Skip to content

Paranoia 0.5.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 25 Oct 20:40
· 26 commits to main since this release
v0.5.0
13f5683

Paranoia 0.5.0 brings a typed decompiler, RISC-V and MIPS, library signatures and Python scripting.

Downloads

  • Paranoia-Setup-0.5.0.exe: the Windows installer (per-user, no admin rights needed)
  • Paranoia-0.5.0-portable.exe: a portable build in a single file

These builds are not code-signed yet, so Windows SmartScreen may ask for confirmation the first time you launch one. The release pipeline will sign builds once a certificate is configured (docs/SIGNING.md).

New

  • Decompiler v2 (x86 / x64):
    • Registers become variables: a1… for parameters and v1… for locals. A register gets a new variable when it is overwritten at the top level and no jump crosses that point.
    • Variables are declared with types. Types come from API prototypes (HANDLE v3 = CreateFileW(a1, GENERIC_READ, …), DWORD for a &var passed as LPDWORD), from stack slot sizes and from register widths. Signatures use __fastcall.
    • switch statements are rebuilt from jump tables.
    • Loops come out as while, while (1) with break/continue, and for (init; cond; step).
  • Better function boundaries on x64 PE: chained .pdata entries are now treated as chunks of their parent function, not as separate functions. This removes about 90% of the false tail calls in kernel32.
  • RISC-V disassembly:
    • RV32 and RV64 with the I, M, A, F, D, C and Zicsr extensions.
    • Compressed instructions are shown in their expanded form, with the usual aliases (li, mv, ret, beqz, …).
    • auipc/lui pairs are resolved to data references and call targets.
  • MIPS disassembly:
    • MIPS32 and MIPS64, big- and little-endian.
    • Branch delay slots are handled in the analysis.
    • lui + addiu/lw pairs and jalr t9 calls are resolved.
  • Library signatures (FLIRT-style):
    • Reads IDA FLAIR .pat files.
    • Writes .pat files from any binary that has symbols (paranoia sigmake, or Create signature file in the menu).
    • A built-in MSVC x64 runtime library is applied automatically.
    • Recognised library functions are highlighted.
  • Python scripting:
    • Scripts run in your own CPython, so all your Python libraries are available.
    • Common IDAPython calls work unchanged (import idc, idautils: Functions, get_func_name, set_name, XrefsTo, get_bytes, patch_bytes, decompile, jumpto, …).
    • The console switches between JavaScript and Python and includes examples.
    • paranoia script <binary> <script.py> runs the same scripts headless, like IDA's batch mode.

Known limitations

  • MIPS is covered by decoder tests on known encodings; it has not been checked on a full MIPS binary yet.
  • IDA's compressed .sig signature files are not read; use .pat files.
  • Pseudocode is available for x86 / x64 only.

See the roadmap for how Paranoia compares with IDA Pro today and what comes next.

Assets 4
Loading