search

rizinorg / ideas

Features that would be nice to have but they are not in the roadmap
3 stars 0 forks source link

Add support for public signature server #41

Closed ogre2007 closed 1 year ago

ogre2007 commented 1 year ago

Rizin lacks support for public or private signatures server, and there is open implementation for lumina https://github.com/naim94a/lumen . Maybe we should implement support for this server? Obviously, it should be very optional feature, but I'm confident that it helps rizin become more popular in collaborated RE.

Describe the solution you'd like Implementation of lumina client in rizin

Describe alternatives you've considered Create some other public server/client, that will be based on open source rizin protocol.

ret2libc commented 1 year ago

If that's going to be done, I'd start it as a separate Core plugin in rizin-extras that could be installed with rz-pm.

ogre2007 commented 1 year ago

I've did a little research on the topic, and found out the main problem with lumina - IDA's proprietary function hashing algo (see https://github.com/naim94a/lumen/issues/2). And it is different from FLIRT signatures. Its simple, but yet very tricky to implement: bitmask is calculated for function bytes, mask's 1s is where variable code position dependent offsets is stored E.g. mask for bl printf will be FFFFFF00h(rizin analysis mask is 0000F0FFh- very different value), but for near jumps - eg ble $pc + x there is no such bits: 00000000h(rizin mask is 0000F0FFh again) . For data loading ldr r0, [str.Hello] from data it will be FF0F0000h (rizin analysis mask is once again 0000F0FFh). Then md5 is computed from FUNC_BYTES & (~MASK_BYTES) concatenation with MASK_BYTES which can be used for lumina protocol. As you can see, difficult part is to create this function mask, which is impossible without IDA-like instruction processing.

XVilka commented 1 year ago

Fixed by https://github.com/rizinorg/rz-silhouette If you have any more suggestions/questions/etc - open an issue, PR, or discussion in that repository.