Relyze Desktop Plugins

Release

These plugins are shipped with Relyze Desktop.

• release/x64dbg.rb - Import or export x64dbg databases, including bookmarks, comments and labels.

• release/call_highlight.rb - Highlight every call instruction in the current function.

• release/diff_copy_data.rb - After a differential analysis has been performed, copy block names and comments from all matched functions in the current analysis over to the diffed analysis.

• release/pe_import_hash.rb - Generate an IMPHASH for a PE file. You can also list all the archives in the current library which have matching IMPHASH hashes.

• release/processor_mode.rb - Get or set the processor mode at the currently selected location.

• release/segment_strip.rb - Strip unwanted segments before code analysis.

• release/static_library_analysis.rb - A simple GUI plugin to manually query and apply static library packages against all non library functions. You can also color known static library functions.

• release/virustotal_detection.rb - Retrieve the last known detection rate from VirusTotal.

• release/decoders/base64.rb - Base64 Decoder a buffer.

• release/decoders/bitwise_not.rb - Bitwise Not a buffers bytes.

• release/decoders/xor.rb - Xor a buffers bytes.

• release/decoders/zlib_decompress.rb - Decompress a buffer via Zlib inflate

• release/loaders/mclf.rb - Load MobiCore Load Format (MCLF) v2 binaries.

• release/loaders/srec.rb - Load Motorola S-Record (SREC) binaries.

Examples

These plugins are simple examples to demonstrate various capabilities.

• examples/binary_diff_compare.rb - Analyze two binaries and perform a differential analysis against them. Displays the percentage difference of the two binaries and what function were modified, by how much and their corresponding matched function.

• examples/count_unique_instructions.rb - Iterate over every instruction in every code block and count the number of unique instructions based on their mnemonic.

• examples/disassemble_arbitrary_bytes.rb - Example to disassemble an arbitrary byte stream for the various supported architectures.

• examples/locate_elf_section_header_items.rb - Example to traverse a models structure in order to search for some data.

• examples/module_dependency_graph.rb - Example to analyze multiple binaries and generate a dependency graph based each binaries module imports. The graph is either displayed in the GUI or saved as an SVG file.

• examples/multithreaded_folder_analysis.rb - Example to perform analysis on multiple binaries in parallel and then save them to the Relyze library.

• examples/add_model_info.rb - Add some example information to a model which is displayed in the overview.

• examples/colors.rb - Simple example to show how to set the color of a models structure items, functions, blocks or instructions.

• examples/test_entrypoints.rb - Test the various entry points of an Analysis plugin, including manually running the plugin, invoking the plugin via a keyboard or popup menu shortcut or via the analysis pipeline.

• examples/patch_nonexec_section.rb - Patch the Characteristics of a PE section which contains the entry point if that section is not already marked as executable.

• examples/unmangle_type.rb - Unmangle a (Microsoft, LLVM or Borland) mangled name and generate a corresponding data type for it and for example generate a pointer to this type.

• examples/metasm_integration.rb - Test loading and using the Metasm library.

Support:

Visit our Relyze Plugin SDK documentation for a complete description of the plugin framework.

Visit our Help Centre to find answers to common questions.

If you require further assistance, contact us directly.

License

All plugins are made available under a 3 clause BSD license. Please see LICENSE.txt for more information.