stevemk14ebr / retools

My reversing tools. Some custom, some not.

RETools

Random tools I made or otherwise just use for reversing quickly.

PEDMPExtractor

• Search for PE files in a raw dump and display arch + pe file size to allow manual carving quickly

REClass

• Live memory C, C++, and other structure rebuilding tool. Shows a structured view over live memory so you can see values as they change.

GoReSym

• Extract GoLang function names, file paths, reconstruct user defined structures and interfaces, and print binary metadata. Amongst other things.

STrace

• Syscall hooking framework. Modify args, return values, etc in a patchguard compatible way.
• Within this repo is a tool PDBReSym, which can download PDBs and Binaries from the MS symbol server, or symbolicate logs.

demumble

• C++ library with python wrapper to demangle Itanium and MSVC symbols on all platforms (Linux, Mac, Windows)
  • Modified from: https://github.com/nico/demumble

JITCall

• Command line application to JIT (via asmjit) compile a calling stub around N number of dll exports with arguments provided the calling convention. Additionally can load shellcode or manual mapping of dlls to easily debug dllmain and can read binary files to pass arbitrary data as argument. Wait for execution by key press or int3.

BlobRunner

• Allocate and run shellcode, print shellcode base and wait for execution by key press. Simpler alternative than JITCall, doesn't support arguments.

COM-Code-Helper

• Com plugin for IDA pro to automatically identify and label many com interfaces and some vtable structures

SingleFileExtractor

• A utility for extracting .NET single file bundles to disk while maintaining the internal bundle folder structure. Also supported by ILSpy fwiw.

IdaScripts

Python helper scripts to do random stuff. May contain wrappers around ida operations, binja operations, or misc python utilities useful in low level stuff. See https://hex-rays.com/blog/igors-tip-of-the-week-33-idas-user-directory-idausr/ for the easiest way to use the plugins and configs.

• Plugins: Ida plugins. Either raw binaries or submodules to the project if it's on github (and installable via src).

  • signsrch: easily create byte signatures of various forms and search for them. Auto-mask the opcode and some immediates
  • hexlight: highlight bracket pairs in hex-rays pseudocode, press 'b' to jump between start/end brackets
  • easy_nop: select and right click an assembly sequence to replace with 0x90 nops
  • flare-capa: find interesting functions in a binary
  • sigmaker: create and search for assembly patterns automatically in IDA
  • HexRaysPyTools (oopsmishap fork): C++ structure rebuilding tool, right click else conditions to swap if/then, much more. Fork includes new template build feature and fixes
  • IDAFuzzy: search plugin
  • Define String From Selection: Allows selecting a region of memory and defining a string of that specific selection length (not null terminated). Useful for Go and other languages with string length stored seperately from the non-null terminated string.

• SLib: Steve's python lib. Simple python helpers to do binary work packaged into a nice python module.

• Misc: Some example IDA python scripts to do common things. Just examples for common tasks.

  • reset_all_colors: Strip set_color's from an IDB received from someone else and reset to theme colors (remove call highlights etc).

• Cfg:

  • idagui.cfg: Escape closes windows disabled via OTHER_CLOSED_BY_ESC, TOOL_CLOSED_BY_ESC, CLOSED_BY_ESC. Hide/Unhide bindings changed to ctrl-shift-h and ctr-shift-u for tenkeyless keyboard support.
  • hexrays.cfg: COLLAPSE_LVARS true, GENERATE_EA_LABELS true, AUTO_UNHIDE true, MAX_FUNCSIZE expanded for stupid obfuscators, PSEUDOCODE_DOCKPOS DP_RIGHT, PSEUDOCODE_SYNCED true, HEXOPTIONS 0x821BF to mask off HO_ESC_CLOSES_VIEW and HO_CONST_STRINGS, MAX_NCOMMAS 1 for nicer conditional formatting
  • ida.cfg: PACK_DATABASE set to 2 for compressed idbs, DemangleNames set to DEMNAM_NAME to show demangled by default

retools's Issues

getProcAddress Bugs

RETools/JITCall/JITLoadDll/ManualMapper/ManualMap.cpp

Line 349 in 633033d

return RVA2VA(uint64_t, hModule, exportPtrs.addressOfFunctions[i]);

Should be

 return RVA2VA(size_t, hModule, exportPtrs.addressOfFunctions[exportPtrs.addressOfNameOrdinals[i]]);

RETools/JITCall/JITLoadDll/ManualMapper/ManualMap.cpp

Line 340 in 633033d

uint64_t ManualMapper::getProcAddress(HMODULE hModule, std::string procName) {

should be size_t return for x86 support

Create dump fix option for pedmpextractor

--fixdump flag should be added to overwrite each sections raw address with the virtual, and size too. This will 'unexpand' the binary so that IDA can correctly parse PE headers of an already expanded PE dumped from memory.

JITCall `-m` exec main

When -m load mode is specified, auto-execute main if it's there. The arg parser seems to require a -f flag first, which is undesirable as we sometimes like to manual load so that we can easily break on main. The loader code itself is already ok.

JITCALL arg types

Need to add support for argv pointer to pointer arrays. Support wchar_t* too.