crowdstrike / crowddetox Goto Github PK
View Code? Open in Web Editor NEWThe CrowdDetox plugin for Hex-Rays automatically removes junk code and variables from Hex-Rays function decompilations.
License: BSD 2-Clause "Simplified" License
The CrowdDetox plugin for Hex-Rays automatically removes junk code and variables from Hex-Rays function decompilations.
License: BSD 2-Clause "Simplified" License
# Project Archived! This project has not been maintained since late 2012. As such, `CrowdDetox` has been set to archive (read only) status. The project will remain listed with hopes the code is useful for future projects or communities. --- CrowdStrike CrowdDetox Plugin for Hex-Rays CrowdDetox version 1.0.2 Beta by Jason Geffner ([email protected]) The CrowdDetox plugin for Hex-Rays automatically removes junk code and variables from Hex-Rays function decompilations. LICENSE Please see the LICENSE file for complete licensing details. BUILD INSTRUCTIONS Pre-built versions of the plugin for Windows, Mac OS, and Linux (hexrays_CrowdDetox.plw, hexrays_CrowdDetox.pmc, and hexrays_CrowdDetox.plx, respectively) can be downloaded from http://www.crowdstrike.com/community-tools/index.html If you would like to use the pre-built plugin, you may skip to INSTALLATION INSTRUCTIONS. Otherwise, follow the steps below to build the CrowdDetox plugin. 1. Install IDA Pro with Hex-Rays (https://www.hex-rays.com) 2. Download and extract the IDA Pro SDK (https://www.hex-rays.com/products/ida/support/download.shtml) 3. Install CMake (http://www.cmake.org/cmake/resources/software.html) 4. Install a C++ compiler 5. Run CMake on the included CMakeLists.txt file with the following command line arguments: -D IDA_DIR=<path to IDA Pro installation> -D IDA_SDK=<path to IDA Pro SDK> For example, if you want to build the CrowdDetox plugin with Visual Studio 11 in Windows, your command line may look as follows: cmake.exe -G "Visual Studio 11" -D CMAKE_MAKE_PROGRAM="C:\Program Files\Microsoft Visual Studio 11.0\Common7\IDE\devenv.exe" -D IDA_DIR="C:\Program Files\IDA 6.4" -D IDA_SDK="C:\idasdk64" CMakeLists.txt 6. Build the solution using a C++ compiler. If using Visual Studio in Windows, open the created CrowdDetox.sln solution and build the CrowdDetox project. In Mac OS or Linux, run make. INSTALLATION INSTRUCTIONS Copy hexrays_CrowdDetox.plw (for Windows), hexrays_CrowdDetox.pmc (for Mac OS), or hexrays_CrowdDetox.plx (for Linux) to the IDA Pro plugins folder. UNINSTALLATION INSTRUCTIONS Remove hexrays_CrowdDetox.plw (for Windows), hexrays_CrowdDetox.pmc (for Mac OS), or hexrays_CrowdDetox.plx (for Linux) from the IDA Pro plugins folder. USAGE INSTRUCTIONS To detox a function's decompilation, press 'Shift-F5'. By default, CrowdDetox considers values and variables used in return statements to be legitimate. Users can manually set a function's prototype to specify a return type of 'void' if the user doesn't want CrowdDetox to consider a function's returned variables to automatically be considered legitimate. RELEASE NOTES 1.0.2 Beta -- Defined _countof macro 1.0.1 Beta -- Detoxing is no longer automatic; users may now press 'Shift-F5' to detox a function's decompilation -- Returned variables now always considered legitimate by default; users can manually set a function's prototype to specify a return type of 'void' if the user doesn't want CrowdDetox to consider a function's returned variables to automatically be considered legitimate -- Improved handling of 'continue', 'return', and 'asm' statements 1.0 Beta -- Initial release
2>CrowdDetox.cpp(1018): error C2039: 'index' : is not a member of 'citem_t'
2> D:\ida6.4\plugins\hexrays_sdk\include\hexrays.hpp(1541) : see declaration of 'citem_t'
Can you do a rebuild for more recent versions of IDA, with a new shortcut?
I am trying to do this myself, and I've run into this issue when compiling the module:
if (pItem->op == cot_var) { if (!afVariableIsLegit[((cexpr_t*)pItem)->v.idx]) { if (T_NORMAL != print_type_to_one_line( szType, _countof(szType), idati, ((cexpr_t*)pItem)->type.u_str())) { return 0; } if (0 != strcmp(szType, "CPPEH_RECORD")) { return 0; } } }
T_NORMAL is not defined and u_str() is not a defined member of tinfo_t. T_NORMAL was #defined as 0 in SDK 6.4, but I do not know what the equivalent of u_str() would be in my version of IDA (6.8).
I put the pre-built plug-in into the plugin folder (I have many plug-ins). Nothing happens and nothing shows up under plug-in.
Restarting ida and guest vm does nothing.
Please advise.
TY
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.