IdaClu - IdaClu is a version agnostic IDA Pro plugin for gr

项目说明

IdaClu

*IdaClu* is an *IDA Pro* plugin with a straightforward 3-step loop pipeline:

1. Find similarities in functions;
2. Label grouped functions in bulk;
3. Repeat step 1 for labeled functions.

The distincti of the plugin lies in *"how"* of search and labeling.

*IdaClu* won *1st* place in *the Hex-Rays Plugin Contest 2023* !

!shot

The Purpose

In addition to the plugin ecosystem, the *IDA* user community creates a wealth of incredible scripts, in complexity. Some could greatly benefit from standardized input/output data format and *GUI*-interface. However, due to time constraints, the relati of learning *PyQt/PySide*, and the challenge of na several backward-incompatible of the *IDAPython API* many community members are unable to support these efforts. As a result, even the best of us sometimes resort to parsing custom data formats from text files or *output window* of *IDA*.

*IdaClu* serves as a *tree/table view* for *IDAPython* scripts.
Pro the following features:

labeling the functions with any combination of *prefix-folder-color*

filtering the input/output

using the progress bar indicator

using the output of other scripts

pro the output to other scripts

*IDAPython*-scripts serve as *sub-plugins* for *IdaClu* if they follow several con of how the script should be structured. One core intention is to minimize this impact.

*The plugin* comes with a set of *x18* simplistic and handy scripts a out of the box. They form the basis and make *IdaClu* useful as a standalone tool. So support of the community is not a "must".

Standard Scripts

Scripts are grouped, and while most names are self-explanatory, some may need explanations:

Xref Analysis

- Xref Count - *group by code-xref count*
- Xref Source - *groups: leaf functions, functions with only explicit calls, functions with calls*
- Xref Destination - *groups: independent functions, , library called functions*

Constant Analysis

- Common Constants - *group by constants being referenced*
- String Refs - *group by string refs*
- Global Analysis - *group by refs of defined names*
- Lib Usage Analysis - *group by library function calls*
- API Usage Analysis - *group by API-function calls*

Control Flow

- Control Flow Analysis - *groups: loop-containing funcs, switch-case funcs, recursi*
- Pseudocode Size - *group by pseudocode line count*

Code Co

- DynamoRIO Functions - *groups: touched/untouched functions*

Function Similarity

- SSDEEP Similarity - *groups: similar function clusters with ssdeep*
- TLSH Similarity - *groups: similar function clusters with tlsh*

Functions

- Explicit Calls - *group by function call with arguments shown in comments*
- Implicit Calls - *group by call with arguments shown in comments*

Filter Analysis

- Distinct Folders - *group by folder path*
- Distinct Prefixes - *group by prefix name*
- Distinct Colors - *group by highlight color*

User Interface

!ui
The user interface intentionally follows *Miller's Law* in *UX* - "The immediate memory span of people is limited to approximately se, plus or minus two."
Here's the breakdown of the main widgets:

1. *Toolkit* - scrollable area with buttons for recognized *IDAPython* scripts
2. *View* - table-based view for script output, function selection, and rendering current labels
3. *Filters* - input controls to refine the chosen script's focus
4. *Labels* - name of *prefix* or *folder* for selected functions
- *R* - toggle button for recursive mode
- *PREFIX* - interacti to switch between *FOLDER* and *PREFIX* labeling modes
- *ADD* - button that applies labeling settings
- *CLEAR* - button that clears labeling settings
5. *Palette* - a set of 5 mutually exclusi highlighting buttons

Tips

1. *IdaClu* aims to incorporate new features from new *IDA*- while maintaining ** approach. The solution is *graceful degradation*. So the *UI* will adapt to older *IDA* , excluding unsupported features.
2. Double-clicking any row in the tree view na to the corresponding function in *IDA*
3. The *filter* widget toggles collapse with a header click.
4. The *toolkit* widget header click swaps *tree-view* and *sidebar* with places.
5. *Rename* context-menu allows to make custom changes in the selected function name.

Setup

*IdaClu* is an *IDAPython* plugin without external package dependencies. No building is required. It can be installed by downloading the repository and copying file *idaclu.py* and folder *idaclu* to your *IDA Pro* plugin directory *(either-or)*:

*C:\Program Files\IDA Pro \<IDA_\>\plugins*

*C:\Users\\<USER_NAME\>\AppData\Roaming\Hex-Rays\IDA Pro\plugins*

While the plugin itself doesn't need external packages, some *sub-plugin scripts* might. This won't prevent the plugin from running, but it will gray out the corresponding buttons with an informati - what's missing.

!miss

Follow these instructions if you need these *sub-plugin scripts*:

*py-tlsh*

*ssdeep*

*yara-python*

Hint

For continuous updates, clone the repository with *Git* and create a *symlink* in the *IDA* plugin folder:

#### Windows

#### Mac

Script Ecosystem

The plugin serves as a *GUI* for scripts without one. By following scripting con, you can make them compatible with *IdaClu*. When done correctly, a corresponding button will appear in the *sidebar*.

