feat: IDA Pro plugin for MBA deobfuscation - #14

Open

kyle-elliott-tob wants to merge 34 commits into

masterfrom

ft-ida-plugin

Commits on Apr 3, 2026

build: add ida-cobra plugin CMake scaffolding

kyle-elliott-tob
and
claude
committed
6a9c300
feat(ida): add MicrocodeDetector for MBA tree detection

kyle-elliott-tob
and
claude
committed
497db80
feat(ida): add MicrocodeConverter for minsn_t <-> Expr conversion

kyle-elliott-tob
and
claude
committed
f12d019
feat(ida): add Verifier for random-input equivalence checks

kyle-elliott-tob
and
claude
committed
e8d688d
feat(ida): add plugin entry point with Hex-Rays callbacks and config

kyle-elliott-tob
and
claude
committed
43c1c4c
ci: add IDA plugin build job (Linux/macOS/Windows)

kyle-elliott-tob
and
claude
committed
4a85e52
feat(ida): add Tier 2 cross-block detection scaffold with post-order walk

kyle-elliott-tob
and
claude
committed
edfc90f
fix(ida): address code review findings

kyle-elliott-tob
and
claude
committed
3169936
ci: add release job to publish IDA plugin artifacts on tags

kyle-elliott-tob
and
claude
committed
06c37de
fix(ci): replace third-party ninja action with package manager installs
kyle-elliott-tob
committed
862b376
fix(ci): gate LLVM dep behind COBRA_ENABLE_LLVM, default OFF
kyle-elliott-tob
committed
272ddf8
fix(ci): use --unresolved-symbols=ignore-all for Linux IDA plugin linking
kyle-elliott-tob
committed
b0000eb
fix(ci): only upload IDA plugin artifacts on tag releases
kyle-elliott-tob
committed
3020936
fix(ci): add IDA SDK platform defines, use clang-cl on Windows
kyle-elliott-tob
committed
26fc86c
fix(cmake): fix library suffix for macos
Ninja3047
committed
793e332
fix(ida): use value equality for mop_t matching

Ninja3047
and
claude
committed
77ed298
fix(ida): drill past wrapper opcodes to find MBA root

Ninja3047
and
claude
committed
eced60d
refactor(ida): convert recursive tree walks to iterative

Ninja3047
and
claude
committed
7300f27
Merge pull request #15 from trailofbits/fixes-and-refactor
kyle-elliott-tob
authored
ad377c2
feat(ida): tag simplified functions via netnode for script queries

Ninja3047
and
claude
committed
55d7c19
feat(ida): add headless idalib test script for CoBRA

Ninja3047
and
claude
committed
e43d1d2
style(ida): apply clang-format to IDA plugin sources

Ninja3047
and
claude
committed
1e2ae83
style(ida): reformat with clang-format-22 to match CI

Ninja3047
and
claude
committed
50a8467

Commits on Apr 4, 2026

test: add scalar extension lowering tests (red)

kyle-elliott-tob
and
claude
committed
b25ff31
feat: add shared scalar extension lowering helpers

kyle-elliott-tob
and
claude
committed
f69f40d
test: add Expr extension lowering tests

kyle-elliott-tob
and
claude
committed
e6d0b74
refactor(llvm): split IsMbaOpcode into IsCoreMbaOpcode + IsTreeOpcode

kyle-elliott-tob
and
claude
committed
a1ebc47
feat(llvm): lower ZExt/SExt via shared extension helpers

kyle-elliott-tob
and
claude
committed
257df1c
test(llvm): add FileCheck tests for extension lowering

kyle-elliott-tob
and
claude
committed
7ce29a7
fix(ida): peel only m_mov in MbaRoot, derive bitwidth from root

kyle-elliott-tob
and
claude
committed
b9dcff6
fix(ida): validate extension widths in LeafCollector

kyle-elliott-tob
and
claude
committed
e4db6be
feat(ida): lower xdu/xds via shared extension helpers

kyle-elliott-tob
and
claude
committed
a33cc21
fix(ida): validate root extension widths before signature generation

kyle-elliott-tob
and
claude
committed
78ac0e7
fix: address review findings — semantic test and dead code

kyle-elliott-tob
and
claude
committed
c543e4f

Navigation Menu

Uh oh!

feat: IDA Pro plugin for MBA deobfuscation - #14

feat: IDA Pro plugin for MBA deobfuscation#14
kyle-elliott-tob wants to merge 34 commits into
masterfrom
ft-ida-plugin

Commits on Apr 3, 2026

build: add ida-cobra plugin CMake scaffolding

feat(ida): add MicrocodeDetector for MBA tree detection

feat(ida): add MicrocodeConverter for minsn_t <-> Expr conversion

feat(ida): add Verifier for random-input equivalence checks

feat(ida): add plugin entry point with Hex-Rays callbacks and config

ci: add IDA plugin build job (Linux/macOS/Windows)

feat(ida): add Tier 2 cross-block detection scaffold with post-order walk

fix(ida): address code review findings

ci: add release job to publish IDA plugin artifacts on tags

fix(ci): replace third-party ninja action with package manager installs

fix(ci): gate LLVM dep behind COBRA_ENABLE_LLVM, default OFF

fix(ci): use --unresolved-symbols=ignore-all for Linux IDA plugin linking

fix(ci): only upload IDA plugin artifacts on tag releases

fix(ci): add IDA SDK platform defines, use clang-cl on Windows

fix(cmake): fix library suffix for macos

fix(ida): use value equality for mop_t matching

fix(ida): drill past wrapper opcodes to find MBA root

refactor(ida): convert recursive tree walks to iterative

Merge pull request #15 from trailofbits/fixes-and-refactor

feat(ida): tag simplified functions via netnode for script queries

feat(ida): add headless idalib test script for CoBRA

style(ida): apply clang-format to IDA plugin sources

style(ida): reformat with clang-format-22 to match CI

Commits on Apr 4, 2026

test: add scalar extension lowering tests (red)

feat: add shared scalar extension lowering helpers

test: add Expr extension lowering tests

refactor(llvm): split IsMbaOpcode into IsCoreMbaOpcode + IsTreeOpcode

feat(llvm): lower ZExt/SExt via shared extension helpers

test(llvm): add FileCheck tests for extension lowering

fix(ida): peel only m_mov in MbaRoot, derive bitwidth from root

fix(ida): validate extension widths in LeafCollector

feat(ida): lower xdu/xds via shared extension helpers

fix(ida): validate root extension widths before signature generation

fix: address review findings — semantic test and dead code