/hrtng

IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations

Primary LanguageC++GNU General Public License v3.0GPL-3.0

hrtng IDA plugin

hrtng IDA plugin is a collection of tools, ideas and experiments from different sources I've found interesting and useful in my reversing work.

There is no one place in menu where all functionality of the plugin grouped together. hrtng menu items placed closer to logically related standard IDA & Hex-Rays decompiler functions. Messages, menu items, popup windows and dialog boxes belong to this plugin are marked with "[hrt]" prefix.

The plugin requires Hex-Rays decompiler presence in your IDA installation. The plugin can be compiled with IDA SDK >= 7.3 but not well tested with old versions.

Special thanks to following peoples for their great plugins were used as base for my work:

Features of the plugin:

Automation

Interactive pseudocode transformation

Decryption

Deal with obfuscated code

Code recognition

Structures assistance

Virtual/indirect calls assistance

IDA UI improvements

Misk features

Patching

IDA plugin developer help

Building

cd src
git clone https://github.com/abdes/cryptopp-cmake
  • Copy IDA_DIR/plugins/hexrays_sdk/include/hexrays.hpp file to the include directory of the IDA SDK.
  • Edit hrtng/src/CMakeLists.txt file to set correct path and version of used IDA SDK. To build later with another SDK version you may change cmake's IDASDK_VER variable with using cmake -D, ccmake or cmake-gui tools.
  • Create build directory, go into it, configure and build cmake project
mkdir bld && cd bld
cmake <path-to/hrtng/src>
cmake --build . --config Release -j 4 --clean-first
  • On the first build attempt there will be compiling error looks like:
hrtng/src/deob.cpp:912:60: error: ‘class rangeset_t’ has no member named ‘getbag’
     fc.create("tmpfc2", ranges.getbag(), 0);//!!! add line into range.hpp, class rangeset_t: "const rangevec_t &getbag() const { return bag; }"
  • To fix the error, edit IDA_SDK/include/range.hpp file, adding line with getbag function implementation into class rangeset_t declaration as in the following example:
class rangeset_t
{
  rangevec_t bag;
  ...
  public:
  const rangevec_t &getbag() const { return bag; }
  ...
};
  • Copy built binaries into IDA_DIR/plugins folder togeter with apilist.txt and literal.txt files from hrtng/bin/plugins
  • Profit

License

This program is released under GPL v3 license

Authors

  • Sergey.Belov at kaspersky.com