{ "added_at": "2026-11-02", "additional_evidence_urls": [ "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/Android/README.md", "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/define_code_functions.py", "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/find_mem_accesses.py", "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/identify_port_use_locations.py", "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/define_data_as_types.py", "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/Android/jni_translate.py", "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/Android/WeddingCake_decrypt.py", "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/tree/3cf0346f93eb3c009f4bf274c91bd00398a56d77/presentations", "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/LICENSE" ], "category": "firmware", "description_en": "Maddie Stone's IDAPython scripts for triaging and annotating embedded-device firmware images in IDA Pro, presented at RECON Montreal and DerbyCon in 2017. Triage scripts define code and functions from per-architecture prologue and epilogue patterns, mark address ranges as bytes, words or double words and turn unexplored bytes into strings; analysis scripts resolve memory accesses made at offsets from a known base value and add cross-references and value comments, and annotation scripts list CPU port (GPIO) use, tag functions without cross-references as possible dead code and trace where an operand is used. An Android folder adds a script that comments JNIEnv function calls in native libraries and one that decrypts the strings of ARM32 libraries packed with the WeddingCake anti-analysis wrapper.", "description_zh": "Maddie Stone 编写的 IDAPython 脚本集，用于在 IDA Pro 中对嵌入式设备固件镜像进行初步梳理和标注，曾于 2017 年在 RECON Montreal 和 DerbyCon 上介绍。梳理类脚本依据各架构的函数序言和尾声模式定义代码与函数，把地址范围标记为字节、字或双字，并把未探索的字节转换为字符串；分析类脚本根据已知基址解析以偏移方式进行的内存访问，并添加交叉引用和数值注释；标注类脚本列出 CPU 端口（GPIO）的使用位置，把没有交叉引用的函数标为可能的死代码，并追踪某个操作数的使用位置。Android 文件夹另有一个为原生库中的 JNIEnv 函数调用添加注释的脚本，以及一个解密经 WeddingCake 反分析外壳打包的 ARM32 库中字符串的脚本。", "entry_url": "https://awesomerea.org/resources/idapython-embedded-toolkit/", "entry_url_zh": "https://awesomerea.org/zh/resources/idapython-embedded-toolkit/", "evidence_url": "https://github.com/maddiestone/IDAPythonEmbeddedToolkit/blob/3cf0346f93eb3c009f4bf274c91bd00398a56d77/README.md", "group": "tools", "id": "idapython-embedded-toolkit", "json_url": "https://awesomerea.org/resources/idapython-embedded-toolkit/record.json", "kind": "tool", "markdown_url": "https://awesomerea.org/resources/idapython-embedded-toolkit/index.md", "markdown_url_zh": "https://awesomerea.org/zh/resources/idapython-embedded-toolkit/index.md", "name": "IDAPython Embedded Toolkit", "name_zh": "IDAPython Embedded Toolkit 嵌入式固件分析脚本集", "record_type": "resource", "relationship": "foundation", "requirements": [ "Ten Python scripts and the slides of the two 2017 talks as PDFs, with no releases or tags; the reviewed master commit, from 2019-08-14, is the latest. The README says the scripts have only been tested on IDA Pro 6.95, with IDA 7.0 testing in progress, and runs each one separately through File > Script file in an open IDA database with IDAPython. Most use Python 2 print statements and pre-7.0 IDC calls such as MakeCode, MakeComm, MakeStr and AskAddr; jni_translate.py, added in 2019, uses Python 3-compatible print calls but still calls idc.MakeComm.", "The user supplies the firmware image or Android native library and its IDA database, and enters address ranges, regular expressions or base values at prompts or in each script's user-defined section. Processor-specific syntax is chosen from IDA's processor name: define_code_functions.py covers 8051, PIC18, Mitsubishi M32R, TI TMS320C28x and AVR, and find_mem_accesses.py only 8051, while identify_port_use_locations.py ships one active PIC18 pattern with commented 8051 alternatives. Unsupported processors stop with an error until the analyst adds patterns, and find_mem_accesses.py cannot create references into segments that do not yet exist.", "Several scripts rewrite the database: define_data_as_types.py first undefines the range, overwriting code or strings there, and WeddingCake_decrypt.py overwrites encrypted strings with their decrypted contents and needs JNI_OnLoad defined and exported. The WeddingCake files accompany Maddie Stone's Black Hat USA 2018 talk on that packer.", "MIT, copyright 2017 Maddie Stone, in LICENSE; the README's copyright notice instead names The Johns Hopkins University Applied Physics Laboratory, and the Android README and WeddingCake script carry a Google LLC 2018 copyright line without separate license terms." ], "requirements_zh": [ "包含十个 Python 脚本以及两场 2017 年演讲的 PDF 幻灯片，没有发布版本或标签；所审阅的 master 提交日期为 2019-08-14，也是最新提交。README 称这些脚本只在 IDA Pro 6.95 上测试过，IDA 7.0 的测试仍在进行；每个脚本需在已打开且带 IDAPython 的 IDA 数据库中通过 File > Script file 单独运行。多数脚本使用 Python 2 的 print 语句和 7.0 之前的 IDC 调用，例如 MakeCode、MakeComm、MakeStr 和 AskAddr；2019 年加入的 jni_translate.py 使用兼容 Python 3 的 print 调用，但仍调用 idc.MakeComm。", "固件镜像或 Android 原生库及其 IDA 数据库由使用者提供，地址范围、正则表达式或基址需在提示框中或各脚本的用户自定义部分填写。处理器相关的语法依据 IDA 的处理器名称选择：define_code_functions.py 支持 8051、PIC18、三菱 M32R、TI TMS320C28x 和 AVR，find_mem_accesses.py 只支持 8051，identify_port_use_locations.py 则只启用一条 PIC18 模式，另以注释形式给出 8051 的备选模式。遇到不支持的处理器时脚本会报错退出，需分析人员自行补充模式；find_mem_accesses.py 也无法为尚未创建的段建立引用。", "部分脚本会改写数据库：define_data_as_types.py 会先取消该范围内的已有定义，覆盖其中的代码或字符串；WeddingCake_decrypt.py 会用解密后的内容覆盖加密字符串，并要求 JNI_OnLoad 已被定义和导出。WeddingCake 相关文件配合 Maddie Stone 在 Black Hat USA 2018 上关于该加壳工具的演讲。", "LICENSE 采用 MIT 许可，版权归 Maddie Stone（2017）；README 中的版权声明则写的是约翰斯·霍普金斯大学应用物理实验室，Android 文件夹的 README 和 WeddingCake 脚本另有 Google LLC 2018 的版权声明，但未给出单独的许可条款。" ], "targets": [ "app", "firmware" ], "url": "https://github.com/maddiestone/IDAPythonEmbeddedToolkit", "verification": "source-reviewed", "verified_at": "2026-10-20" }