mandiant / flare-ida

IDA Pro utilities from FLARE team
Apache License 2.0
2.24k stars 465 forks source link

updated shellcode hash searcher #88

Closed adamprescott91 closed 4 years ago

adamprescott91 commented 4 years ago

added XOR option for hashes: this allows an XOR value to be applied to hashes from the database just before comparison, this is seen in DoppelPaymer binaries where the hash generation algorithm hasn't changed in a year but they apply a unique XOR to the hash per sample

added decompiler comment option for OpArg hashes: allows the plugin to comment the pseudo code as well as the disassembler so you can see results in both views automatically

updated to work with IDA 7.4 and python 3 print strings, exceptions and dictionaries have been updated for python 3