Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Plugin porting to rizin & cutter. Readme fix #9

Open
wants to merge 10 commits into
base: master
Choose a base branch
from
Open

Plugin porting to rizin & cutter. Readme fix #9

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
ff77334
Changed a little bit readme and few functions for correct working and…
Rukatonoshi Jul 28, 2022
016f048
Update README.md
Rukatonoshi Jul 28, 2022
3b7fccc
Merge pull request #1 from Rukatonoshi/Rizin_Porting
Rukatonoshi Jul 28, 2022
a76b690
Ported syms2elf plugin to cutter
Rukatonoshi Jul 28, 2022
d6a7f7a
Merge pull request #2 from Rukatonoshi/Cutter_Porting
Rukatonoshi Jul 28, 2022
2267a8e
Update README.md
Rukatonoshi Jul 28, 2022
28e9908
Update README.md
Rukatonoshi Aug 16, 2022
6893b05
Update README.md
Rukatonoshi Aug 16, 2022
a1b2053
Update README.md
Rukatonoshi Aug 16, 2022
e491a93
Update README.md
Rukatonoshi Aug 17, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 17 additions & 9 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,36 +1,41 @@
# syms2elf

The plugin export the symbols (for the moment only functions) recognized by IDA Pro and radare2 to the ELF symbol table. This allows us to use the power of IDA/r2 in recognizing functions (analysis, FLIRT signatures, manual creation, renaming, etc), but not be limited to the exclusive use of this tools.
The plugin export the symbols (for the moment only functions) recognized by IDA Pro and radare2 (also works for rizin and cutter) to the ELF symbol table. This allows us to use the power of IDA/r2 in recognizing functions (analysis, FLIRT signatures, manual creation, renaming, etc), but not be limited to the exclusive use of this tools.

Supports 32 and 64-bits file format.

## INSTALLATION

* **IDA Pro**: Simply, copy `syms2elf.py` to the IDA's plugins folder.
* **radare2**: You can install via r2pm: `r2pm -i syms2elf`
* **radare2**: In radare2 environment, pass this command: `#!pipe python ./syms2elf.py <output_file>`
* **rizin** : In rizin environment, pass this command: `#!pipe python ./syms2elf.py <output_file>`
* If you are using radare2, make sure that you have install r2pipe. You can use this command: `pip3 install r2pipe`
* For rizin: `pip3 install rzpipe`



## EXAMPLE

Based on a full-stripped ELF:

```
$ file test1_x86_stripped
test1_x86_stripped: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, stripped
```$ file test_x86
testfile_x86: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=7ee4206d91718e7b0bef16a7c03f8fa49c4a39e7, stripped
```

Rename some functions in IDA or r2, run `syms2elf` and select the output file.

![IDA output log](https://cloud.githubusercontent.com/assets/1675387/13477862/a02aa742-e0ce-11e5-835e-3a0992a3f171.png)

![r2_syms2elf](https://cloud.githubusercontent.com/assets/1675387/13831270/adddfae2-ebd2-11e5-8dcd-877c9c67faed.png)
![r2_syms2elf](https://user-images.githubusercontent.com/40752497/181514837-0fe5de8a-29db-4a67-a614-f10a773b5e1c.png)

![cutter](https://user-images.githubusercontent.com/40752497/181536360-f725857c-1893-48c4-ac4a-96288a034b31.png)


After that:

```
$ file test1_x86_unstripped
test1_x86_unstripped: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, not stripped
$ file test_x86_unstripped
test_x86_unstripped: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=7ee4206d91718e7b0bef16a7c03f8fa49c4a39e7, not stripped
```

Now, you can open it with others tools and analyzing in a more comfortable way.
Expand All @@ -39,7 +44,10 @@ Now, you can open it with others tools and analyzing in a more comfortable way.

* Daniel García (@danigargu)
* Jesús Olmos (@sha0coder)

* Ivan Stupnitskiy (@YanagiRu) -- plugin porting
## CONTACT

Any comment or request will be highly appreciated :-)

## AND ALSO
This modification (plugin porting to rizin & cutter) was started as a part of [Digital Security](https://github.com/DSecurity)'s Research Centre internship ["Summ3r of h4ck 2022"](https://dsec.ru/about/vacancies/#internship).
Loading