Mrzzkllen / cutter-plugins

A a curated list of Community Plugins and Scripts written for Cutter

Cutter Plugins

This is a curated list of Plugins and Scripts written for the reverse engineering platform - Cutter.

Want to build your own Plugin for Cutter, or to port an existing one? Follow the tutorial in the official documentation: https://cutter.re/docs/plugins.html

Table of Contents

• Cutter Plugins
  • Table of Contents
  • Integrations
    • Jupyter Plugin
  • Malware Analysis
    • APT32 Graph Deobfuscator
    • Dropshot / StoneDrill Decrypter
    • Deobfuscate Bitpaymer API Calls
  • Coverage
    • CutterDRcov
    • Cutter Lighthouse
  • Enhancements
    • Assembly-reference
    • Recovering Stack Strings
  • Graphs
    • Cutter Deep Graphs
  • Misc
    • Cutter plugin templates

---

Integrations

Jupyter Plugin

This plugin integrates the Jupyter notebook inside Cutter

Status: Maintained

Malware Analysis

APT32 Graph Deobfuscator

A plugin for Cutter and Radare2 to deobfuscate APT32 flow graphs This is a python plugin for Cutter that is compatible as an r2pipe script for radare2 as well. The plugin will help reverse engineers to deobfuscate and remove junk blocks from APT32 (Ocean Lotus) samples.

Type: Plugin
Status: Maintained
Article: APT32 Flow Graphs with Cutter and Radare2

Dropshot / StoneDrill Decrypter

This is an r2pipe based script that is used to decrypt strings and resources in the Dropshot APT malware.

Type: Script
Status: Maintained
Articles:

• Decrypting APT33’s Dropshot Malware with Radare2 and Cutter – Part 1
• Decrypting APT33’s Dropshot Malware with Radare2 and Cutter – Part 2

Deobfuscate Bitpaymer API Calls

Deobfuscation script of API calls in Bitpaymer (v2)

Type: Script
Reference: https://twitter.com/FraMauronz/status/1005138478261309440

Coverage

CutterDRcov

CutterDrcov is code coverage plugin that visualizes DynamoRIO drcov into Cutter static analysis.

Type: Plugin
Status: Maintained

Cutter Lighthouse

This is still a work in progress on this Pull Request.

Type: Plugin
Status: WIP

Enhancements

Assembly-reference

A plugin for Cutter that shows the information about the assembly instruction currently selected (only for x86 and x64)

Type: Plugin
Status: Maintained

Recovering Stack Strings

Cutter script to comment value of strings that were manually created on the stack.

Type: Script
Status: Maintained

Graphs

Cutter Deep Graphs

A Cutter plugin to generate radare2 graphs. It also provides a new graph called Deep callgraph, which builds an in-depth callgraph from the current function, adding recursively its callees' callings.

Type: Plugin
Status: Maintained

Misc

Cutter plugin templates

Python and C++ sample plugins to start with.

Type: Plugin
Status: Maintained