testcc2c/ida-jm-xorstr-decrypt-plugin

Attempts to decrypt JM Xorstr in some x64 binaries

IDA Xorstr Decryption Plugin

• Attempts to decrypt obfuscated strings in x64 windows binaries using https://github.com/JustasMasiulis/xorstr
• Only tested on a few projects, can be hit or miss
• Tested on IDA 8

Usage

1. Put xorstr_decrypt.py into <IDA_DIR>/plugins/
2. Open a binary, load the plguin. Any decrypted strings will be shown in the console