Home

Awesome

ida-images

Image preview plugin for Ida disassembler.

Application

I made this plugin to ease finding image decoding routines - I can run some complex code and see if the memory contains the image I'm looking for afterwards.

Features

Additionally, I'm open to feature requests, as long as they won't make the code too bloated.

Installing IDA plugin

Either drop the rgb-ida.py file and librgb directory in C:\Program Files\IDA 7.0\plugins (or similar) and then run it via <kbd>Ctrl</kbd> + <kbd>3</kbd>, or run the script manually with <kbd>Alt</kbd> + <kbd>F9</kbd>.

Tested on: IDA Pro 6.6, 6.8, 7.0

Installing standalone version

In this case you can either directly use ./rgb, or install it globally with sudo python setup.py install.

Seeing it in action

Viewing program code

A piece of code

I have no idea what the gradients are there for, but it's certainly interesting!

Are you LZSS?

More mysterious data.

Viewing actual bitmap

A bitmap

Now all that's left is to localize the exact function that allocated this segment... and voilà.