05 Mar

IDA StringMiner™

Today, I’ll show off this IDA plug-in I made over a few months last summer.
I ended up with basically an enhanced replacement for IDA Pro’s Strings window that understands many character set encodings (of the multi-byte foreign language kind, other then our ubiquitous friend ASCII), extracts ambiguous UTF-16 strings (real ones, using code pages beyond “ASCII-16″/Latin 1), with some statistical understanding of languages, and wrapped up with some automated web translation to translate the found “foreign” strings into English.

StringMiner™ screenshot:
ID StringMiner™ Example 1
Read More

27 Feb

Updates to my plug-ins, QT work around for segment selector, something new.

IDA plug-in updates:
Over the last month or so I’ve updated a lot of my plug-ins you can find HERE.
Also released the source for Class Informer that people had asking for:
https://sourceforge.net/projects/classinformer/.

IDA Multi-select segment dialog:
I’ve fixed some bugs and made my customized multi-select IDA segment dialog work again.
This where it allows you to select more then one segment, sometimes necessary for some
of my plug-ins, in particular for IDB cases with multiple “.text”, and, or, “.rdata” sections et al.

Here you can select one or more segments using the standard Windows CTRL or Shift Left clicks, etc.
Multi-select segment dialog example
Now in the log output it will show you what segment(s) you selected too, I.E. “Segments selected: ‘.data’, ‘.data’, ‘.rdata’.”
Read More

18 Oct

L.A. Noire PC command line options

Got around to finishing L.A. Noire recently. It’s a huge, fun, and original game with an immersive cinematic feel to it. Also interesting is the story behind it’s development and tech: L.A. Noire – Wikipedia

L.A. Noire Trailer:

I unfortunately had performance problems running it on my machine. Not a bad machine mind you, I can play pretty much everything else fine like Skyrim, etc.
I drudged through several cases until I finally Googled about it finding this official post How to fix poor L.A. Noire PC performance on certain hardware setups, and then some other unofficial ones saying pretty much the same thing.

There is little to no descriptions for these commands. I didn’t want to go around blindly playing with random combinations not knowing what they did.
I took a look in “LANoire.exe” and sure enough there were plenty of strings embedded in it, even better there were even hidden descriptions (albeit slightly outdated) for the commands.
Read More

10 Oct

Bing / Microsoft Translator C++ example

Today I write about the Bing/Microsoft Translator and give you a nice C++ example on how to use the API (using the HTML interface) since there is none to be found elsewhere. You will not find a single C++ example in any of the MS documentation (nor a current complete one any place else on the web). All of the examples are C# and PHP only. It’s understandable after all since it’s easier with these languages/systems due to their native components, but I needed and wanted C/C++.

English “Hello World!” to German translation:
BingTranslate C++ main()

Read More

07 Oct

Adventures in automated World of Tanks hit zone skin mapping

WOT (World of Tanks): WOT Wikipedia
Servers: North America, Europe, Russian

First a bit of teaser. A labeled hit model side view of the German heavy Löwe tank:
Löwe hull #1

If you play WOT you probably know that ideally you want to shoot at an enemy’s vehicle vulnerable spots to do max damage.
It’s kill or be killed. Kill the other tank before they kill you.
And maybe you want to find good cover and be an effective sniper too.
Although it’s not everything to playing WOT well. You need to use effective combat tactics and develop strategies et al.
Read More

24 May

IDA function reference count to comment plug-in

It dawned on me the other day that because of how I think when I do reversing that seeing how many times a function is referenced would be useful information.
If I could just glean this off the screen rather then manually pressing ‘X’ and count summarizing each sub-function while within a function then that might save me a lot of time and energy.

As I am reversing a particular function it’s local functions are probably of more significance then ones that are not.
If I see a count of ‘1’ then I can assume it is local (although this might not be 100% true as there could be some error in my IDB that is missing one or more references).
Otherwise if I see a function with many references then I can make some assumptions about it’s nature too.
Read More

23 May

Updated IDA Pro plugins

I updated my IDA Pro plugins back in March here IDA Plugins.
I made a post on the IDA forum IDA Pro fourm but forgot to note it here until now.

Added a few new features to some like code and or data segment selectors, etc.
The best thing I’ve removed most if not all of the slow string searching (where it was used) and in general did some speed optimizations.
Now several key ones like “Class Informer” and “ExtraPass” are exponentially faster.

For reversing Windows executables I find IMHO two that are pretty much a necessity:
Read More