OpenSec Atlas

hrtng: An Open Source Tool for Malware Analysis | OpenSec Atlas

Malware Analysis

Tool

hrtng

An advanced IDA Pro plugin offering decryption, deobfuscation, patching, and pseudocode transformations to enhance malware analysis.

View on GitHub

About This Tool

IDA Pro plugin with a rich set of features: decryption, deobfuscation, patching, lib code recognition and various pseudocode transformations

Primary Use Case

This tool is primarily used by malware analysts and reverse engineers to simplify the analysis of obfuscated or encrypted binaries within IDA Pro. It automates complex tasks like decryption and code recognition, enabling faster and more effective forensic investigations.

Key Features

Decryption of encrypted code segments
Deobfuscation of complex or obfuscated binaries
Patching capabilities within IDA Pro
Library code recognition to identify common functions
Various pseudocode transformations to improve readability

Insights & Recommendations

Requires a licensed copy of IDA Pro to function. Best used by users familiar with IDA Pro and reverse engineering concepts. Some features may require manual intervention or configuration for optimal results.

Installation

Clone the repository: git clone https://github.com/KasperskyLab/hrtng.git
Copy the plugin files to the IDA Pro plugins directory
Restart IDA Pro to load the plugin
Refer to the documentation for any dependencies or configuration

Usage

Use plugin menu inside IDA Pro to access decryption and deobfuscation features

Invokes the plugin's GUI to apply transformations and patches interactively

Apply pseudocode transformations via plugin options

Transforms the disassembled code to more readable pseudocode

Smart Usage Notes

Integrate with automated malware triage systems to accelerate threat intelligence workflows.Use in purple team exercises to enhance understanding of malware obfuscation techniques and improve detection rules.Leverage patching features to create custom signatures or mitigations for novel malware samples.Combine with sandbox environments to enrich forensic data with deobfuscated code insights.Incorporate into threat hunting pipelines to decode and analyze suspicious binaries proactively.