icecr4ck

IDAPython CTREE

Important links

• Hex-Rays Decompiler Primer
• hexrays.hpp

Description

The CTREE is built from the optimized microcode (maturity at CMAT_FINAL), it represents an AST-like tree with C statements and expressions. It can be printed as C code.

icecr4ck

import idautils
import ida_range
import ida_hexrays as hr

class decryptor(hr.mop_visitor_t):

    def visit_mop(self, op, type, is_target):
        if op.t != hr.mop_f:
            return 0

icecr4ck

import idaapi

class ExamplePlugin(idaapi.plugin_t):
    flags = idaapi.PLUGIN_DRAW
    comment = "This plugin does nothing useful"
    help = "No help is needed"
    wanted_name = "Example"
    wanted_hotkey = "Alt-F11"

    def init(self):

icecr4ck

IDAPython cheatsheet

Important links

• Porting IDAPython plugins to IDA 7.4
• Hex-Rays IDAPython official documentation

Basic commands

Get informations on the binary

icecr4ck

from binaryninja import *
from miasm.jitter.csts import PAGE_READ, PAGE_WRITE
from miasm.analysis.machine import Machine

def stop_sentinelle(jitter):
    jitter.run = False
    jitter.pc = 0
    return True

def emulate(bv, addr):

icecr4ck

IDA Microcode notes

References

• Ilfak's presentation at Recon 2018
• Microcode in pictures
• Hex-Rays Microcode API vs. Obfuscating Compiler
• Scripts vds10, vds11, vds12 and vds13 from Hex-Rays SDK

Implementation

icecr4ck

import sys
from PySide2.QtWidgets import (QApplication, QDialog, QPushButton, QLabel, QHBoxLayout)
from PySide2.QtCore import Qt
from binaryninjaui import (UIAction, UIActionHandler, Menu)

class GreatUI(QDialog):

    def __init__(self, parent=None):
        super(GreatUI, self).__init__(parent)
        self.setWindowModality(Qt.NonModal)

icecr4ck

from miasm.analysis.binary import Container
from miasm.analysis.machine import Machine
from miasm.core.asmblock import AsmCFG

cont = Container.from_string("\xff\xe0\x89\xc0\x89\xd8\xeb\x05\x89\xc8\xeb\x01\x90\xc3")
bs = cont.bin_stream

machine = Machine("x86_32")
mn, dis_engine = machine.mn, machine.dis_engine

icecr4ck

import sys

from miasm.analysis.machine import Machine
from miasm.analysis.binary import Container
from miasm.analysis.simplifier import IRCFGSimplifierSSA, IRCFGSimplifierCommon

cont = Container.from_stream(open(sys.argv[1], 'rb'))
machine = Machine('x86_64')
mdis = machine.dis_engine(cont.bin_stream, loc_db=cont.loc_db)

icecr4ck

import sys

from miasm.analysis.machine import Machine
from miasm.analysis.binary import Container

#def cb_example(cur_bloc, loc_db, offsets_to_dis, *args, **kwargs):
    #if len(cur_bloc.lines) < 1:
        #return

cont = Container.from_stream(open(sys.argv[1], 'rb'))