Awesome Open Source
Awesome Open Source

xray - Filter Hex-Rays Decompiler Output

xray is a plugin for the Hexrays decompiler that both filters and colorizes the textual representation of the decompiler's output based on configurable regular expressions.

This helps highlighting interesting code patterns which can be useful in malware analysis and vulnerability identification.

xray animated gif

Installation/Updating:

xray installs or updates itself as a plugin by loading it as a script using the "File->Script file..." (Alt-F7) menu item within IDA.

Running the plugin for the first time creates a default configuration file "xray.cfg" within the folder "%APPDATA%/Hex-Rays/IDA Pro/plugins/", which can and should then be customized by the user.

While still under development, updating from a previous installation of the plugin may introduce changes to the configuration file which may cause incompatibility. If this is the case, the current configuration file should be ported to the new format or deleted.

xray requires IDA 7.2+ (with some effort it may be backported to 7.0).

This IDAPython project is compatible with Python3. For compatibility with older versions of IDA, you may want to check out the Python2 branch of this project.

Usage:

The plugin offers two distinct filtering/highlighting features:

  • "xray", a persistent, configurable regular expression parser that applies color filters to the output of the Hexrays decompiler. This filter can be turned on and off using a keyboard shortcut as described in the next section.

    Persistent filtering attempts to match regular expressions taken from the plugin's configuration file against each of the decompiler's text lines. Successful matches will cause the background color of a matching text line to be changed accordingly. Optionally, changing the "high_contrast" setting to "1" in the configuration file will cause a visual "xray" effect.

    For more settings and details, please refer to the comments in the configuration file.

  • a dynamic filter that filters/highlights Hexrays output. This filter works similar to how the built-in filters for IDA "choosers" work. Possible "filter types" are "Regex" and "ASCII". Additional "filter options" determine how the filters are applied to respective Hexrays output:

    • "Text" removes any lines from the decompiler's output that a specified search term could not be matched against.
    • "Color" does not remove non-matching lines but only their respective color tags instead. This will cause matching text to be highlighted visually.

Popup Menus/Keyboard shortcuts:

  • F3: Toggle xray
  • Ctrl-R: Reload xray configuration file and apply changes (edit and reload the configuration file on-the-fly)
  • Ctrl-F: Find ascii string/regular expression and apply filters based on Filter type and options. "Text": removes any non-matching lines from the outpout "Color": removes colors from non-matching lines

xray3 animated gif

Contact:

Twitter: https://twitter.com/pat0is



Alternative Project Comparisons
Related Awesome Lists
Top Programming Languages
Top Projects

Get A Weekly Email With Trending Projects For These Topics
No Spam. Unsubscribe easily at any time.
Python (795,011
Plugin (113,994
Highlight (8,965
Regular Expression (8,794
Configuration Files (3,493
Ida (1,162
Malware Analysis (647
Decompiler (586
Ida Pro (252
Idapython (184
Bughunting (57
Hexrays (23