Delphi RE support

[psifertex]

There are no special workflows or types for reverse engineering Delphi. Ultimately we could even add a language representation layer but the most immediate goal is to support any specific file format data structures including debug information, pascal-style strings, and platform types.

[psifertex]

Alternate string formats are likely encapsulated by #1334

[xusheng6]

For what I can remember -- Delphi binaries do have certain metadata that, if properly parsed and applied, can give you function names and other things. Though I cannot remember the details. Might worth checking some Delphi-specific tools first

[xorhex]

I see just enough Delphi malware over the years it would be really nice not to have to get IDR working each time.

[fuzyll]

@xorhex What feature(s) do you find the most useful from IDR, or that you would like to see?

This is something I've been very interested in building for awhile and I think the work that's been done on Workflows in our past few releases should let us be able to do this pretty well.

From what I think would be quickest to most time-consuming for me:

• Finding and parsing internal data formats for class info, virtual method tables, etc.
• Providing types for common runtime libraries
• Writing a custom language representation ("Pseudo-Delphi")
• Identifying and parsing Pascal-style strings

These are the things I'd identified when talking with Jordan before he filed this issue. But, is there anything else you'd like to see? And are there any specific binaries that I could use as test cases that would ensure whatever I'm building is worthwhile for you? I already have some to work with, but they are not malware.

[xorhex]

@fuzyll

These 3 would be ideal for me (pretty much sums up what I'm looking for)

• Finding and parsing internal data formats for class info, virtual method tables, etc.
• Providing types for common runtime libraries
• Identifying and parsing Pascal-style strings

What do you mean by a custom language representation - like the high level C/rust representation but dephi like?

Here are 2 malware samples that hopefully will be of help to you. These are the types of things I've looked at in the past.

Malware.zip Pwd: infected

Thanks!

[xorhex]

This might be of some help as well https://github.com/eset/DelphiHelper

[utkonos]

Yes and yes to all of the above. Also, here are a few samples to add to the mix that I've been working on recently. All have been uploaded to the customer portal.

Tampered innosetup DLL: "silly planet jumps carefully"
Legit innosetup compiler EXE (used with tampered DLL): "kind star swims carefully"

DanaBot DLL: "fierce star builds happily"
DanaBot EXE: "wise ocean glows boldly"

[utkonos]

And don't forget about ASPack:

"happy dragon jumps happily"
"eager mountain dreams quietly"

[utkonos]

Adding other projects for more reference material:

Binja plugins that already exist:
https://github.com/CTM1/BinjaDelphiMapper
https://github.com/ImNotAVirus/delphi_ninja

IDR Components:
https://github.com/crypto2011/IDR
https://github.com/crypto2011/IDR64
https://github.com/crypto2011/KBBUILDER

Ghidra/IDR Plugins:
https://github.com/huettenhain/dhrake