Home

Awesome

IDATag - Tag explorer for IDA Pro

When analyzing a binary, a reverser using IDA will rename functions, comment, add bookmarks.

Moreover, this actions are available only from the IDA environment (IDA, IDA scripting or plugins).

However, this usage does not allow to have a global view of the analysis. Also, the different conventions to document an IDB may differ.

Finally, adding information from an external tools is not possible (except with scripts or plugins).

The idea behind IDATag is to offer a centralized way/view to document an IDB from IDA or from any other external tool.

Overview

IDATag is a tag plugin for IDA Pro. The plugin leverages IDA as a platform to map, explore, and visualize collected tags.

Tags can come from multiple sources such as IDA itself or different other clients.

Releases

The plugin is in active development, some bugs may appear. Thanks to let me know!

Building

Requirements

IDA Pro (32-bit)

Linux

export IDASDK=/opt/idafree-7.0/idasdk73
export IDATARGET=IDA32NUX
mkdir Ida32Build
cd Ida32Build
cmake -G"Unix Makefiles" ..
make

Windows

set IDASDK=C:\Program Files\IDA Pro 7.3\idasdk73
set IDATARGET=IDA32WIN
"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Auxiliary\Build\vcvars64.bat"
mkdir Ida32Build
cd Ida32Build
cmake -G"Visual Studio 16 2019" -A x64 ..
cmake --build . --config RelWithDebInfo

The build binary can be found in bin\IDATag_x64\ directory:

IDA Pro (64-bit)

Linux

export IDASDK=/opt/idafree-7.0/idasdk73
export IDATARGET=IDA64NUX
mkdir Ida64Build
cd Ida64Build
cmake -G"Unix Makefiles" ..
make

Windows

set IDASDK=C:\Program Files\IDA Pro 7.3\idasdk73
set IDATARGET=IDA64WIN
"C:\Program Files (x86)\Microsoft Visual Studio\2019\Professional\VC\Auxiliary\Build\vcvars64.bat"
mkdir Ida64Build
cd Ida64Build
cmake -G"Visual Studio 16 2019" -A x64 ..
cmake --build . --config RelWithDebInfo

WARNING: no quotes for the IDASDK path! Example :

set IDASDK=C:\Program Files\IDA Pro 7.3\idasdk73

The build binary can be found in bin\IDATag_x64\ directory:

Installation

Just copy the built dll file in the IDA Pro plugin directory.

REMARK: you can also create a symbolic link to th target dll. for example, in an Admin prompt:

mklink IDATag.dll c:\dev\IDATag\bin\IDATag_x64\IDATag.dll
mklink IDATag64.dll c:\dev\IDATag\bin\IDATag_x64\IDATag64.dll

This plugin targets IDA Pro version 7.0 and above only. This plugin has not been tested on Linux.

Usage

IDATag loads automatically when an IDB is opened. To open the view, you may use the Ctrl+Alt+T shorcut.

Tag Overview

The Tag Overview is a dockable widget that provides view of the referenced tags.

alt-text

These tags can come from multiple entry points:

alt-text

The JSON tag file is a pivot to each IDATag client.

Every tools that could create a JSON file with a specific structure is able to feed your IDA view. The JSON contract has been designed as minimalist.

For instance, the following JSON is used to tag a specific offset with two tags:

[
	{
		"tag": "crypto",
		"offset": 5065078,
		"feeder": "tagcrypt"
	},
	{
		"tag": "SHA-1",
		"offset": 5065078,
		"feeder": "tagcrypt"
	}
]

Each tag in the IDATag view is displayed with a specific colour corresponding to its feeder (tag signature).

alt-text

This table can be sorted by column, and entries can be double clicked to jump to their corresponding disassembly. Moreover, multiple filters are available to facilitate the navigation:

When textually filtered a tag will be highlighted in the view.

Also, it is possible to add tags from IDA by:

Tagging from IDA will automatically add an User tag to follow up the work done.

Finally, all the tags may be modified the same way through the IDATag view.

Context Menu

Right clicking the table in the Tag Overview will produce a context menu with a few basic amenities.

Also, IDATag contextual menu is accessible from different views:

alt-text

Configuration

The plugin can be configured with a specific folder to store tag files and username. The menu is accessible at 'Edit > [IDATag] Configuration'.

alt-text

IDA integration

Multiple hooks have been deployed to automatically tag the database:

Other event might be supported in the near future (eg. new_file).

Tag version

It is possible to ensure the good usage of a tag on a specific IDB by adding a hash value in the tag file. This hash value should correspond to the hashsum of the binary.

[
	{
		"hash": "2E6E67FF68755B3CD8236F0FFA1A05D6"
		"tag": "crypto",
		"offset": 5065078,
		"feeder": "tagcrypt"
	}
]

Tag clients

One of the main goal of IDATag is to make IDA extensible. It can takes as input json files generated by other tools.

Several clients are provided in the client folder: