_ _ ______ _____ _ __ __ _
| | | | | ___ \ / __ \ | | \ \ / / | |
| |_| | _____ _| |_/ /__ _ _ _ ___| / \/ ___ __| | ___ \ V / _ __ | | ___ _ __ ___ _ __
| _ |/ _ \ \/ / // _` | | | / __| | / _ \ / _` |/ _ \/ \| '_ \| |/ _ \| '__/ _ \ '__|
| | | | __/> <| |\ \ (_| | |_| \__ \ \__/\ (_) | (_| | __/ /^\ \ |_) | | (_) | | | __/ |
\_| |_/\___/_/\_\_| \_\__,_|\__, |___/\____/\___/ \__,_|\___\/ \/ .__/|_|\___/|_| \___|_|
__/ | | |
|___/ |_|
============================================================================
The Hex-Rays Decompiler plugin for better code navigation in RE process. CodeXplorer automates code REconstruction of C++ applications or modern malware like Stuxnet, Flame, Equation, Animal Farm ...
The CodeXplorer plugin is one of the first publicly available Hex-Rays Decompiler plugins. We keep updated this project since summer of 2013 and continue contributing new features frequently. Also most interesting feutures of CodeXplorer have been presented on numerous security conferences like: REcon, ZeroNights, H2HC, NSEC and BHUS 👾
Contributors :
Alex Matrosov ( @matrosov )
Eugene Rodionov ( @rodionov )
Rodrigo Branco ( @rrbranco )
Gabriel Barbosa ( @gabrielnb )
Supported versions of Hex-Rays products: everytime we focus on last versions of IDA and Decompiler because trying to use new interesting features in new SDK releases. It's also mean we tested just on last versions of Hex-Rays products and not guaranteed stable work on previous ones.
Why not IdaPython: all code developed on C/C++ because it's more stable way to support complex plugin for Hex-Rays Decompiler.
Supported Platforms: x86/x64 for Win, Linux and Mac.
HexRaysCodeXplorer - Hex-Rays Decompiler plugin for easier code navigation. Right-click context menu in the Pseudocode window shows CodeXplorer plugin commands:
💎 Here are the main features of the CodeXplorer plugin: 💎
The reconstructed structure is displayed in “Output window”. Detailed information about type Reconstruction feature is provided in the blog post “ Type REconstruction in HexRaysCodeXplorer ”.
Also CodeXplorer plugin supports auto REconstruction type into IDA local types storage.
struct_local_data_storage
two virtual function tables were identified and, as a result, two corresponding structures were generated:
struct_local_data_storage_VTABLE_0
and
struct_local_data_storage_VTABLE_4
.
Extract Types to File – dump all types information (include reconstructed types) into file.
Navigation through virtual function calls in HexRays Pseudocode window. After representing C++ objects by C-structures this feature make possible navigation by mouse clicking to the virtual function calls as structure fields:
Object Explorer supports following features:
Auto structures generation for VTBL into IDA local types
Navigation in virtual table list and jump to VTBL address into "IDA View" window by click
Show hints for current position in virtual table list
Shows cross-references list by click into menu on "Show XREFS to VTBL"
The Batch mode contains following features:
Example (dump types and ctrees for functions with name prefix "crypto_"):
idaq.exe -OHexRaysCodeXplorer:dump_types:dump_ctrees:CRYPTOcrypto_path_to_idb
Compiling:
Windows:
Open the solution in Visual Studio
Open file src/HexRaysCodeXplorer/PropertySheet.props in notepad(++) and update values of IDADIR and IDASDK paths to point to IDA installation path and IDA7 SDK path accordingly. HexRays SDK should be in $IDADIR\plugins\hexrays_sdk (like by default)
Build Release | x64 and Release x64 | x64 configurations
Linux:
cd src/HexRaysCodeXplorer/
IDA_DIR=<PATH_TO_IDA> IDA_SDK=<PATH_TO_IDA_SDK> EA64=0 make -f makefile.lnx
IDA_DIR=<PATH_TO_IDA> IDA_SDK=<PATH_TO_IDA_SDK> EA64=0 make -f makefile.lnx install
Mac:
cd src/HexRaysCodeXplorer/
IDA_DIR=<PATH_TO_IDA> IDA_SDK=<PATH_TO_IDA_SDK> make -f makefile.mac
The Mac makefile might need some hand editing, pull requests welcome!
IDA 7.0 .pmc file extension should be .dylib
bash$ export IDA_DIR="/Applications/IDA\ Pro\ 7.0/ida.app/Contents/MacOS" && export IDA_SDK="/Applications/IDA\ Pro\ 7.0/ida.app/Contents/MacOS/idasdk" && make -f makefile7.mac
Or open project in Xcode HexRaysCodeXplorer.xcodeproj
With CMake:
cd src/HexRaysCodeXplorer/
mkdir build && cd build
cmake .. -DIdaSdk_ROOT_DIR=<PATH_TO_IDA_SDK> -DHexRaysSdk_ROOT_DIR=<PATH_TO_HEXRAYS_SDK>
cmake --build . --config Release
============================================================================
Conference talks about CodeXplorer plugin:
"Distributing the REconstruction of High-Level IR for Large Scale Malware Analysis", BHUS [slides]
"Object Oriented Code RE with HexraysCodeXplorer", NSEC [slides]
"HexRaysCodeXplorer: object oriented RE for fun and profit", H2HC [slides]
"HexRaysCodeXplorer: make object-oriented RE easier", ZeroNights [slides]
"Reconstructing Gapz: Position-Independent Code Analysis Problem", REcon [slides]