IDAChef

A CyberChef-style recipe/operation toolkit embedded in IDA Pro 9.x. Build multi-step data transformation chains — encoding, encryption, compression, hashing, extraction — and run them directly against bytes or strings from your IDA database. Patch the result back into the binary or drop it as a comment.

┌──────────────┬──────────────────┬─────────────────────────────┐
│  Operations  │     Recipe       │         I/O Panel           │
│  (search)    │                  │                             │
│              │  ┌─ From Hex ──┐ │  Input:  5e 73 68 7d 6c... │
│  Data format │  │  XOR  [0x55] │ │  [Get Selected Bytes]      │
│  ▸ From Hex  │  │  ADD  [3]    │ │  [Get String @ Cursor]     │
│  ▸ To Hex    │  └─────────────┘ │  [From Clipboard]           │
│  ▸ From B64  │                  │                             │
│  ...         │  [Up] [Down]    │  [✓ Auto Bake]  [Bake!]    │
│              │  [Remove][Clear] │                             │
│  Encryption  │                  │  Output:  4b 58 87 7f e8    │
│  ▸ XOR       │  Arguments:      │  [Copy] [Output → Input]    │
│  ▸ AES Dec   │  Key: [0x55   ] │                             │
│  ...         │                  │  Address: [0x140001000]     │
│              │                  │  [Patch Bytes] [Set Comment] │
└──────────────┴──────────────────┴─────────────────────────────┘

Features

• 289 operations across 12 categories — encodings, ciphers, compression, hashing, extraction, networking, code formatting, and more
• Dockable IDA widget (Ctrl-Alt-C) — operation browser, recipe builder, and I/O panel all in one window
• Live "Auto Bake" — every parameter change instantly recomputes the full recipe chain
• Direct IDA integration — pull selected bytes, grab the string under your cursor (ASCII or UTF-16LE), patch output back into the binary, or set comments; batch-process a whole address range of strings and patch results back
• Recipe import/export — save recipes as JSON and load them again, including recipes exported from CyberChef itself
• Formula expressions — chain byte-level operations in a single step: FromHex+XOR(0x55)+ADD(3) or FromBase64+NOT+ROL(3)
• Auto-growing argument fields — monospace fields that expand to fit your key/IV/salt, with live byte-length hints and AES key-size detection
• Zero-dependency core — hex, Base64/32/85, XOR, gzip/zlib/lzma, SHA*, CRC, regex extractors, and 100+ more ops use only the Python standard library; AES/DES/RC4 available with pycryptodome (optional)

Install

1. Copy both idachef_plugin.py and the idachef/ folder into your IDA plugins directory:

   OS	Path
   Windows	%APPDATA%\Hex-Rays\IDA Pro\plugins\
   macOS	~/Library/Application Support/Hex-Rays/IDA Pro/plugins/
   Linux	~/.idapro/plugins/

   plugins/
     idachef_plugin.py
     idachef/
       __init__.py
       core/
         __init__.py
         dish.py
         formula.py
         logger.py
         operation.py
         recipe.py
         utils.py
       operations/
         __init__.py
         arithmetic.py
         ciphers.py
         codeformat.py
         compression.py
         encoding.py
         extractors.py
         hashing.py
         language.py
         networking.py
         other.py
         publickey.py
         textutils.py
       ui/
         __init__.py
         chef_widget.py
         qt_compat.py
   

2. (Optional) For AES/DES/RC4 encryption: install pycryptodome into IDA's Python:

   "<ida>/python3/python.exe" -m pip install pycryptodome
   

   Everything else — Base64/32/85, hex, XOR, ROT13/47, gzip/zlib/bzip2/lzma, MD5/SHA*, CRC, HMAC, extractors — works with the standard library alone.

3. Restart IDA (or Edit → Plugins → IDAChef / Ctrl-Alt-C).

Usage

Opening

Edit → Plugins → IDAChef or press Ctrl-Alt-C.

Three-panel layout

All panels are splitter-based and freely resizable — drag the dividers between columns, between the recipe list and its argument editor, and between the Input / Output / Batch sections.

• Left — Operation Browser: searchable, categorised tree. Double-click an operation to add it to your recipe. Type in the search box to filter by name, category, or description.

• Centre — Recipe: ordered list of operations. Click a step to edit its arguments. Use Up / Down / Remove / Clear buttons to rearrange or reset. Arguments update live as you type (with Auto Bake enabled). Save Recipe / Load Recipe export and import the chain as JSON (also copied to the clipboard); Load Recipe additionally accepts recipes exported from CyberChef, mapping their positional arguments onto IDAChef's schemas.

• Right — I/O Panel:

  • Input: paste text directly, or pull data from IDA:
    • Get Selected Bytes — reads the current Hex View / disassembly selection and displays it as a hex string
    • Get String @ Cursor — reads the string literal at the current cursor position (ASCII and UTF-16LE strings are both detected)
    • From Clipboard — pastes clipboard content
  • Output: displays the final baked result in your chosen format (Auto hex/text, Hex, UTF-8, Latin-1, Base64, Decimal Bytes, C Array, Python bytes, UTF-16LE Text)
  • Actions:
    • Copy Output to clipboard
    • Output → Input — feed the result back as new input
    • Patch Bytes at Address — write output bytes to the specified address in the IDA database
    • Set Comment at Address — set the output text as a comment at the specified address

Input parsing

The input text is treated as plain text (with \xHH escape support). Use explicit recipe steps — From Hex, From Base64, From Binary, etc. — to decode your input before further processing.

IDA Output Window logging

Each bake prints three lines to IDA's output window:

Input: 5e6877497d7d71526c776d536c707c6c
Step 1 'From Hex' -> ^hwI}}qRlwmSlp|l
Step 2 'XOR' -> KX...
Result: KX...

• Input: the raw input text (or decoded byte string from IDA)
• Step N 'Operation': the output after each recipe step
• Result: the final output

All byte content is printed as decoded text (UTF-8 with Latin-1 fallback), truncated at 300 characters. Errors include the step index and exception message.

Formula expressions

The Formula (compound) operation lets you chain multiple byte-level operations in a single recipe step using an expression syntax:

FromHex+XOR(0x55)+ADD(3)      — decode hex, XOR with 0x55, add 3 (mod 256)
FromBase64+NOT+ROL(3)         — decode base64, bitwise NOT, rotate left 3
XOR(0xaa)+SHR(2)+AND(0x7f)   — XOR then shift-right then mask

Supported byte-level ops: XOR, ADD, SUB, AND, OR, NOT, ROL, ROR, SHL, SHR, MUL, MOD

Optional From prefix: FromHex or FromBase64 (decodes the entire input before byte-level operations are applied). If no prefix is given, input bytes are used as-is.

Keys in XOR/ADD/SUB/AND/OR/MUL/MOD can be hex (0xNN) or decimal integers. Multi-byte hex keys are cyclically repeated.

Operations by category — 289 total

Data format (50)

To/From: Hex, Hexdump, Base64, Base32, Base45, Base85, Base58, Base62, Binary, Octal, Decimal, Float, Charcode. URL Encode/Decode, HTML Entity, Morse Code, Quoted-Printable. Swap Endianness, Escape/Unescape String, Escape/Unescape Unicode, Punycode, BCD, Hex Content. CSV↔JSON, Unicode Normalisation, Text↔Integer Conversion, Generate UUID.