editor plugins

Editor plugins

disrobe ships integration scaffolds for VS Code, IDA Pro, and Ghidra under editors/ in the repository root. Each plugin calls the disrobe binary already on your PATH; there is no language server or extension marketplace publish required.

All files under editors/ are generated by xtask plugins from the live CLI command catalog and are verified byte-identical in CI via xtask sync --check.

Auto-installer

Clone the repository and run the auto-installer script for your platform:

Linux / macOS (bash):

bash editors/install.sh vscode
bash editors/install.sh ida
bash editors/install.sh ghidra
# optional overrides:
bash editors/install.sh ida --ida-dir /path/to/ida/plugins
bash editors/install.sh ghidra --ghidra-scripts ~/my-scripts

Windows (PowerShell):

.\editors\install.ps1 vscode
.\editors\install.ps1 ida
.\editors\install.ps1 ghidra
# optional overrides:
.\editors\install.ps1 ida -IDADir 'C:\IDA\plugins'
.\editors\install.ps1 ghidra -GhidraScripts 'C:\ghidra_scripts'

The scripts require only the repository clone; they copy files into the standard per-editor location without network access.

Visual Studio Code

Requirements: VS Code 1.85 or later. Build disrobe from source and add the binary to your PATH, or set disrobe.executablePath in VS Code settings.

Manual install steps:

1. Copy the editors/vscode directory to ~/.vscode/extensions/disrobe-vscode (Linux/macOS) or %USERPROFILE%\.vscode\extensions\disrobe-vscode (Windows).
2. Reload VS Code.

The extension activates automatically and starts disrobe serve --stdio as an LSP daemon when disrobe.lsp.enable is true (the default). All commands appear under the disrobe category in the Command Palette and in the editor right-click context menu.

Settings:

Setting	Default	Description
disrobe.executablePath	"disrobe"	Path to the disrobe binary.
disrobe.lsp.enable	true	Start the LSP daemon on activation.
disrobe.lsp.trace	"off"	LSP trace level: off, messages, or verbose.
disrobe.auto.outDir	""	Output directory for disrobe auto.

Commands (via Command Palette or right-click context menu):

Command	Description
disrobe.auto	Auto: run full deobfuscation pipeline
disrobe.detect	Detect: identify obfuscator / packer
disrobe.strings	Strings: extract and deobfuscate strings
disrobe.ioc	IOC: extract indicators of compromise
disrobe.behavior	Behavior: summarize binary capabilities (MITRE)
disrobe.identify	Identify: compiler / packer / protector fingerprint
disrobe.scan	Scan: leak credentials scanner
disrobe.startServer	Manually start the LSP daemon
disrobe.stopServer	Stop the LSP daemon
disrobe.showOutput	Open the disrobe output channel

IDA Pro

Requirements: IDA Pro 7.6 or later with IDAPython 3 backend. disrobe binary on your PATH.

Manual install steps:

1. Copy editors/ida/disrobe_ida.py to your IDA plugins directory:
   • Linux/macOS: ~/.idapro/plugins/
   • macOS (app): ~/Library/Application Support/hex-rays/ida pro/plugins/
   • Windows: %APPDATA%\Hex-Rays\IDA Pro\plugins\
2. Restart IDA Pro.

The plugin registers all disrobe subcommands as menu actions under Edit > Plugins > disrobe and assigns default hotkeys. Invoking an action runs disrobe <subcommand> <input_file_path> on the file IDA has open and prints the output to the IDA output window.

Actions and default hotkeys:

Action	Hotkey
Auto: run full deobfuscation pipeline	Alt-Shift-A
Detect: identify obfuscator / packer	Alt-Shift-D
Strings: extract and deobfuscate strings	Alt-Shift-S
IOC: extract indicators of compromise	Alt-Shift-I
Behavior: summarize binary capabilities (MITRE)	Alt-Shift-B
Identify: compiler / packer / protector fingerprint	Alt-Shift-F
Scan: leak credentials scanner	Alt-Shift-C

Ghidra

Requirements: Ghidra 10.3 or later. disrobe binary on your PATH.

Manual install steps:

1. Copy editors/ghidra/DisrobeAnalyzer.java to a directory listed in Ghidra's Script Manager search paths:
   • Default location: ~/ghidra_scripts/
   • Or add a custom path via Window > Script Manager > Manage Script Directories.
2. In Ghidra: Window > Script Manager, click the refresh icon to pick up the new script.
3. Double-click DisrobeAnalyzer in the script list to run it.

When run, the script reads the path of the currently loaded program, shows a dialog to choose a disrobe action, shells out to the disrobe binary, and prints the output to the Ghidra console.

To assign a keybinding, right-click DisrobeAnalyzer in the script list and choose Assign Key Binding.