Tool
HexRays Toolbox
IDAPython scripts that find code patterns in Hex-Rays decompiler output, independent of the binary's processor architecture, by running user-written lambda queries over the decompiled ctree. Queries run from the hxtb-shell GUI inside IDA, from IDAPython through functions such as find_expr() and find_item(), from interactive command-line helpers or in batch mode over a set of files. The README's use cases include finding vulnerabilities and their variants, locating code patterns from previously reversed executables in newly decompiled code, malware variant analysis and finding patterns across binaries built for different architectures.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: Needs a valid IDA license and a valid Hex-Rays decompiler license for each target architecture. The repository has no releases; the reviewed master commit dates from 2023-06-20.
- Scope: Example queries for hxtb-shell are in the hxtbshell_queries folder, and the shell also accepts Python expressions copied from the context viewer of the separate HRDevHelper plugin.
- License: CC0-1.0 per LICENSE.
About this entry
The description was reviewed against primary sources.
Primary sources
- Readme.md GitHub · patois/HexraysToolbox · Revision d04869a
- hxtb.py GitHub · patois/HexraysToolbox · Revision d04869a
- hxtbshell_queries GitHub · patois/HexraysToolbox · Revision d04869a
- LICENSE GitHub · patois/HexraysToolbox · Revision d04869a
More in Native binaries
- Virtuailor · Tool
- xAnalyzer · Tool
- Voltron · Tool
- Remill · Tool
- iaito · Tool
- HexRaysCodeXplorer · Tool