kordesii | decoding encoded strings and files in malware via IDA Pro

kordesii is a Python library. kordesii has no bugs, it has no vulnerabilities, it has build file available and it has low support. However kordesii has a Non-SPDX License. You can download it from GitHub.

DC3-Kordesii is a framework for decoding encoded strings and files in malware via IDA Pro IDAPython scripting. One parser module is usually created per malware family. It is designed to ease the burden of encoded string extraction by doing it in an automated, static way as well as to provide a standard set of functionality and methodologies. It supports both an analyst directed analysis and large-scale automated executing, utilizing either the REST API, the CLI or by manually running decoders in IDA. DC3-Kordesii is authored by the Department of Defense Cyber Crime Center (DC3).