Skip to content
Official VirusTotal plugin for IDA Pro
Python
Branch: master
Clone or download
gerardofn Merge pull request #5 from VirusTotal/v0.8
Update plugin_loader.py
Latest commit 3476b74 Jan 30, 2020
Permalink
Type Name Latest commit message Commit time
Failed to load latest commit information.
plugin updated to v0.8 Jan 30, 2020
.gitignore Vtgrep initial (#1) Dec 13, 2019
CODEOWNERS minor changes, added README.md (#3) Jan 9, 2020
LICENSE
README.md Update README.md Jan 30, 2020
VERSION updated to v0.8 Jan 30, 2020

README.md

VT-IDA Plugin

This is the official VirusTotal plugin for Hex-Rays IDA Pro. This plugin integrates functionality from VirusTotal web services into the IDA Pro's user interface.

The current version is v0.8beta, This plugin is not production-ready yet, and unexpected behavior can still occur. This release integrates VTGrep into IDA Pro, facilitating the searching for similar code, strings, or sequences of bytes.

Requirements

This plugin has been developed for IDA Pro 7.0 and beyond and supports both Python 2.7 and 3.x. It requires the "requests" module, the easiest way of installing it is by using pip:

$ pip install requests

Installation

Copy the content of the plugin directory into the IDA Pro's plugin directory and start IDA Pro.

OS Plugin path
Linux /opt/ida-7.X/plugins
macOS ~/.idapro/plugins
Windows %ProgramFiles%\IDA 7.X\plugins

Usage

While in the disassembly window, select an area of a set of instructions and right-click to chose one of the following actions:

  • Search for bytes: it searches for the bytes contained in the selected area.
  • Search for string: it searches for the same string as the one selected in the Strings Window.
  • Search for similar code: identifies memory offsets or addresses in the currently selected area and ignores them when searching.
  • Search for similar code (strict): same as above but it also ignores all the constants in the currently selected area.
  • Search for similar functions: same as "similar code" but you don’t need to select all the instructions that belong to a function. Just right-click on one instruction, and it will automatically detect the function boundaries, selecting all the instructions of the current function.

Another option is to look for similar strings. To search for similar ones, open the Strings Windows in IDA Pro, right-click on any string (one or many) and select Virus Total -> Search for string.

These actions will launch a new instance of your default web browser, showing all the matches found in VTGrep. Remember that your default web browser must be logged into your VirusTotal Enterprise account in order to see the results.

Check IDA Pro's output window for any message that may need your attention.

Note: This version only supports Intel 32/64 bits when searching for similar code. Support for more processors will be added in the next version.

You can’t perform that action at this time.