• Stars
    star
    131
  • Rank 275,867 (Top 6 %)
  • Language
    Python
  • Created over 4 years ago
  • Updated over 4 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A collection of my IDA plugins

IDA Plugins

My collection of plugins for IDA Pro.

Installing plugins

You can simply put the script in the %idafolder%\plugins directory, But I recommend that you use the plugins loader:

  • Take the plugins loader plugin:

https://github.com/tmr232/Sark/blob/master/plugins/plugin_loader.py

It allows you to manage your plugins by editing a plugins.list file.

  • Put plugin_loader.py in the "plugins" directory of IDA.
  • Open IDA as administrator and close it (so the plugins.list file will be created at %idafolder%\cfg)
  • Add the path of the wanted plugin in this file (for example, c:\...\reg_xref.py)

Register Cross References

When looking at disassembly, it's useful to find usages of a register - That's why I created reg_xref. Simply install the plugin and use Shift-Z to get a view like this:

Alt Text

A notable mention is Oregami, But the main difference is that Oregami tries to analyze and find where the same value is used, and display only these references. This is useful for example in case you want to mark a register as a pointer to a structure. I wanted something simpler that shows all of the references to a register inside a function.

More Repositories

1

windbg-cheat-sheet

My personal cheat sheet for using WinDbg for kernel debugging
JavaScript
373
star
2

etw-providers-docs

Document ETW providers
C
203
star
3

autochk-rootkit

Reverse engineered source code of the autochk rootkit
C
195
star
4

apc-research

APC Internals Research Code
C
156
star
5

ReversingMinesweeper

Reverse Engineering Minesweeper: Reconstruct Minesweeper Source Code
C
123
star
6

shellcode2exe

Batch script to compile a binary shellcode blob into an exe file
Batchfile
79
star
7

windows-inspector

A driver to intercept low level windows events
C
60
star
8

windows-imports-searcher

Support Windows OS Reversing by searching easily for references to functions across many DLLs
Python
34
star
9

snax86

A snake game written in x86 Assembly language for windows console
Assembly
31
star
10

rpcmon

RPC Monitor based on The ETW Microsoft-Windows-Rpc provider
Python
25
star
11

practical-reverse-engineering

Code for the solutions of practical reverse engineering
C
20
star
12

autoit-analysis

AutoIt Analysis Library: Parser & Emulator For Malware Researchers
Python
16
star
13

simple-os

Simple Protected Mode Kernel for i386
C++
15
star
14

auto-makefile

Generic Makefile Template with Automatic Dependency Generation
Makefile
12
star
15

PE

PE.Parser, PE.Dumper, PE.Loader
C++
11
star
16

checkpoint-ctf-2018

Solutions to the challenges of the checkpoint CSA CTF
Python
8
star
17

set-critical-thread

Use NtSetInformationThread(ThreadBreakOnTermination) for anti-debugging
C++
8
star
18

real-kernel

16 bit Real mode operating system kernel
C++
7
star
19

tracelogging-providers

A dump of all the trace logging providers from system32
PowerShell
7
star
20

simple-etw-provider

hello world ETW provider
C
6
star
21

repnz.github.io

The deployed version of my blog
HTML
5
star
22

gamekid

Gameboy Emulation Library
C
5
star
23

supple

Supple way to load dynamic XML configuration files
C#
4
star
24

bluehat-il-2019-slotd

BlueHat IL 2019 vulnerable debugging interface
C
3
star
25

nc8-reversing-ctf

Solution to the NC8 CTF & nc8 instruction set emulation API
Python
2
star
26

pytreecli

A command line library that allows to build a tree structures command line easily
Python
2
star
27

c-streams

Wrapper for custom streams in the C language
C
2
star
28

dotflow

DotNet Actor Model POC library
C#
1
star
29

calculator-driver

Simple calculator windows driver
C
1
star