Contributed By Check Point Software Technologies LTD.
It can be useful in the following cases:
We support the following list of debug backends for now:
Labeless is a multipurpose IDA Pro plugin system for labels/comments synchronization with a debug backend, with complex memory dumping and interactive Python scripting capabilities. It consists of two parts: IDA plugin and debug backend's plugin.
Labeless significantly reduces time that researcher spends on transferring already reversed/documented code information from IDA (static) to debugger (dynamic). It saves time, preventing from doing the same job twice. Also, you can document and add data to the IDB on the fly and your changes will be automatically propagated to debug backend, even if you will restart the virtual machine or instance of debug backend will crash. So, you will never lose your research.
This solution is highly upgradable. You can implement any helper scripts in Python on debug backend's side and then just call them from IDA with one line of code, parsing the results and automatically propagating changes to IDB.
We can take that memory region and put it in the IDB, fixing imports 'on-the-fly', using debug backend's functionality. No more need in ImpRec or BinScylla, searching for the regions in memory that contain the real IAT, because we get that information dynamically from the debugged process itself.
As a result we have a lot of memory regions that may represent even different modules (if the unpacking process if multistage) with valid references between them, which gives us a possibility to build a full control flow graph of the executable. Basically, we will end up with one big IDB, containing all the info on the specific case.
If you want to use both x86 and x86_64 targets, then you should do the following steps for each python distro.
deploy
directory to target machine, where you want to use a debugger backendprotobuf 2.6.1
using the following commands:cd c:\deploy
c:\Python27\python.exe setup_protobuf.py
labeless
python module, there are two ways to archive that, the first one is to use PyPI in case you have an Internet connection on the debug machine:pip install --upgrade labeless
In case you don't have an Internet connection, you could install prebuilt module from release archive:
cd c:\deploy
c:\Python27\Scripts\pip.exe install labeless-1.1.2.65-py2.py3-none-any.whl
Note: If you have already used Labeless before and you want to update it, don't forget to reinstall python module each time you have new release
plugins
directoryLabeless supports Windows and Linux (starting from 6.9.5 version of) IDA PRO. Labeless handles only PE/AMD64 binaries. Labeless requires IDAPython plugin python.[plw|p64|plx|plx64]
(it ships with IDA PRO, but make sure it works well).
There are plugins:
IDA[XX]\plugins\labeless_ida.plw - for IDA for Windows, handles 32-bit binaries (used with idaq)
IDA[XX]\plugins\labeless_ida.p64 - for IDA for Windows, handles 64-bit binaries (used with idaq64)
IDA[XX]\plugins\labeless_ida.plx - for IDA for Linux, handles 32-bit binaries (used with idaq)
IDA[XX]\plugins\labeless_ida.plx64 - for IDA for Linux, handles 64-bit binaries (used with idaq64)
Copy Labeless plugins to your IDA's plugins
directory, for example c:\IDA68\plugins
In case you have IDA for Windows, please, use .plw
/.p64
plugins.
If you have IDA for Linux, please, use .plx
/.plx64
plugins. Also, copy IDA[XX]/libprotobuf.so.9
to your IDA home directory (for example /home/alex/ida695/
), it's an important library.
You may find prepared debugger in the following directory OllyDbg110
. (Note!: Don't forget to set up debugger's plugins
directory).
Copy DeFixed110\plugins\labeless_olly_foff.dll
to DeFixed plugins
directory (Note!: Don't forget to set up debugger's plugins
directory)
You may find prepared debugger in the following directory OllyDbg201
. (Note!: Don't forget to set up debugger's plugins
directory).
You may find prepared debugger in the following directory x64dbg
.
LL: ok, binded at <IP>:<PORT>
message, its presence means that debug backend-side plugin is initialized successfully. Note: if you start many debuggers, you may see that the following message appearsAlso, you may see the firewall alert
If you want to access the debug backend from another computer, you should allow the backend to listen by this dialog or manually.
Labeless
-> Load stub database...
from the menuEdit
-> Plugins
-> Labeless
Labeless
-> Settings...
Alt+Shift+E
Successfully connected!
, then configuration is done correctly.configure -platform win32-msvc2010 -shared -release -no-webkit -opensource -no-qt3support -no-phonon -no-phonon-backend -opengl desktop -nomake demos -nomake examples -nomake tools -no-script -no-scripttools -no-declarative -qtnamespace QT
Repeatable - are comments, which IDA shows in any referenced place.
Labeless
-> Sync labels now
from IDA's main menuIssue with Python 2.7.11 is described here, so avoid usage of this version. The latest stable supported version is 2.7.10.