ida-cyberchef - A Qt-based CyberChef interface designed for malwar

项目说明

IDA CyberChef

A Qt-based CyberChef interface designed for malware analysis workflows in IDA Pro. This brings the power of CyberChef's data transformation operations directly into your reverse engineering toolkit.

Install it ' IDA Pro plugin manager:

HCLI is the official Hex-Rays tool for managing IDA Pro installations, licenses, and SDKs.

!ida-cyberchef screenshot

What is this?

If you've ever been knee-deep in a malware sample and needed to quickly decode some base64, XOR a blob with a key, or chain together a series of transformations on binary data - you know the pain of context switching. Copy data from IDA, paste into CyberChef web UI, get result, copy back. Repeat 47 times.

This project eliminates that workflow. It embeds CyberChef's data transforms directly into IDA Pro's Qt user interface, integrating with common IDA features, like reading the current cursor/selection, settings comments, and patching bytes.

How it works

We use PythonMonkey (SpiderMonkey, Firefox's JS engine) to run CyberChef's Ja code inside Python. The ida_cyberchef.cyberchef module loads CyberChef's bundle, sets up polyfills for browser/Node.js APIs it expects, and exposes a clean bake() function that takes binary data and a recipe.

Then, we have a PySide6 Qt widget that exposes the recipe composer with the input/output hex dumps. The UI updates reactively - change the input or tweak an operation argument, and after a brief debounce, the entire pipeline re-executes and updates the output.

As a minor extension beyond traditional CyberChef, each operation step can be expanded to preview intermediate results, which might be useful for debugging complex recipes.

Background

This started as an experiment to see if CyberChef could be embedded in Python without needing a browser or Electron. The GCHQ team built CyberChef as a web application, but they also exposed a Node.js API. We're using a minimal CommonJS-compatible build (from Willi Ballenthin's fork) that doesn't require the full Node.js runtime.

The project went through a few iterations:
1. First, just getting the Ja engine to work with proper type con between Python bytes and CyberChef's "Dish" objects
2. Then building a clean bake() API that chains operations
3. Then the Qt layer with reacti

There's also a standalone (non-IDA Pro) Qt application for running CyberChef on the desktop; but really, I'm not sure why you'd use this the standalone HTML file from upstream.

Runtime support

The runtime supports local, deterministic operation execution. It has no browser tab, DOM, worker, or network dependency, and does not fetch external assets at runtime. The bridge applies compatibility fixes for CyberChef's Node-targeted bundle, including argument normalization and runtime polyfills. Most offline CyberChef operations work out of the box.

Excluded operations: Ja Beautify/Minify/Parser, Syntax highlighter, DNS o, HTTP request, Optical Character Recognition, and Add Text To Image. The Ja formatting operations are excluded by the Node-targeted CyberChef bundle. The network operations require browser-style request APIs. The OCR and image-text operations require browser-style workers or asset loading that this project does not provide.

Magic, YARA Rules, Argon2, and Argon2 compare are also excluded. Some operations (Caret/M-decode, Convert co-ordinate format, Fletcher-16/32/64 Checksum, HAS-160, Parse X.509 CRL, Public Key from Certificate, Public Key from Private Key) are missing from the CyberChef build entirely. Generated operation docs in docs/ops.md annotate these directly.

Supported Python

PythonMonkey's prebuilt wheels reach into CPython internal structures, so the plugin is sensitive to the exact Python that IDA Pro uses. PythonMonkey 1.3.2 works on Python 3.10-3.12 and 3.13.13+, but misreads those structures on 3.13.0-3.13.12 and 3.14.0, breaking all recipe execution. On an unsupported interpreter, the plugin logs a warning and disables itself at load time. The fix is to upgrade the Python installation that IDA uses (for example, to 3.13.13 or later).

Building

First, initialize the submodule if you haven't already:

Then build CyberChef's Ja bundle (you'll need Node.js for this):

This installs npm dependencies in the CyberChef submodule, runs the Node.js build (takes about 40 seconds), and copies the resulting bundle to ida_cyberchef/data/CyberChef.js. That's the ~20MB file the Python code loads at runtime.

To run the plugin in IDA, symlink the de directory into $IDAUSR/plugins/ida-cyberchef:

You'll also want to install the dependencies into your IDA Pro Python en, something like:

Also, you can run the standalone QApplication (outside of IDA Pro) like this:

Future Work

I'm not quite sure if this will survive or not - I started out to prove this could work, and then was surprised when things fell into place. The architecture is a little ugly: running SpiderMonkey from Python inside IDA to load a huge blob from GCHQ. But, it works, and we benefit from the operations already supported by CyberChef. So, if you want to propose enhancements and bug fixes, go for it!

There's some risk that the underlying Ja engine (PythonMonkey now; STPyV8 pre, until it was archived in 2026) might become unmaintained or not build/work with future of Python or IDA Pro. That'll be a good time to re-e the best parts of ida-cyberchef and perhaps rebuild them carefully.

License

This project's code is licensed Apache 2.0 by Hex-Rays. CyberChef itself is also licensed under Apache 2.0 by GCHQ.

项目信息

开发语言：Python

Star 数：195

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A Qt-based CyberChef interface designed for malware analysis workflows, particularly in IDA Pro展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。