Dynamic Data Resolver

Dynamic Data Resolver (DDR) is an IDA plugin that consists of three components:

• A DynamoRIO client extension DLL
• A DDR server
• The IDA DDR plugin

The IDA plugin acts as a frontend for the DynamoRIO client DLL which is using instrumentation to build an instruction trace for a malware sample. During this trace, all relevant dynamic values like registers or memory pointers are logged. This means that the analyst can resolve these values (such as 'call eax') during static analysis in an IDA session. You can find more information in this blog post, and download the code from GitHub.