{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/README.md#L13-L15",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/README.md#L112-L150",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/doc/decr.md",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/doc/appcall.md",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/doc/deob.md",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/doc/msig.md",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/.github/workflows/build.yml",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/ida-plugin.json",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/CHANGELOG.md",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/NOTICE.txt",
    "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/COPYING",
    "https://github.com/KasperskyLab/hrtng/releases/tag/v3.9.114",
    "https://securelist.com/hrtng-ida-pro-plugin/114780/"
  ],
  "category": "native-analysis",
  "description_en": "IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. It decrypts strings, data and constants with built-in ciphers or in bulk through IDA's Appcall debugger feature, resolves API-name hashes, unflattens control flow and forces decompilation of obfuscated code, and recognizes library code through microcode signatures, inlined-function detection and PAT files built from an IDA database. Pseudocode helpers cover automatic renaming, retyping and enum substitution, structure creation, virtual and indirect call navigation, and patching.",
  "description_zh": "Kaspersky 发布的 IDA 插件，为 Hex-Rays 反编译器加入了作者在包括恶意软件分析在内的逆向工作中积累的各类工具。它可用内置密码算法解密字符串、数据和常量，或借助 IDA 的 Appcall 调试器功能批量解密；还能识别 API 名称哈希、消除控制流平坦化并强制反编译混淆代码，并通过微码签名、内联函数检测和从 IDA 数据库生成的 PAT 文件识别库代码。伪代码辅助功能包括自动重命名、类型修改和枚举替换、结构体创建、虚函数与间接调用导航以及补丁。",
  "entry_url": "https://awesomerea.org/resources/hrtng/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/hrtng/",
  "evidence_url": "https://github.com/KasperskyLab/hrtng/blob/2c7b78e5772cc8728d8b450fd5a87cb226a683fb/README.md",
  "group": "tools",
  "id": "hrtng",
  "json_url": "https://awesomerea.org/resources/hrtng/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/hrtng/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/hrtng/index.md",
  "name": "hrtng",
  "name_zh": "hrtng IDA 反编译增强插件",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Requires IDA with the Hex-Rays decompiler. The README supports only the latest IDA version; the plugin can still be compiled against IDA SDK 7.3 or later, but new features are usually not well tested on older versions. Latest release at review: v3.9.114, published 2026-09-02, with prebuilt archives for IDA 9.2, 9.3 and 9.4 plus a separate 7z archive; the reviewed master commit is one changelog fix ahead and declares 3.9.115 in ida-plugin.json.",
    "The CI workflow builds Linux x64, macOS (Apple silicon and Intel) and Windows x64 binaries, and Linux ARM for IDA 9.3 and 9.4. Source builds use CMake with the Crypto++ CMake submodule and an IDA SDK whose path and version are set in src/CMakeLists.txt; the README gives manual SDK fixes for 8.5 and 9.1. The apilist.txt and literal.txt files from bin/plugins must sit beside the plugin for API-hash scanning and enum substitution.",
    "Samples and IDA databases come from the analyst. The Appcall engine for mass decryption runs the analyzed program's own decryption routine under the selected IDA debugger, and its documentation reports testing only with the imul emulator and IDA's Remote Windows debugger. Obfuscated-code decompilation and inline detection are described as experimental.",
    "GPL-3.0. NOTICE.txt lists bundled third-party code and its licenses, including Crypto++ 8.9.0 under the Boost Software License 1.0, used for ciphers such as RC4, AES and ChaCha20, and MIT-licensed GraphSlick and microavx code."
  ],
  "requirements_zh": [
    "需要带 Hex-Rays 反编译器的 IDA。README 称只支持最新的 IDA 版本；插件仍可针对 IDA SDK 7.3 及以上版本编译，但新功能通常未在旧版本上充分测试。审阅时最新版本为 v3.9.114，发布于 2026-09-02，提供适用于 IDA 9.2、9.3 和 9.4 的预编译压缩包，另附一个 7z 压缩包；所审阅的 master 提交比该版本多一个更新日志中的修复，并在 ida-plugin.json 中声明版本 3.9.115。",
    "CI 工作流构建 Linux x64、macOS（Apple 芯片和 Intel）和 Windows x64 二进制，并为 IDA 9.3 和 9.4 构建 Linux ARM 版本。从源码构建需使用 CMake、Crypto++ CMake 子模块和 IDA SDK，SDK 路径与版本在 src/CMakeLists.txt 中设置；README 给出了 SDK 8.5 和 9.1 需要手动修正的内容。API 哈希扫描和枚举替换需要把 bin/plugins 中的 apilist.txt 和 literal.txt 放在插件旁边。",
    "样本和 IDA 数据库由分析人员自行提供。批量解密的 Appcall 引擎会在所选 IDA 调试器中运行被分析程序自身的解密函数，其文档称仅用 imul 模拟器和 IDA 的 Remote Windows 调试器测试过。混淆代码反编译和内联检测被标为实验性功能。",
    "采用 GPL-3.0 许可。NOTICE.txt 列出了随附的第三方代码及其许可证，其中包括采用 Boost Software License 1.0 的 Crypto++ 8.9.0（用于 RC4、AES、ChaCha20 等密码算法），以及采用 MIT 许可的 GraphSlick 和 microavx 代码。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/KasperskyLab/hrtng",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}