cmu-sei / pharos

Automated static analysis tools for binary programs
Other
1.51k stars 186 forks source link

Add Cutter/Rizin/Radare2 plugins #48

Open XVilka opened 4 years ago

XVilka commented 4 years ago

Since you have now plugins for IDA Pro and GHIDRA, what about doing that for rizin/Cutter too?

Rizin is a highly-portable cross-platform reverse engineering framework and a toolkit without dependencies. It has support for analyzing binaries, disassembling code, debugging programs, attaching to remote GDB/LLDB, WinDbg servers, rich plugin system (see rz-pm), and integration with various decompilers. For example, ghidra decompiler plugin - rz-ghidra. It is actively developed and can be easily integrated in various open source and commercial products.

image

For documentation on writing plugins for rizin see Scripting and Plugins Rizin Book chapters.

Cutter is a crossplatform Qt/C++ GUI frontend to rizin:

image

For documentation on writing plugins for Cutter see the official tutorial and the curated list of various popular plugins.

sei-ccohen commented 4 years ago

This sounds like a great idea, and we'd welcome a pull request or even an independent repo that would connect the OOAnalyzer technology to Radare2. :-) Our team had a special interest in developing a Ghidra plugin, but we aren't prepared to allocate the resources to developing one for Radare2 at the moment.

On the positive side, both the IDA Pro plugin and the Ghidra plugin work by reading the JSON file produced by OOAnalyzer, and since it proved sufficient for implementing both of those plugins, so there's a good chance that no special knowledge of Pharos or OOAnalyzer internals will be required to create the plugin for Radare2. If any changes are required to JSON format to support Radare2, we'd be willing to work with someone on that. If you or anyone else that sees this message is interested in developing an OOAnalyzer plugin for Radare2, please feel to reach out to me in email to discuss the specifics, ask questions about the JSON format, etc. Hopefully we'll see a Radare2 plugin as well at some point.

uditagarwal97 commented 4 years ago

@XVilka @sei-ccohen Instead of a plugin, I have rather written a small python script(That can be found here: https://github.com/madaari/pharos/tree/master/tools/ooanalyzer/radare2) similar to ida2r2.py to parse OOAnalyzer's output JSON file and export relevant info as Radare2 script.

sei-ccohen commented 4 years ago

@madaari Thanks for this Radare2 add-on. I haven't had a chance to test it personally, but we'll leave the issue open to help other people looking for a Radare2 capability find your script repository. We just pushed a non-trivial update to OOAnalyzer. You might want to test your script again and make sure that we haven't broken anything on your end.

XVilka commented 4 years ago

@madaari you can send it to the r2pm repository:

uditagarwal97 commented 4 years ago

@madaari you can send it to the r2pm repository:

Sure. I just need to make a few more changes in that script and will then open a PR to r2pm.