Script Description

The following block is mandatory and is used to register the script in *IdaClu*:

Main Function

In addition to this, each script must define a single get_data() function.
Currently there are *x2* possible prototypes:

Execution En

If the script logic depends on a specific IDA configuration, the *IdaClu* plugin can offer the following properties in the *en* object:

Before script execution, these fields are guaranteed to be initialized.
You can refer to the full list in the *output window* of *IDA*. Right under the *banner* there will be *EN* section with the dump of current .

Custom Input

As an experimental feature, *the plugin* supports custom input for each script.
When defined, the following code will render the input field under the script button upon the first click:

The second click sends this data to the target script, accessible via the *plug_params* parameter of the *get_data()* function:

Return Value

For hierarchical output data, the script should return *dictionary of lists*.
*Keys* of this dictionary are function group names - collapsible elements of *tree view*.
*Vals* of this dictionary are *either-or*:

list of function addresses (simple case)

list of tuples (<function_address>, <comment>) (ad case)

Remarks

However the rest is up to the author of the certain script,
there are several optional tips:

1. Each script should be assigned to a certain script group. A script group is essentially a folder - *plugins/idaclu/plugins/\<plugin_group_folder\>/* containing an *\_\_init\_\_.py* file with a single string:

2. For *IDAPython* cross-compatibility consider using bundled shims module:

3. If the script utilizes *func-generator* consider employing the following code for debugging and running the script e the *IdaClu* en:

In case anything is left uncovered in this *README*, refer to example scripts or contact the *IdaClu* author.

Compatibility

Recommended specs: *IDA Pro v8.2+* with *Python v3.x*.
Minimum specs: *IDA Pro v6.7+* with *Python v2.7+*.

Test en:

1. *IDA Pro v6.7 + Windows 7*
2. *IDA Pro v7.7 + Windows 10*
3. *IDA Pro v8.2 + Windows 11*
4. *IDA Pro v7.0, MacOS High Sierra v10.13.6*
5. *IDA Pro v7.6, MacOS v13.2.1*

Other *IDA* can be added as test en upon request.
To be cross-compatible *IdaClu* relies on *PyQt* and *IdaPython* shims.
Scripts bundled with *IdaClu* currently are *PE-first* and *Intel x86/x64-first* due to the author's work specifics.

Upcoming Changes

table view for the scripts that output non-hierarchical data

several types of controls to provide input to scripts

lots of code optimizations

sort data in columns by clicking the column headers for tree/table view

a more flexible API for the scripts

more detailed IDA en detection

helper context menus for native IDA widgets

filter refresh if changes to .idb were made outside the plugin

grayed out narrow folder filters if they are subsumed by broader ones

"save to file" option for the current view

time estimation for large binaries

caption of the processing phase in *UI*

breakpoint setting feature

count of functions currently selected

folder labels with hierarchy

button to clear all labels at once

Feel free to come up with your ideas/proposals.
They will be carefully considered and their implementation is highly likely to be included in upcoming plugin releases.

Known bugs

Minor issues with cross-compatibility

Comment column remains unhidden with empty comments

Some bundled plugins produce quite dirty output:

- *Global Analysis*

Some scripts and their corresponding groups do not match

Experimental "Code Co" plugin fails to load

Explicit folder filtering with "/" as a parameter does not work as expected

Labels are still present in filters after being removed from .idb

In recursive mode, the function can be prefixed multiple times

Recursive mode is not considered while highlighting with color

Acknowledgements

*Caroline 'By0ute' Beyne* for the simplistic *PoC of collapsible PyQt widget*

*Markus 'gaasedelen' Gaasedelen* for *DrCov file format parser*

*Willi Ballenthin* of *Mandiant* for *PoC of PyQt-shim script* to support both *PySide (IDA <v6.9)* and *PyQt (IDA >=v6.9)*

Guys from *Gray Hat Academy* for *PoC of IDAPython-shim script* to support *v6.x-v7.x* of *IDAPython API*

*mr.d0x* for the original idea of *Windows API* classification demonstrated on *MalAPI.io*

History

*2024-04-2x* - ChatGPT sub-plugins *(UPCOMING)*

*2024-03-2x* - /RTTI related sub-plugins *(UPCOMING)*

*2024-03-09* - Release of upgraded *v1.1*

*2023-12-09* - Obfuscation detection sub-plugins

*2023-12-01* - Release of more stable *v1.0*

*2023-09-14* - The original release of *IdaClu* *v0.9*!

项目信息

开发语言：Python

Star 数：186

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕IdaClu is a version agnostic IDA Pro plugin for grouping similar functions. Pick an existing grouping algorithm or create your own.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。