Editor plugins

The editors/ directory contains plugins for VS Code, IDA Pro, Ghidra, and Binary Ninja. Each calls an installed Disrobe binary. The VS Code plugin also starts the LSP service when enabled in its settings.

Plugin sources, manifests, and installers are generated by xtask plugins and checked by xtask sync --check. The VS Code build dependencies are pinned in its npm lockfile.

Auto-installer

Clone the repository and run the auto-installer script for your platform:

Linux / macOS (bash):

bash editors/install.sh vscode
bash editors/install.sh ida
bash editors/install.sh ghidra
bash editors/install.sh binja
bash editors/install.sh ida --ida-dir /path/to/ida/plugins
bash editors/install.sh ghidra --ghidra-scripts ~/my-scripts

Windows (PowerShell):

.\editors\install.ps1 vscode
.\editors\install.ps1 ida
.\editors\install.ps1 ghidra
.\editors\install.ps1 binja
.\editors\install.ps1 ida -IDADir 'C:\IDA\plugins'
.\editors\install.ps1 ghidra -GhidraScripts 'C:\ghidra_scripts'

The VS Code installer requires Node.js 20 or later, npm, and the code command on PATH. It downloads the locked build dependencies, compiles a VSIX, and installs it through VS Code. The other installers copy plugin sources to the selected editor directory.

Visual Studio Code

Requirements: VS Code 1.85 or later. Build disrobe from source and add the binary to your PATH, or set disrobe.executablePath in VS Code settings.

Manual install steps:

Run these commands from editors/vscode:

npm ci --ignore-scripts
npm run package
code --install-extension disrobe.vsix --force

Reload VS Code after installation. You can also choose Extensions: Install from VSIX and select disrobe.vsix. Local installation requires no Marketplace account.

The extension activates automatically and starts disrobe serve --stdio when disrobe.lsp.enable is true (the default). This requires a Disrobe build with the server feature. Set the option to false to use only the CLI commands.

All commands appear under the disrobe category in the Command Palette. The seven file-analysis commands also appear in the editor right-click menu for files on disk. They read the saved file, so save pending edits before running them.

Settings:

Setting	Default	Description
`disrobe.executablePath`	`"disrobe"`	Path to the `disrobe` binary.
`disrobe.lsp.enable`	`true`	Start the LSP daemon on activation.
`disrobe.lsp.trace`	`"off"`	LSP trace level: `off`, `messages`, or `verbose`.
`disrobe.auto.outDir`	`""`	Output directory for `disrobe auto`.

Commands:

Command	Description
`disrobe.auto`	Auto: run full deobfuscation pipeline
`disrobe.detect`	Detect: identify obfuscator / packer
`disrobe.strings`	Strings: extract and deobfuscate strings
`disrobe.ioc`	IOC: extract indicators of compromise
`disrobe.behavior`	Behavior: summarize binary capabilities (MITRE)
`disrobe.identify`	Identify: compiler / packer / protector fingerprint
`disrobe.scan`	Scan: leak credentials scanner
`disrobe.startServer`	Manually start the LSP daemon
`disrobe.stopServer`	Stop the LSP daemon
`disrobe.showOutput`	Open the `disrobe` output channel

IDA Pro

Requirements: IDA Pro 7.6 or later with IDAPython 3 backend. disrobe binary on your PATH.

Manual install steps:

Copy editors/ida/disrobe_ida.py to your IDA plugins directory:
- Linux/macOS: ~/.idapro/plugins/
- macOS (app): ~/Library/Application Support/hex-rays/ida pro/plugins/
- Windows: %APPDATA%\Hex-Rays\IDA Pro\plugins\
Restart IDA Pro.

The plugin registers all disrobe subcommands as menu actions under Edit > Plugins > disrobe and assigns default hotkeys. Invoking an action runs disrobe <subcommand> <input_file_path> on the file IDA has open and prints the output to the IDA output window.

Actions and default hotkeys:

Action	Hotkey
Auto: run full deobfuscation pipeline	Alt-Shift-A
Detect: identify obfuscator / packer	Alt-Shift-D
Strings: extract and deobfuscate strings	Alt-Shift-S
IOC: extract indicators of compromise	Alt-Shift-I
Behavior: summarize binary capabilities (MITRE)	Alt-Shift-B
Identify: compiler / packer / protector fingerprint	Alt-Shift-F
Scan: leak credentials scanner	Alt-Shift-C

Ghidra

Requirements: Ghidra 10.3 or later. disrobe binary on your PATH.

Manual install steps:

Copy editors/ghidra/DisrobeAnalyzer.java to a directory listed in Ghidra's Script Manager search paths:
- Default location: ~/ghidra_scripts/
- Or add a custom path via Window > Script Manager > Manage Script Directories.
In Ghidra: Window > Script Manager, click the refresh icon to pick up the new script.
Double-click DisrobeAnalyzer in the script list to run it.

When run, the script reads the path of the currently loaded program, shows a dialog to choose a disrobe action, shells out to the disrobe binary, and prints the output to the Ghidra console.

To assign a keybinding, right-click DisrobeAnalyzer in the script list and choose Assign Key Binding.

Binary Ninja

The plugin requires a Binary Ninja edition with Python plugin support. Binary Ninja Free does not support plugins.

Run the installer with binja, then restart Binary Ninja. Commands appear under Plugins > disrobe and operate on the current file. Set DISROBE_BINARY in the installed __init__.py if the Disrobe executable is not on PATH. See the plugin instructions for manual installation paths.