psifertex

Welcome to Jordan's grab-bag of common Binary Ninja Snippets.

These snippets are meant to run with the Binary Ninja Snippets Plugin
(http://github.com/Vector35/snippets) though they can all also be pasted
directly into the python console or turned into stand-alone plugins if needed.

To install the entire collection at once, just install the Snippets plugin via
the plugin manager (CMD/CTL-SHIFT-M), confirm the Snippet Editor works
(Tool/Snippets/Snippet Editor), and unzip this bundle (Download ZIP above) into
your Snippets folder.

NyaMisty

This gist contains lots of my written IDAPython snippets.

OALabs

import idaapi, idc, idautils


class DecryptorError(Exception):
    pass


def rc4crypt(key, data):
    x = 0
    box = range(256)

jymcheong

using System;
using System.Diagnostics;
using Microsoft.Diagnostics.Tracing;
using Microsoft.Diagnostics.Tracing.Session;
using Microsoft.Diagnostics.Tracing.Parsers;
using System.IO;
using System.Collections.Generic;
using System.Reflection;
using Newtonsoft.Json;

icecr4ck

IDAPython cheatsheet

Important links

• Porting IDAPython plugins to IDA 7.4
• Hex-Rays IDAPython official documentation

Basic commands

Get informations on the binary

MattPD

Program Analysis Resources

(draft; work in progress)

See also:

• Compilers
  • correctness
• Program analysis:
• Dynamic analysis - instrumentation, translation, sanitizers

icecr4ck

IDA Microcode notes

References

• Ilfak's presentation at Recon 2018
• Microcode in pictures
• Hex-Rays Microcode API vs. Obfuscating Compiler
• Scripts vds10, vds11, vds12 and vds13 from Hex-Rays SDK

Implementation

lucasg

import ida_bytes
import binascii

def get_guid(address):
   
    data1 = ida_bytes.get_dword(address)
    data2 = ida_bytes.get_word(address + 4)
    data3 = ida_bytes.get_word(address + 6)
    data4 = ida_bytes.get_bytes(address + 8, 8)

cmatthewbrooks

##############################################################################
#
# Name: hello_world_plugin.py
# Auth: @cmatthewbrooks
# Desc: A test plugin to learn how to make these work; Specifically, how to
#       have multiple actions within the same plugin.
#
#       In plain English, IDA will look for the PLUGIN_ENTRY function which
#       should return a plugin object. This object can contain all the 
#       functionality itself, or it can have multiple actions.

mattifestation

[
    {
        "ProviderGUID":  "72d164bf-fd64-4b2b-87a0-62dbcec9ae2a",
        "ProviderName":  "AccEventTool",
        "ProviderGroupGUID":  "4f50731a-89cf-4782-b3e0-dce8c90476ba",
        "AssociatedFilenames":  [
                                    "accevent.exe",
                                    "inspect.exe",
                                    "narrator.exe",
                                    "srh.dll"