editor plugins - 1-3-7/disrobe GitHub Wiki
The editors/ directory contains plugins for VS Code, IDA Pro, Ghidra, and Binary Ninja. Each calls an installed Disrobe binary. The VS Code plugin also starts the LSP service when enabled in its settings.
Plugin sources, manifests, and installers are generated by xtask plugins and checked by xtask sync --check. The VS Code build dependencies are pinned in its npm lockfile.
Clone the repository and run the auto-installer script for your platform:
Linux / macOS (bash):
bash editors/install.sh vscode
bash editors/install.sh ida
bash editors/install.sh ghidra
bash editors/install.sh binja
bash editors/install.sh ida --ida-dir /path/to/ida/plugins
bash editors/install.sh ghidra --ghidra-scripts ~/my-scriptsWindows (PowerShell):
.\editors\install.ps1 vscode
.\editors\install.ps1 ida
.\editors\install.ps1 ghidra
.\editors\install.ps1 binja
.\editors\install.ps1 ida -IDADir 'C:\IDA\plugins'
.\editors\install.ps1 ghidra -GhidraScripts 'C:\ghidra_scripts'The VS Code installer requires Node.js 20 or later, npm, and the code command on PATH. It downloads the locked build dependencies, compiles a VSIX, and installs it through VS Code. The other installers copy plugin sources to the selected editor directory.
Requirements: VS Code 1.85 or later. Build disrobe from source and add the binary to your PATH, or set disrobe.executablePath in VS Code settings.
Manual install steps:
Run these commands from editors/vscode:
npm ci --ignore-scripts
npm run package
code --install-extension disrobe.vsix --forceReload VS Code after installation. You can also choose Extensions: Install from VSIX and select disrobe.vsix. Local installation requires no Marketplace account.
The extension activates automatically and starts disrobe serve --stdio when disrobe.lsp.enable is true (the default). This requires a Disrobe build with the server feature. Set the option to false to use only the CLI commands.
All commands appear under the disrobe category in the Command Palette. The seven file-analysis commands also appear in the editor right-click menu for files on disk. They read the saved file, so save pending edits before running them.
Settings:
| Setting | Default | Description |
|---|---|---|
disrobe.executablePath |
"disrobe" |
Path to the disrobe binary. |
disrobe.lsp.enable |
true |
Start the LSP daemon on activation. |
disrobe.lsp.trace |
"off" |
LSP trace level: off, messages, or verbose. |
disrobe.auto.outDir |
"" |
Output directory for disrobe auto. |
Commands:
| Command | Description |
|---|---|
disrobe.auto |
Auto: run full deobfuscation pipeline |
disrobe.detect |
Detect: identify obfuscator / packer |
disrobe.strings |
Strings: extract and deobfuscate strings |
disrobe.ioc |
IOC: extract indicators of compromise |
disrobe.behavior |
Behavior: summarize binary capabilities (MITRE) |
disrobe.identify |
Identify: compiler / packer / protector fingerprint |
disrobe.scan |
Scan: leak credentials scanner |
disrobe.startServer |
Manually start the LSP daemon |
disrobe.stopServer |
Stop the LSP daemon |
disrobe.showOutput |
Open the disrobe output channel |
Requirements: IDA Pro 7.6 or later with IDAPython 3 backend. disrobe binary on your PATH.
Manual install steps:
- Copy
editors/ida/disrobe_ida.pyto your IDA plugins directory:- Linux/macOS:
~/.idapro/plugins/ - macOS (app):
~/Library/Application Support/hex-rays/ida pro/plugins/ - Windows:
%APPDATA%\Hex-Rays\IDA Pro\plugins\
- Linux/macOS:
- Restart IDA Pro.
The plugin registers all disrobe subcommands as menu actions under Edit > Plugins > disrobe and assigns default hotkeys. Invoking an action runs disrobe <subcommand> <input_file_path> on the file IDA has open and prints the output to the IDA output window.
Actions and default hotkeys:
| Action | Hotkey |
|---|---|
| Auto: run full deobfuscation pipeline | Alt-Shift-A |
| Detect: identify obfuscator / packer | Alt-Shift-D |
| Strings: extract and deobfuscate strings | Alt-Shift-S |
| IOC: extract indicators of compromise | Alt-Shift-I |
| Behavior: summarize binary capabilities (MITRE) | Alt-Shift-B |
| Identify: compiler / packer / protector fingerprint | Alt-Shift-F |
| Scan: leak credentials scanner | Alt-Shift-C |
Requirements: Ghidra 10.3 or later. disrobe binary on your PATH.
Manual install steps:
- Copy
editors/ghidra/DisrobeAnalyzer.javato a directory listed in Ghidra's Script Manager search paths:- Default location:
~/ghidra_scripts/ - Or add a custom path via
Window > Script Manager > Manage Script Directories.
- Default location:
- In Ghidra:
Window > Script Manager, click the refresh icon to pick up the new script. - Double-click
DisrobeAnalyzerin the script list to run it.
When run, the script reads the path of the currently loaded program, shows a dialog to choose a disrobe action, shells out to the disrobe binary, and prints the output to the Ghidra console.
To assign a keybinding, right-click DisrobeAnalyzer in the script list and choose Assign Key Binding.
The plugin requires a Binary Ninja edition with Python plugin support. Binary Ninja Free does not support plugins.
Run the installer with binja, then restart Binary Ninja. Commands appear under Plugins > disrobe and operate on the current file. Set DISROBE_BINARY in the installed __init__.py if the Disrobe executable is not on PATH. See the plugin instructions for manual installation paths.