Repository navigation
Delphi RE support #6496
Description
There are no special workflows or types for reverse engineering Delphi. Ultimately we could even add a language representation layer but the most immediate goal is to support any specific file format data structures including debug information, pascal-style strings, and platform types.
Activity
psifertex commentedon Mar 15, 2025
Alternate string formats are likely encapsulated by #1334
xusheng6 commentedon Mar 18, 2025
For what I can remember -- Delphi binaries do have certain metadata that, if properly parsed and applied, can give you function names and other things. Though I cannot remember the details. Might worth checking some Delphi-specific tools first
xorhex commentedon Mar 21, 2025
I see just enough Delphi malware over the years it would be really nice not to have to get IDR working each time.
fuzyll commentedon Mar 21, 2025
@xorhex What feature(s) do you find the most useful from IDR, or that you would like to see?
This is something I've been very interested in building for awhile and I think the work that's been done on Workflows in our past few releases should let us be able to do this pretty well.
From what I think would be quickest to most time-consuming for me:
These are the things I'd identified when talking with Jordan before he filed this issue. But, is there anything else you'd like to see? And are there any specific binaries that I could use as test cases that would ensure whatever I'm building is worthwhile for you? I already have some to work with, but they are not malware.
xorhex commentedon Mar 24, 2025
@fuzyll
These 3 would be ideal for me (pretty much sums up what I'm looking for)
What do you mean by
a custom language representation- like the high level C/rust representation but dephi like?Here are 2 malware samples that hopefully will be of help to you. These are the types of things I've looked at in the past.
Malware.zip Pwd:
infectedThanks!
xorhex commentedon Mar 24, 2025
This might be of some help as well https://github.com/eset/DelphiHelper
utkonos commentedon Mar 28, 2025
Yes and yes to all of the above. Also, here are a few samples to add to the mix that I've been working on recently. All have been uploaded to the customer portal.
Tampered innosetup DLL: "silly planet jumps carefully"
Legit innosetup compiler EXE (used with tampered DLL): "kind star swims carefully"
DanaBot DLL: "fierce star builds happily"
DanaBot EXE: "wise ocean glows boldly"
utkonos commentedon Apr 2, 2025
And don't forget about ASPack:
"happy dragon jumps happily"
"eager mountain dreams quietly"
utkonos commentedon May 1, 2025
Adding other projects for more reference material:
Binja plugins that already exist:
https://github.com/CTM1/BinjaDelphiMapper
https://github.com/ImNotAVirus/delphi_ninja
IDR Components:
https://github.com/crypto2011/IDR
https://github.com/crypto2011/IDR64
https://github.com/crypto2011/KBBUILDER
Ghidra/IDR Plugins:
https://github.com/huettenhain/dhrake
fuzyll commentedon May 1, 2025
Thanks! I've started on this, but have been sidetracked by a few more pressing things. Embarcadero also has reasonably good documentation available for some parts of this as well.
psifertex commentedon Sep 3, 2026
We now have support for the
registercalling convention (on dev but soon to be stable) and https://github.com/psifertex/delphinja additionally provides debug information parsing and a large number of type libraries. Leaving this issue open as we still plan to have better integrated first party support.