AwesomeREA.org

Tool

hrtng

IDA plugin published by Kaspersky that extends the Hex-Rays decompiler with tools its author collected for reverse-engineering work, including malware analysis. It decrypts strings, data and constants with built-in ciphers or in bulk through IDA's Appcall debugger feature, resolves API-name hashes, unflattens control flow and forces decompilation of obfuscated code, and recognizes library code through microcode signatures, inlined-function detection and PAT files built from an IDA database. Pseudocode helpers cover automatic renaming, retyping and enum substitution, structure creation, virtual and indirect call navigation, and patching.

Requirements and limitations

  • Requires IDA with the Hex-Rays decompiler. The README supports only the latest IDA version; the plugin can still be compiled against IDA SDK 7.3 or later, but new features are usually not well tested on older versions. Latest release at review: v3.9.114, published 2026-09-02, with prebuilt archives for IDA 9.2, 9.3 and 9.4 plus a separate 7z archive; the reviewed master commit is one changelog fix ahead and declares 3.9.115 in ida-plugin.json.
  • The CI workflow builds Linux x64, macOS (Apple silicon and Intel) and Windows x64 binaries, and Linux ARM for IDA 9.3 and 9.4. Source builds use CMake with the Crypto++ CMake submodule and an IDA SDK whose path and version are set in src/CMakeLists.txt; the README gives manual SDK fixes for 8.5 and 9.1. The apilist.txt and literal.txt files from bin/plugins must sit beside the plugin for API-hash scanning and enum substitution.
  • Samples and IDA databases come from the analyst. The Appcall engine for mass decryption runs the analyzed program's own decryption routine under the selected IDA debugger, and its documentation reports testing only with the imul emulator and IDA's Remote Windows debugger. Obfuscated-code decompilation and inline detection are described as experimental.
  • GPL-3.0. NOTICE.txt lists bundled third-party code and its licenses, including Crypto++ 8.9.0 under the Boost Software License 1.0, used for ciphers such as RC4, AES and ChaCha20, and MIT-licensed GraphSlick and microavx code. Nothing was built, installed or run.

About this entry

Type
Tool
Category
Native analysis tools
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  2. README.md#L13-L15 GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  3. README.md#L112-L150 GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  4. doc/decr.md GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  5. doc/appcall.md GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  6. doc/deob.md GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  7. doc/msig.md GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  8. .github/workflows/build.yml GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  9. ida-plugin.json GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  10. CHANGELOG.md GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  11. NOTICE.txt GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  12. COPYING GitHub · KasperskyLab/hrtng · Revision 2c7b78e
  13. https://github.com/KasperskyLab/hrtng/releases/tag/v3.9.114
  14. https://securelist.com/hrtng-ida-pro-plugin/114780/