CodeDoctor 0.90 (IDA Edition) - IDA Plugin by hnedka (12.11.2009)
History:
0.90 (12.11.2009) - initial public release
note: examples are from OllyDbg, but they work exactly the same way in IDA
________________________________________________________________________________
Functions:
1) Deobfuscate
Select instructions in disasm window and execute this command. It will try
to clear the code from junk instructions.
Example:
Original:
00874372 57 PUSH EDI
00874373 BF 352AAF6A MOV EDI,6AAF2A35
00874378 81E7 0D152A41 AND EDI,412A150D
0087437E 81F7 01002A40 XOR EDI,402A0001
00874384 01FB ADD EBX,EDI
00874386 5F POP EDI
Deobfuscated:
00874372 83C3 04 ADD EBX,4
________________________________________________________
2) Deobfuscate - Single Step
This works like previous command, but does one transformation at a time
_______________________________________________________
3) Move NOPs to bottom
Converts this:
00874396 50 PUSH EAX
00874397 90 NOP
00874398 90 NOP
00874399 52 PUSH EDX
0087439A BA 3F976B00 MOV EDX,somesoft.006B973F
0087439F 90 NOP
008743A0 90 NOP
008743A1 90 NOP
to this:
00874396 50 PUSH EAX
00874397 52 PUSH EDX
00874398 BA 3F976B00 MOV EDX,somesoft.006B973F
0087439D 90 NOP
0087439E 90 NOP
0087439F 90 NOP
008743A0 90 NOP
008743A1 90 NOP
Limitations: it breaks all jumps and calls pointing inwards
________________________________________________________
4) Undo / Redo
Undo or Redo last operation (from one of the above functions)
________________________________________________________
发表于 2009-11-16 16:11
发表于 2009-11-16 17:11
