IDA Script For Delphi

[Coldzer0]

Hello all

this script will rename all unknow functions to it's real name

like CreateForm , CloseForm .. etc

it searchs for sig of Events manager (this one Construct the Functions names and address )

it will works only for Delphi with GUI (components)


at first IDA didn't recognise it as Delphi file


now select the local debugger


then load the script file


it will load and Stop at EP

hit the Greeeen button or [F9]



now we have all the Functions named and have a BP [on]

the only issue here is it needs to run the file & the file to be unpacked

but if u can get the pattern address on unpacked file on memory it will work fine


https://github.com/Coldzer0/IDA-For-Delphi

i hope it will help reversing Delphi files

Peace

 

[Storm Shadow]

Very nice.

 

[mayl8822]

good, thanks for share

 

[m4n0w4r]

Very useful .. Thanks for sharing!

 

[Coldzer0]

i add support to x64
https://github.com/Coldzer0/IDA-For-Delphi/
still need more test with different versions of Delphi that support x64