Accenture / VulFi

IDA Pro plugin for query based searching within the binary useful mainly for vulnerability research.
Apache License 2.0
530 stars 62 forks source link

[Improvement Simplified]Add batch program automatic running function #15

Open zhefox opened 11 months ago

zhefox commented 11 months ago

Implementation idea: By using the batch functionality of IDA, determine if IDA has finished loading before starting the plugin. After the execution is complete, save the data to a CSV file, close IDA, and open the next one.

import idaapi
import idautils
import idc
def do_some_analyse():
    pass
def main():
    idc.Wait()   # wait for analysis completed
    do_some_analyse()
    idc.Exit(0)  # shutdown IDA
if __name__ == "__main__":
    main()

then use such as this can batch processing

!#/usr/bin/env/ python
import os
import subprocess
ida_path = "D:/Program Files/IDA 7.7/ida.exe"
work_dir = os.path.abspath('.')
pefile_dir = os.path.join(work_dir, 'pefile')
script_path = os.path.join(work_dir, "analysis.py")
for file in os.listdir(pefile_dir):
    # cmd_str = ida.exe -Lida.log -c -A -Sanalysis.py pefile
    cmd_str = '{} -Lida.log -c -A -S{} {}'.format(ida_path, script_path, os.path.join(pefile_dir, file))
    print(cmd_str)
    if file.endswith('dll') or file.endswith('exe'):
        p = subprocess.Popen((cmd_str))
        p.wait() 
Martyx00 commented 11 months ago

All you need to do is import the vulfi.py file, create scanner instance with vulfi_scanner = VulFiScanner(json.load(rules_file)) and start the scan with scan_result = vulfi_scanner.start_scan([]). After it completes the scan_result will hold a list with the results. You could save or process these results whatever way you like. This does not really require any changes to the plugin, what you want in this case is just to create a wrapper for it. Let me know if the suggested approach does not work, otheriwse I think the plugin supports batch processing if you wrap it so no change is required.