Forest Global Training Partners

Cyber Risks · Cisco Talos

Dynamic Data Resolver (DDR) — IDA Plugin 1.0 beta

Summary: Cisco Talos released a beta of its Dynamic Data Resolver, an IDA plugin paired with a DynamoRIO client that runs a malware sample on a separate machine and feeds runtime values back into IDA as a JSON trace file. The plugin offers light and full traces (default cap of 20,000 instructions), resolves dynamic values and auto-comments operands, dumps buffers, patches samples, and generates x64dbg scripts, with a 30-second API timeout by default.

What you should know: DDR kills every process the sample started at the end of an analysis, but a 32-bit process launching a 64-bit child is not supported by DynamoRIO, so DDR never sees that child and never kills it - Talos advises checking the malware machine yourself rather than trusting the cleanup.

Read the original at Cisco Talos ↗

Topics
Malware
Related