Talos tools of the trade
Summary: Cisco Talos updated GhIDA, an IDA Pro plugin that integrates the Ghidra decompiler via the Headless Analyzer or REST APIs through the Ghidraaas Docker container, and released a Python 3 version alongside the Python 2 one, tested in IDA 7.3 and IDA 7.5 with Ghidra 9.1.2. The new Dynamic Data Resolver for IDA adds start and break address options in place of absolute code ranges, command line parameters for the sample under analysis, and a relocation check, and now supports only Python 3.
What you should know: The DDR installer deletes the entire existing installation directory, such as C:\tools\DDR, and its contents after confirmation, so any files analysts keep there are lost on upgrade. DDR also produces incorrect addresses when a sample is rebased in IDA or relocated by the IDA debugger, since it expects the PE file-based original virtual address.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026