CrackerCat / replica

Ghidra analysis script that aims to help in malware analysis.

REPLICA - TAME THE DRAGON

START

Copy the repository files into any of ghidra_scripts directories and extract db.7z, directories can be found from Window->Script Manager->Script Directories

Search for replica and enable in tool option

Done!

Features

Disassemble missed instructions

Detect and fix missed functions

Fix 'undefined' datatypes

Set MSDN API info as comments

Tag Functions based on API calls

Detect and mark wrapper functions

Fix undefined data and strings

Detect and label crypto constants

Detect and comment stack strings

Detect and label indirect string references

Detect and label indirect function calls

Rename Functions Based on string refrences

BUG? OPEN NEW ISSUE

https://github.com/reb311ion/replica/issues