Author: Pedram Amini
Size: ~22k
MD5: a0b40085fca1c9f3d2d1c12c14725c71
Update Summary: Added gml_export() routine for generating GML graphs.

Written as a C.. class, Function Analyzer was originally developed to provide an abstracted layer over "chunked" functions frequently found in Microsoft optimize compiled binaries. As of IDA v4.7 this functionality is built into the SDK. However, Function Analyzer can be used to construct plug-ins compatible across older versions and provides abstracted next_ea()/prev_ea() routines for stepping through an internal "unchunked" instruction list. The abstraction layer also exposes the following function-level information: basic block enumeration (nodes, edges), call count, MD5 hash, CRC, customizable GDL (Wingraph) and GML graph generation.

Download  |  License 

Author: Richard Johnson
Size: 80kb
MD5: A7C9DFB633CCBFB0EC1536700EF169BB

Codis is a console-based disassembler written for the purpose of demonstrating the basic logic of a disassembler engine.

This software was released as example code accompanying the information provided in the Toorcon 7 presentation titled 'Disassembler Internals'.

Codis is written in C and will compile for Linux or Win32 Cygwin environments.

Screenshot  |   Readme

Download  |  License 

Author: David Zimmer David Zimmer
Size: 1.2Mb
MD5: 552C2888770D5E489139DDFD6C8B064E

IDACompare is a plugin designed to compare and match up equivalent functions across two IDA databases. IDACompare was primarily designed for analyzing changes across malcode variants, it should also find good use when conducting patch analysis.

Once function matches have been made, names can be ported across disassemblies, or sequentially renamed in both.

Project also implements a signature scanner, letting you build your own listing of known functions.

Overview  |   Video Tour

Download  |  License 

Author: Pedram Amini
Size: ~225k
MD5: 19ddfa0ab42939e1aa83f81688c7a261
Update Summary: Ported to IDA 4.8

IDA Sync was written to allow multiple analysts to synchronize their reverse engineering efforts with IDA Pro in real time. Users connect to a central server through the ida_sync plugin. Once connected, all comments and name changes made with the registered hot keys are immediately transmitted to all other users working on the same project. The central server stores a copy of all changes as well, allowing new analysts to jump on the project and immediately receive up to date information.

Included in the source release is a C.. class providing IDA Pro plugin developers with an abstracted asynchronous IPC interface.

Download  |  License 

Author: Pedram Amini
Size: ~70k
MD5: e4086cfbe1b501f4ca0bd2473d272c07
Update Summary: Ported to IDA 4.8

Built on top of the IDA Function Analyzer, pGRAPH (Pedram's Grapher), provides an interface to generate more detailed and user defined control-flow graphs using the bundled Wingraph package. Extended features include: support for "chunked" functions, instruction level coloring, edge customization (manhattan vs splines), layout algorithm and more.

Screenshots: Options  |   Sample

Download  |  License 

Author: Pedram Amini
Size: ~8k
MD5: 731fa609c8a61e202c76af9c737e9ef9

This IDC script will scan through an IDA database locating and marking the relevant RPC server data structures. It will then enumerate the dispatch routines from the DispatchTable. The script outputs the addresses of the discovered structs / functions and was designed to automate the otherwise tedious manual process of locating RPC routines to audit.

Download  |  License