IdaClu

1. 1. Find similarities in functions;
2. 2. Label grouped functions in bulk;
3. 3. Repeat step 1 for labeled functions.

The Purpose

• labeling the functions with any combination of prefix-folder-color
• filtering the input/output
• using the progress bar indicator
• using the output of other scripts
• providing the output to other scripts

Standard Scripts

• Xref Analysis
  • Xref Count - group by code-xref count
  • Xref Source - groups: leaf functions, functions with only explicit calls, functions with virtual calls
  • Xref Destination - groups: independent functions, VFT-functions, library called functions
• Constant Analysis
  • Common Constants - group by constants being referenced
  • String Refs - group by string refs
  • Global Variable Analysis - group by refs of defined names
  • Lib Usage Analysis - group by library function calls
  • API Usage Analysis - group by API-function calls
• Control Flow
  • Control Flow Analysis - groups: loop-containing funcs, switch-case funcs, recursive funcs
  • Pseudocode Size - group by pseudocode line count
• Code Coverage
  • DynamoRIO Functions - groups: touched/untouched functions
• Function Similarity
  • SSDEEP Similarity - groups: similar function clusters with ssdeep
  • TLSH Similarity - groups: similar function clusters with tlsh
• Virtual Functions
  • Explicit Calls - group by function call with arguments shown in comments
  • Implicit Calls - group by VFT-function call with arguments shown in comments
• Filter Analysis
  • Distinct Folders - group by folder path
  • Distinct Prefixes - group by prefix name
  • Distinct Colors - group by highlight color

User Interface

1. 1. Toolkit - scrollable area with buttons for recognized IDAPython scripts
2. 2. View - table-based view for script output, function selection, and rendering current labels
3. 3. Filters - input controls to refine the chosen script's focus
4. 4. Labels - name of prefix or folder for selected functions
5.    - R - toggle button for recursive mode
6.    - PREFIX - interactive label to switch between FOLDER and PREFIX labeling modes
7.    - ADD - button that applies labeling settings
8.    - CLEAR - button that clears labeling settings
9. 5. Palette - a set of 5 mutually exclusive color highlighting buttons

Tips

1. 1. IdaClu aims to incorporate new features from new IDA-versions while maintaining version-agnostic approach.
   1. The solution is graceful degradation. So the UI will adapt to older IDA versions, excluding unsupported features.
2. 2. Double-clicking any row in the tree view navigates to the corresponding function in IDA
3. 3. The filter widget toggles collapse with a header click.
4. 4. The toolkit widget header click swaps tree-view and sidebar with places.
5. 5. Rename context-menu allows to make cutom changes in the selected function name.

Setup

• C:\Program Files\IDA Pro \plugins
• C:\Users\\AppData\Roaming\Hex-Rays\IDA Pro\plugins

> pip install py-tlsh
# do not: pip install ssdeep
> git clone https://github.com/MacDue/ssdeep-windows-32_64
> cd ssdeep-windows-32_64-master
> python setup.py install

Hint

Windows

:: C:\Users\\AppData\Roaming\Hex-Rays\IDA Pro\plugins\idaclu.py
> mklink "C:\Program Files\IDA Pro X.X\plugins\idaclu.py" \idaclu.py
:: C:\Users\\AppData\Roaming\Hex-Rays\IDA Pro\plugins\idaclu
> mklink /d "C:\Program Files\IDA Pro X.X\plugins\idaclu" \idaclu

Mac

% ln -s \idaclu.py /Users//.idapro/plugins/idaclu.py
% ln -s \idaclu /Users//.idapro/plugins/idaclu

Script Ecosystem

Script Description

SCRIPT_NAME = 'Xref Count'  # arbitrary name that will appear on the corresponding button
SCRIPT_TYPE = 'func'  # 'func' or 'custom' depending on whether the script iterates on functions or some other data structures to produce the output
SCRIPT_VIEW = 'tree'  # 'tree' is the only currently supported view, 'table' is to be added
SCRIPT_ARGS = []  # experimental feature, supports tuples of the form ('', '', '')

Main Function

# Case #1: SCRIPT_TYPE == 'func':
def get_data(func_gen=None, env_desc=None, plug_params=None):
    # 1. Iterate over pre-filtered functions via func_gen() generator
    # 2. Progress bar values are calculated automatically

# Case #2: SCRIPT_TYPE == 'custom':
def get_data(progress_callback=None, env_desc=None, plug_params=None):
    # 1. Iterate over custom data structures
    # 2. Use `progress_callback(, )` to report current progress

Execution Environment

- feat_bookmarks
- feat_cpp_oop
- feat_folders
- feat_golang
- feat_ida6
- feat_ioi64
- feat_lumina
- feat_microcode
- feat_microcode_new
- feat_python3
- feat_undo
  ...

Custom Input

SCRIPT_ARGS = [('file_path', 'file', 'input the file path')]

plug_params['']

Return Value

• list of function addresses (simple case)
• list of tuples (,) (advanced case)

Remarks

1. 1. Each script should be assigned to a certain script group. A script group is essentially a folder - plugins/idaclu/plugins// containing an __init__.py file with a single string:

    PLUGIN_GROUP_NAME = ''

1. 2. For IDAPython cross-compatibility consider using bundled shims module:

    from idaclu import ida_shims

1. 3. If the script utilizes func-generator consider employing the following code for debugging and running the script even outside the IdaClu environment:

    def debug():
        data_obj = get_data(func_gen=idautils.Functions)
        ida_shims.msg(json.dumps(data_obj, indent=4))
    if __name__ == '__main__':
        debug()

Compatibility

1. 1. IDA Pro v6.7 + Windows 7
2. 2. IDA Pro v7.7 + Windows 10
3. 3. IDA Pro v8.2 + Windows 11
4. 4. IDA Pro v7.0, MacOS High Sierra v10.13.6
5. 5. IDA Pro v7.6, MacOS Ventura v13.2.1

Upcoming Changes

• table view for the scripts that output non-hierarchical data
• several types of controls to provide input to scripts
• lots of code optimizations
• sort data in columns by clicking the column headers for tree/table view
• a more flexible API for the scripts
• more detailed IDA environment detection
• helper context menus for native IDA widgets
• filter refresh if changes to .idb were made outside the plugin
• grayed out narrow folder filters if they are subsumed by broader ones
• "save to file" option for the current view
• time estimation for large binaries
• caption of the processing phase in UI
• breakpoint setting feature
• count of functions currently selected
• folder labels with hierarchy
• button to clear all labels at once

Known bugs

• Minor issues with cross-compatibility
• Comment column remains unhidden with empty comments
• Some bundled plugins produce quite dirty output:
  • Global Variable Analysis
• Some scripts and their corresponding groups do not match
• Experimental "Code Coverage" plugin fails to load
• Explicit folder filtering with `"/"` as a parameter does not work as expected
• Labels are still present in filters after being removed from .idb
• In recursive mode the function can be prefixed multiple times
• Recursive mode is not considered while highlighting with color

Acknowledgments

Version History