New Binary Ninja Plugin

[xfoxfu]

This new version of Binary Ninja plugin will provide better experience over the existing one.

Features

It will not load the entire il2cpp.h header file into Binary Ninja, since this is super slow on big projects. (Shall we add an option to allow the user to still load the entire header file?)

When the user wants to get type information on a function or a static ScriptMetadata item, the user would use Il2Cpp Annotate from the plugin menu to load function signature and all related global variable types. (Note: the type may not update immediately after annotation for Binary Ninja's problem, so the user has to manually switch to graph view and back to get the views updated.)

It no longer requires preprocessing header file with il2cpp_header_to_binja.py. Instead, it uses tree-sitter to compute the type dependencies to comply with Binary Ninja's C++ parser.

It additionally loads ScriptMetadata and ScriptMetadataMethod.

Demo

Load

The menu Il2Cpp Load loads script.json and il2cpp.h to the Binary Ninja instance.

It can optionally mark the functions and global variables with names, string literal values, etc. If the user opens an existing BNDB, it does not need to load names, and this will make loading faster.

After loading and marking names, the functions and global data variables are marked without types.

Annotate

The menu Il2Cpp Annotate will load type information for a given function or data variable. The user does not have to select precisely the beginning of the function. It will detect the surrounding function at the current cursor position.

Annotate is only available after loading. If the user saves the project as BNDB, and reopens it, it requires to use Il2Cpp Load first without loading the names (Skip naming = Yes).

Annotate will load the types and all its dependents to Binary Ninja, and then load the function signature type or the data variable type.

After annotating function, the analysis may not update. The user has to switch to graph view and back to get it updated (shortcut: press Space twice). This is a known problem of Binary Ninja.

Credits to @SyxP and @exstrim401 for their existing work. This code is based on @SyxP 's IL2CPPDumperBinja and @exstrim401 's version in this repository.

[SyxP]

Note to self and other people using this:

Line 197 of _init_.py may need to be changed to tys = self.bv.parse_types_from_string(header, None, default_dirs) where default_dirs can be found via https://docs.binary.ninja/guide/type.html#finding-system-headers if it gives the following error while running Annotate:

[Default]   File "/home/syx/Documents/binaryninja/plugins/../python/binaryninja/binaryview.py", line 6889, in parse_types_from_string
[Default]     raise SyntaxError(error_str)
[Default] SyntaxError: error: sources.hpp:1:10 'stdint.h' file not found

[unknowntrojan]

when running on nightly versions of Binja, and soon on stable, before creating any undo actions you need to group them between calls to bv.begin_undo_actions() and bv.end_undo_actions(). easy fix, although annoying, it does increase undo performance a lot.

[bobberman]

Thanks! The plugin is amazing! :)