[General] IDA Scripting

[J0llyGr33n]

Hey guys I was looking up some IDA Scripting stuff and came past a few things I thought might be interesting for SOME people here. Although this will most likely be the people are newer to everything such as my self.

Disclaimer: I have not used any of these before and I am not the author of any of these. I am just sharing resources I found!

First up is:
RubLib 0.04 - Programming stuff

Version 0.04 of RubLib, a high-level API for writing IDA Pro scripts in Ruby, is here. It grew from 125 methods to 163 methods since version 0.03. The most important new features are:

Support for function chunks
The Instruction class was restructured a bit
The behaviour of the [ ]-operator of the RubLib classes was standardized. It behaves like the [ ]-operator of the standard String class now.

I personally don't use Ruby but if I recall Ruby is a rather easy scripting language to use, and is becoming quite popular with big use in the security field due to Metasploit. But that is to far off topic to discuss here.

OpenRCE

Creates pseudo-c code to aid you in the progress of decompiling a target. Of course, the script doesn't give you accurate results. It doesn't have any dataflow analysis nor doese it handle every mnemonic/code structure. My intention was to play a bit with the IDC scripting language.

The above may be a nice substitute for IDAs actual plugin for those who can't afford it.


OpenRCE

C++ VTable reconstruction script, see screenshot.

It works particularly well in this example because most of the functions are defined and thus have pretty names, it could at least be used as a starting point for creating the vtable then RE'ing the method(s) of interest.

To be used in an injected DLL, etc., where you can get the THIS for the object(s) you want and then cast it using these reconstructed classes. And yes they don't have class data, you still have to RE that.

http://www.openrce.org/reference_lib.../ida/idapw.pdf
Ida Plugin Writing in C/C++

Enjoy guys. Remember I have not used any of these before and I am not the author of any of these. I am just sharing resources I found!