for passing tracing ID between threads in multi-threaded applications
Scala
1
star
91

genrex

Generator of regular expressions
Python
1
star
92

fairy-tale

Toolbox for functional programming in Scala using Finally Tagless approach
Scala
1
star
93

ResolveTest

Simple dns resolve utility.
C++
1
star
94

gossip-bot

Find out what is happening within the company
Go
1
star