Delphi handling - Githubissues

mandiant / flare-floss

FLARE Obfuscated String Solver - Automatically extract obfuscated strings from malware.

Apache License 2.0

3.25k stars 452 forks source link

Delphi handling #729

Open mr-tz opened 1 year ago

mr-tz commented 1 year ago

detect Delphi
tag Delphi strings
parse Delphi structures?
extract Delphi/Pascal strings

HongThatCong commented 1 year ago

I have written an idc script to scan and parse string types in a Delphi binary. Hope it can be of help to you. Parse Delphi structs is a bit complicated because Delphi's RTTI structs vary greatly with each version of Delphi. It's on my todo list, an idapython plugin for parsing RTTI Delphi structs. https://github.com/HongThatCong/DelphiScripts/blob/master/DelphiStrScan.idc