https://github.com/isra17/nrs

NSIS Reversing Suite with IDA Plugins
https://github.com/isra17/nrs

Last synced: 3 months ago
JSON representation

NSIS Reversing Suite with IDA Plugins

• Host: GitHub
• URL: https://github.com/isra17/nrs
• Owner: isra17
• License: gpl-3.0
• Created: 2016-02-12T04:59:16.000Z (almost 9 years ago)
• Default Branch: master
• Last Pushed: 2023-05-15T13:01:25.000Z (over 1 year ago)
• Last Synced: 2024-07-10T14:32:07.925Z (4 months ago)
• Language: Python
• Homepage:
• Size: 438 KB
• Stars: 99
• Watchers: 14
• Forks: 19
• Open Issues: 4
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

        
# NRS

## NSIS Reversing Suite

NRS is a set of Python librairies used to unpack and analysis NSIS installer's data. It also feature an IDA plugin used to disassembly the NSIS Script of an installer.

![nrs screenshot](http://i.imgur.com/0EQE6gu.png)

### Installation

NRS is available through [Pypi](https://pypi.python.org/pypi/nrs) or this repositoy.

To use with IDA, the native module must be build in 32 bits since IDA use its own 32 bits Python runtime on x64_86 systems.

It is recommended to use [IDAPython-virtualenv](https://github.com/Kerrigan29a/idapython_virtualenv) to manage Python dependancies in IDA.

Change working directory to IDA root directory: `cd $IDA_DIR`

To setup virtualenv: `virtualenv -p python2 venv && source venv/bin/activate`.

Install nrs from Pypi and build in 32 bits: `CFLAGS=-m32 LDFLAGS=-m32 pip install nrs`.

It can also be installed from the git repository: `CFLAGS=-m32 LDFLAGS=-m32 pip install -e $PATH_TO_LOCAL_REPO`.

Create symbolic links from NRS modules to IDA folders: `python -c 'import nrs.ida;nrs.ida.install()`. The `venv` folder must be in the IDA folder or you must pass the ida folder path to the `nrs.ida.install` function.

Open IDA and load any NSIS installer!

If you have errors about `nrs` modules not found, ensure you run IDA from the Python venv.

A simple way is simply to run it from command line with your virtualenv activated:

```

$ source venv/bin/activate

$ ./idaq

```