From Collaborative RCE Tool Library
CodeDoctor
| Tool name: | CodeDoctor |
|
||
|---|---|---|---|---|
| Author: | hnedka | |||
| Website: | N/A | |||
| Current version: | 0.90 | |||
| Last updated: | November 12, 2009 | |||
| Direct D/L link: | see details | |||
| License type: | freeware | |||
| Description: | <nowiki>CodeDoctor is a plugin for Olly and IDA. History: 11.11.2009 - 0.90 - initial public release ________________________________________________________________________________ Functions: 1) Deobfuscate Select instructions in disasm window and execute this command. It will try to clear the code from junk instructions. Example: Original: 00874372 57 PUSH EDI 00874373 BF 352AAF6A MOV EDI,6AAF2A35 00874378 81E7 0D152A41 AND EDI,412A150D 0087437E 81F7 01002A40 XOR EDI,402A0001 00874384 01FB ADD EBX,EDI 00874386 5F POP EDI Deobfuscated: 00874372 83C3 04 ADD EBX,4 ________________________________________________________ 2) Deobfuscate - Single Step This works like previous command, but does one transformation at a time _______________________________________________________ 3) Move NOPs to bottom Converts this: 00874396 50 PUSH EAX 00874397 90 NOP 00874398 90 NOP 00874399 52 PUSH EDX 0087439A BA 3F976B00 MOV EDX,somesoft.006B973F to this: 00874396 50 PUSH EAX 00874397 52 PUSH EDX 00874398 BA 3F976B00 MOV EDX,somesoft.006B973F 0087439D 90 NOP 0087439E 90 NOP Limitations: it breaks all jumps and calls pointing inwards ________________________________________________________ 4) Undo / Redo Undo or Redo last operation (from one of the above functions) ________________________________________________________ 5) Retrieve Jumpy function This will statically parse instructions and follow all jumps. This is useful for situations, when program jumps here and there and here and there... When it encounters some instruction, that can't be followed, it stop and copies all parsed instruction to an allocated place in memory. Use settings to set some parameters: Step over calls - if set, it will step over calls, otherwise it will follow them Step over jccs - dtto, but for Jccs Deobfuscate - it will deobfuscate instruction, when it encounters Jcc, RET, JMP reg/exp, CALL reg/exp; useful for multi-branch Example: Original: 00874389 /EB 05 JMP SHORT somesoft.00874390 0087438B |
|||
| Related URLs: |
|
|||
Feed containing all updates for this tool.
(please also edit it if you think it fits well in some additional category, since this can also be controlled)
You are welcome to add your own useful notes about this tool, for others to see!