Output for BinNavi

[manizzle]

BinNavi was open-sourced recently. We should have a flag for radare2 to output a format compatible with the BinNavi format. Even though BinExport is not open sourced, there are multiple public implementations showing how to create the sql queries needed to load disassembly into the BinNavi DB, which is then converted to REIL internally for select architectures. Since radare2 has support for converting from ESIL to REIL (https://github.com/radare/radare2/commit/1d89f7d7996e67ea9275fc1318aeb9390def27cc) we could probably rework BinNavi later to also take REIL directly from radare2 instead of doing translation by its self. This would allow more architectures to be supported than the 3 architectures supported by BinNavi right now.

I think first step would be to just replicate some of the known implementations (https://github.com/google/binnavi/issues/28) of disassembly -> BinNavi import and then working on replacing REIL import with radare2 can be step 2.

P.S: Can maybe win conference tickets :)

[radare]

+1 this was already discussed the day binnavi was opensauced. i just can't focus on this task right now, feel free to take it

[Maijin]

@manizzle see https://github.com/radare/radare2-bindings/tree/master/r2pipe/java

[dukebarman]

:+1: It will be a great!

[jvoisin]

I think that crowell had a PoC in ruby for this.

[Manouchehri]

Google recently open sourced their exporter plugin too.

https://github.com/google/binexport

[bzz]

Would be great to be able to load radare2 disassembly to BinNavi. Do you guys know if there are there any updates on this beside https://github.com/google/binnavi/wiki/Replacing-IDA-as-Disassembler-Frontend ?

[manizzle]

I wanted to work on this but I had a problem with creating the IL for BinNavi due to this issue. https://github.com/radare/radare2/issues/4456

Any here on this thread have a solution to this? I could use capstone along side r2 but it seems hacky

[manizzle]

@Manouchehri I sent you a DM on Twitter. I am most curious how you exported expression nodes and expression tress for individual instructions. I have problems getting fine grained operand information from just radare right now. Only other way would be to use radare's https://github.com/radare/radare2/blob/master/libr/anal/esil2reil.c

Here is the SQL schema we need to import into: https://www.zynamics.com/binnavi/manual/html/dbformat.htm

[XVilka]

I would advise you to give a look to RadecoIL and consider implementing diffing engine on top of it instead: https://github.com/radare/radeco-lib/tree/master/src/middle

[manizzle]

@XVilka Hey man. Would you consider https://github.com/radare/radeco-lib/blob/master/src/middle/ir.rs to be a better ESIL translator than https://github.com/radare/radare2/blob/master/libr/anal/esil2reil.c ? I am thinking of maybe lifting the radeco IL to REIL if the support is better. At this point, I think feeding REIL directly to BinNavi would be the best option for this particular radare->BinNavi task

Also, for BinDiff, if we were to use the radeco IL, BinDiff still requires that specific instructions supplied so when basic blocks are showed to be different, more detailed information like number of instructions/instruction types and arguments, can also be shown to the user. I like the idea of using radecoIL because the CFG would probably be much cleaner, but it then destroys the original instruction context. Is there a way to go from radeco IL back to native instructions easily?

[XVilka]

Also interesting and relevant tool:

• https://github.com/ubfx/BinDiffHelper

  Importing Table

  

  Successfully renamed functions