The x86 Emulator plugin for IDAPro
Description: This project is a
plugin for the IDAPro Disassembler. Its purpose is to allow a
reverse engineer the chance to step through x86 code while reverse
engineering a binary. The plugin can help you step through any
x86 binary from any platform. For Windows binaries, many common library
calls are trapped and emulated by the emulator, allowing for a higher fidelity
emulation.
I find it particularly useful for stepping
through obfuscated code as it automatically reorganizes an IDA
disassembly based on actual code paths.
Beginning with version 1.0.0 the emulator supports Ida's new (Ida >= 6.0) Qt
interface on Windows, Linux, and OS X.
Download:
Download it here: ida-x86emu-1.0.5.tgz
Plugin Binaries only (current build with latest CVS sources: 11 Dec 2010):
Choose your IDA version (NOTE: do not rename the plugin when you download it)
The PGP public key used to sign these binaries may be found HERE.
Sourceforge Project Page
The Soureforge page for this project is here
Updates:
-
12/11/10 - Posted version 1.0.5 - see ChangeLog for changes
-
11/02/10 - Posted version 1.0.4 - see ChangeLog for changes
-
10/19/10 - Posted version 1.0.2 - see ChangeLog for changes
-
10/18/10 - Posted version 1.0.1 - see ChangeLog for changes
-
10/17/10 - Posted version 1.0.0 - see ChangeLog for changes
-
08/21/10 - Posted version 0.9.6.4 - see ChangeLog for changes
-
01/01/10 - Posted version 0.9.6.3 - see ChangeLog for changes
-
11/26/09 - Posted version 0.9.6.2 - see ChangeLog for changes
-
08/24/09 - Posted version 0.9.6.1 - see ChangeLog for changes
-
08/11/09 - Posted version 0.9.6 - see ChangeLog for changes
-
09/07/08 - Posted version 0.9.5 - see ChangeLog for changes
-
11/14/07 - Posted version 0.9.4 - see ChangeLog for changes
-
01/09/06 - Posted version 0.9.1 - see ChangeLog for changes
-
12/06/05 - Posted version 0.8 - see ChangeLog for changes
-
10/16/04 - Posted version 0.5
-
08/02/04 - Blackhat talk on
Obfuscated code analysis with Ida
-
07/09/04 - Posted version 0.4 which includes Windows SEH
-
04/04/04 - Posted version 0.3 which includes heap emulation
-
02/21/04 - Posted my CodeCon04 presentation
-
12/13/03 - Have begun adding basic support for segment registers
Here is what the thing looks like, it is a bit like a debugging control
panel
This project is hosted at SourceForge
