HexraysToolbox - Hexrays Toolbox - Find code patterns within the He

项目说明

HexRays Toolbox

HexRays Toolbox (hxtb) is a powerful set of IDAPython scripts that can be used to find and locate code patterns in binaries, independent from their underlying processor architecture.

Use Cases

scan binary files for and

locate code patterns from pre reverse engineered executables in newly decompiled code

malware analysis

find code similarities across several binaries (i.e. for proving "code theft", license , ...)

find code patterns from binaries compiled for architecture A in binaries compiled for architecture B

probably a lot more...

The query illustrated by the animation below is an example for how a that affected WhatsApp for Android (C, libwhatsapp.so) can be located using HexRays Toolbox. This is done by formulating a desired code pattern that is to be located using an IDAPython lambda function. Find the example script !here.

!toolbox animated gif

Requirements

A valid IDA license and a valid HexRays decompiler license per target architecture is required.

Usage

There are several ways of using Hexrays Toolbox, each with a degree of flexibility.

run queries on behalf of hxtb_shell, an interactive GUI

custom IDAPython scripting

, a script that adds con functions to be used with the IDA command line interface

, a script that processes and runs hxtb queries on a given set of files in batch mode

hxtb-shell

Executing the included script from within IDA opens a GUI window that can be used to develop, load and run hxtb queries. The screenshot below shows what a query loaded with hxtb-shell may look like.

!hxtb shell

hxtb-shell also accepts Python expressions that are created by the HRDe plugin's context . They can be copied from it and directly pasted into the hxtb-shell GUI.

!HRDe context

___

Further example queries that can be loaded with hxtb-shell can be found in the sub-folder included with HexRays Toolbox.

Scripting

Loading with IDA (Alt-F7) makes functions such as and a to both the IDAPython CLI and the script interpreter (Shift-F2). Among others, these functions can be used to run queries on the currently loaded IDA database. Please check out some of the examples shown below.

Examples

List expressions that compare anything to zero ("x == 0")

List (direct) function calls

!list of calls

List memcpy calls where "dst" argument is on stack

List calls to sprintf(str, fmt, ...) where fmt contains "%s"

Show all instructions using signed operators in a list view

!list of signed operators

Show all "if" statements in a list view

!list of if statements

Find all loop statements within current db, display result in a list view

!list of loops

Show potential memory copy operations in a list view

!list of copy loops

项目信息

开发语言：Python

Star 数：483

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Hexrays Toolbox - Find code patterns within the Hexrays ctree展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。