Tag: IDA Pro

IDC_Importer: A Binary Ninja plugin for importing IDC database dumps from IDA Pro

~ hucktech ~ Leave a comment

IDC Importer (Plugin)

Author: SpecterDev

Allows users to import idc database dumps from IDA into Binary Ninja. Making the switch from IDA to Binary Ninja but need your function names and symbols to carry over? This plugin will take an IDC file and automatically import the functions, strings, and comments.

https://github.com/Cryptogenic/idc_importer

flare-emu: IDA Pro + Unicorn Engine

~ hucktech ~ Leave a comment

flare-emu marries IDA Pro’s binary analysis capabilities with Unicorn’s emulation framework to provide the user with an easy to use and flexible interface for scripting emulation tasks. It is designed to handle all the housekeeping of setting up a flexible and robust emulator for its supported architectures so that you can focus on solving your code analysis problems. Currently, flare-emu supports the x86, x86_64, ARM, and ARM64 architectures.[…]

https://github.com/fireeye/flare-emu

IDA 7.2 released

~ hucktech ~ Leave a comment

We have many news this time, but let us start with the most desired and requested one: support for ARM v8.3 instructions. With the advent of the new iPhone XS many reverse engineers started to stumble on these new instructions. Besides, they include a new security mechanism: Pointer Authentication Code. It makes exploiting software vulnerabilities much more difficult but it requires modifications in our file parsing and analysis methods.[…]

https://www.hex-rays.com/products/ida/7.2/

IDA Pro 7.1 released

~ hucktech ~ Leave a comment

“With this version of IDA we publish the decompiler intermediate language: the microcode. We were planning to do it since very long time but the microcode was constantly evolving, we could not do it. After ten years of evolution it looks mature and ready to be published. We believe that it will permit our users to implement much more powerful and higher level analysis algorithms than before. In the future we plan to use the microcode in IDA too: if the decompiler is present, the analysis will be improved automatically. “

https://hex-rays.com/products/ida/7.1/index.shtml

https://hex-rays.com/products/ida/7.1/microcode.png

 

IDA releases Freeware 7.0 update

~ hucktech ~ Leave a comment

https://www.hex-rays.com/products/ida/support/download_freeware.shtml

The freeware version of IDA v7.0 has the following limitations:

no commercial use is allowed
lacks all features introduced in IDA > v7.0
lacks support for many processors, file formats, debugging etc…
comes without technical support

 

Duo Labs releases: IDAPython, Coretex M Firmware and Amnesia modules

~ hucktech ~ 1 Comment

Examining Personal Protection Devices: Hardware and Firmware Research Methodology in Action
Todd Manning, Duo Labs
[…]This paper describes a methodology for retrieving device firmware, and for loading firmware into IDA Pro, a common disassembler. This paper focuses on the disassembly of this firmware, and the discussion of a novel approach to defeating readback protection discovered in one ARM Cortex M implementation. During the course of this research, I developed code for IDA Pro to assist in loading and grooming Cortex M firmware images. The IDAPython code is comprised of two modules. The first module annotates Cortex M vector tables, which gives IDA Pro hints about where code exists in the firmware image. The Cortex M module can automatically annotate firmware with a vector table located at the start of a firmware image, or can be tailored by the end user to work with relocated tables. The second module, called Amnesia, uses byte-level heuristics to detect ARM instructions in the firmware. Amnesia also contains heuristics that operate at the ARM instruction level to determine function boundaries based on common ARM function prologues and epilogues.[…]

Cortex M Firmware (cortex_m_firmware.py): This Cortex M Firmware module grooms an IDA Pro database containing firmware from an ARM Cortex M microcontroller. This module will annotate the firmware vector table, which contains a number of function pointers. This vector table annotation will cause IDA Pro to perform auto analysis against the functions these pointers point to. The Cortex M Firmware module also calls into the Amnesia module to automate discovery of additional code in the firmware image using the Amnesia heuristics.

Amnesia (amnesia.py): Amnesia is an IDAPython module designed to use byte level heuristics to find ARM thumb instructions in undefined bytes in an IDA Pro database. Currently, the heuristics in this module find code in a few different ways. Some instructions identify and define new code by looking for comon byte sequences that correspond to particular ARM opcodes. Other functions in this module define new functions based on sequences of defined instructions.

https://duo.com/blog/examining-personal-protection-devices-hardware-and-firmware-research-methodology-in-action

https://github.com/duo-labs/idapython

IPyIDA

~ hucktech ~ Leave a comment

 

Marc-Etienne M.Lévei has an IDA shell in IPython! (I wish more security tool  projects would integrate with IPython.)

IPyIDA is a python-only solution to use a IPython console in the context of IDA Pro. It spawns an IPython kernel that you can connect to with ipython console –existing in your shell or by opening a QT Console window in IDA Pro with <Shift-.>. You can then benefit from IPython’s autocompletion, online help, monospaced font input field, graphs, and so on.
‏

https://github.com/eset/ipyida

tool mini-review: UEFI Xmod

~ hucktech ~ Leave a comment

UEFI Xmod is a to work with EFI images (extracting specific modules, batch processing, etc.). This Python-based command line tool is by “danse-macabre”. It is only 2 days old, so watch for it to evolve.

usage:
uefi_xmod.py [-h] [-g GUID] [-n NAME] [-r REGEX] [-p] [-o OUTDIR] [-t] target [target …]
target : EFI image file or directory which contains such files
-h, –help : show this help message and exit
-g GUID, –guid GUID : extract module with specified GUID
-n NAME, –name NAME : extract module with specified user interface name
-r REGEX, –regex REGEX : extract modules whose names match against given RE
-p, –prefix : add prefix to extracted file
-o OUTDIR, –outdir OUTDIR : store extracted modules in specified directory
-t, –test : do not extract anything but instead check the presence of the specified module

(UEFI Xmode aside, dans-macabre also has another set of UEFI tools: ida-efitools, which is a rewrite of another ida-efitools project, with multiple scripts to help IDA Pro users with UEFI analysis.)

More Information:
https://github.com/danse-macabre/uefi_xmod
https://github.com/danse-macabre/ida-efitools