Learning Malware Analysis

5.3 IDA Plugins

IDA plugins greatly enhance the capabilities of IDA, and most of the third-party software that are developed to be used with IDA are distributed in the form of plugins. A commercial plugin that is of great value to a malware analyst and reverse engineer is the Hex-Rays Decompiler (https://www.hex-rays.com/products/decompiler/). This decompiles the processor code into a human-readable C-like pseudocode, making it easier to read the code, and can speed up your analysis.

The best place to find some of the interesting plugins is the Hex-Rays plugin contest page at https://www.hex-rays.com/contests/index.shtml. You can also find a list of useful IDA plugins at https://github.com/onethawt/idaplugins-list.