IDA Plugin Updates on 2026-11-11

New Releases:

• btf2ida v0.1.19
• btf2ida v0.1.18: headless runner for idalib
• btf2ida v0.1.17
• btf2ida v0.1.16
• btf2ida v0.1.15
• btf2ida v0.1.14
• btf2ida v0.1.13
• btf2ida v0.1.12
• btf2ida v0.1.11
• cfiscope v0.1.17
• cfiscope v0.1.16: headless runner for idalib
• cfiscope v0.1.15
• cfiscope v0.1.14
• cfiscope v0.1.13
• cfiscope v0.1.12
• cfiscope v0.1.11
• cfiscope v0.1.10
• memlens v0.3.24
• memlens v0.3.23: entry point and code-safety fixes
• memlens v0.3.22: per-CPU typing robust to IDA name rules
• memlens v0.3.21: headless runner for idalib
• memlens v0.3.20: per-CPU variables, one copy per CPU
• memlens v0.3.19
• memlens v0.3.18
• memlens v0.3.17
• memlens v0.3.16
• memlens v0.3.15
• memlens v0.3.14

Activity:

• btf2ida
  • 18c8c14c: CHANGELOG: modules without BTF, check_module, empty-struct count go i…
  • cbd3f071: Release check: any Linux version banner in the chosen file may match …
  • ee17d9ab: README: ar/tar alternative creates the deb folder first
  • 677082fa: pyright: declare BTF.unchecked_release; no open(None) for a database …
  • f95ab787: No-BTF module: refuse a vmlinux of another kernel release (vermagic v…
  • ee02047e: Module detection = section lookup (not a string search); 32-bit no-BT…
  • e2bec6e3: Summary counts empty structs/unions apart (forward declarations only)…
  • c00033f7: tests/check_module.py: fake-database run on a real .ko; README Try a …
  • 8527763b: F1 measured on Debian 13 nf_tables.ko without .BTF: 154 imports typed…
  • bcad2a22: README: modules with no BTF of their own (F1)
  • 66811a4e: Modules without their own BTF: type their imports from the chosen vml…
  • fd2364b8: 32-bit database: the summary says why no prototype was applied; READM…
  • 0ce968cc: README: demo prototype coverage re-counted on the current demo kernel…
  • 15ba3dcc: A base vmlinux without BTF gets a message that says why (bzImage: ext…
  • e67e91bb: CHANGELOG: AI-agent line for the next release
  • 4772df92: v0.1.19: headless runner never opens a file dialog
  • 81ab14c6: headless: no file dialog without a window (split BTF without –vmlinu…
  • c81bbf13: v0.1.18: headless runner for idalib (tools/btf2ida_headless.py); run_…
  • 70f77604: tests: synthetic __ksymtab test (4 layouts, GPL, code/data/writable c…
  • 3a5fe08c: v0.1.17: –prototypes comments out names that clash with a typedef or…
• cfiscope
  • 017a9e53: Manifest description says it has not yet been run in real IDA (as the…
  • 54f9e21c: v0.1.17 CHANGELOG corrected by a claims check (runtime comment text, …
  • d4670755: Runtime calls go to __cfi_check of the kernel or the module holding t…
  • aa9d7138: WIP docs: fixture block spacing condensed
  • 4310e0e7: WIP docs: README + CHANGELOG (Unreleased) for the labelled CFI runtim…
  • c90e15b8: WIP eval: runtime calls found from the code vs the symbol-based bucke…
  • c5cad60e: WIP IDA layer: comment the CFI runtime’s own calls (‘jtCFI runtime: c…
  • ee7e3a09: WIP fixture case call_inline (inlined slow path: find_check_fn, then …
  • 48e82b9a: WIP core/cli: Site.runtime_call_ea (inlined slow path blr = CFI runti…
  • 015375a6: docs: download link for the Android 12 GKI 5.10 measurement (README +…
  • 5b55de58: README/CHANGELOG: measured on Android 12 GKI 5.10 too (no code change…
  • 5e1e29c7: core: link a gap check through the register its slow path passes when…
  • 7beb894c: fixture case call_gap (mov between sub and ror; asserts the check sta…
  • c479f116: core: range checks with up to 4 unrelated words between sub and ror (…
  • c80c2a52: eval_gki_oldcfi: inlined tracepoint loops as their own bucket of unre…
  • 6ca92b0c: v0.1.17: aarch64 Linux 5.x jump-table CFI (Android 12/13 GKI 5.15)
  • 78193493: IDA layer: jump-table CFI candidates count as address taken through t…
  • 54b3faa2: core: range provenance (range_from), no stale ‘candidates unknown’ no…
  • d1d06f54: IDA layer: site_at prefers the exact call/check and the narrowest spa…
  • 1c554413: README: table row for coverage without the CFI runtime’s own calls
• memlens
  • fbfe84f1: Stub test: a listed CPU without a copy of the variable is skipped, la…
  • e241ca59: README + kernel2elf doc: name the split .percpu.cpu. sections a…
  • 85f13ac5: Per-CPU typing also takes split .percpu.cpu. sections (pre-rele…
  • bd8cf3bf: CHANGELOG: AI-agent line for the next release
  • a5a40d76: v0.3.24: per-CPU typing across CPU-number gaps; Ghidra column re-meas…
  • 354e1782: README: Ghidra column re-measured on current-code exports (all three …
  • 02f1d849: Per-CPU typing takes CPU numbers from the .percpu.cpu sections (no…
  • 6b7e84ad: README: the Export action asks for the ISF (Cancel = Volatility’s own…
  • 4cc5988e: v0.3.23: ELF entry = kernel text again (not per-CPU data); Apply kern…
  • 76ad6578: v0.3.22: per-CPU typing also finds cpu_ (only inside .percpu…
  • 31eee379: README: applied-globals note includes the per-CPU variables
  • a295f7db: kernel2elf README: percpu rows and –no-percpu (verified byte-identic…
  • 0530bb58: v0.3.21: headless runner for idalib (tools/memlens_headless.py) + stu…
  • ee2c67fc: CHANGELOG/WRITEUP: this_cpu_off holds the CPU’s per-CPU offset (on 7.…
  • b1b2b2c3: README: demo kernel.elf is 68 MB with the per-CPU areas
  • bb68c2a2: v0.3.20: per-CPU variables exported and typed, one copy per CPU
  • 7829a32f: per-CPU: take fixed_percpu_data and the variable at __per_cpu_start; …
  • dfff8ad8: IDA layer: type every CPU’s copy (cpu.) of per-CPU variables…
  • e65a0707: kernel2elf: export each CPU’s per-CPU area (.percpu.cpu, symbols c…
  • e970d554: v0.3.19: plugin loads on a Python without _lzma; .xz ISF gives one cl…