Resolve hashed API names by performing a hasher function rather than trying to guess it. Two approaches are used to resolve hashed symbols:
- Emulation using Unicorn Engine
- Runtime execution - stopping at OEP and running individual, especially complex, non-autonomous functions
Designed for reverse engineers dealing with obfuscated malware, shellcode, or custom loaders.
- Emulates real hashing functions via Unicorn
- Signature-based system with support for:
cdecl,stdcall,fastcall,win64- Arguments (incl. custom/default inputs)
- Memory-return values
- CLI and IDA plugin support
- Supports
char*,uint32,uint64, pointers, etc.
pip install -e .Make sure you're using the same Python version as IDA (e.g. Python 3.10)
Use from CLI:
- Resolve hash to string (resolve mode):
python cli/main.py resolve \
--signature <path_to_signature_file> \
--funcbin <path_to_function_binary> \
--hash <hash_value> \
--symbols <path_to_symbols_file> \
--arg <additional_argument_1=value> \
--arg <additional_argument_2=value>- Calculate hash for specified string (hash mode):
python cli/main.py hash \
--signature <path_to_signature_file> \
--funcbin <path_to_function_binary> \
--arg <additional_argument_1=value> \
--arg <additional_argument_2=value>- Generate hash map in bulk for symbols list (bulk mode, emulator):
python cli/main.py bulk \
--signature <path_to_signature_file> \
--symbols <path_to_symbols_file> \
--mode emu \
--funcbin <path_to_function_binary> \
--output <output_path> \
--arg <additional_argument_1=value> \
--arg <additional_argument_2=value>- Generate hash map in bulk for symbols list (bulk mode, runtime):
python cli/main.py bulk \
--signature <path_to_signature_file> \
--symbols <path_to_symbols_file> \
--mode runtime \
--exepath <path_to_exe_file> \
--func-rva <function_rva> \
--output <output_path> \
--arg <additional_argument_1=value> \
--arg <additional_argument_2=value>- Replace the placeholders like
<path_to_signature_file>,<path_to_function_binary>, etc., with the actual file paths and values for each mode.
Integrate with IDA:
- Symlink
ida_plugin/into yourIDA/plugins/directory ashashres - Drop
hashres_plugin.pynext to it:
ln -s path/to/ida_plugin D:/Your/IDA/hashresThen open a binary in IDA → right click a hash function → Hash Resolver: Generate hashmap
python -m pytestCLI tests run in subprocesses to validate emulation
MIT, do what you want.