Results 1 to 8 of 8

Thread: IDA Pro - Automated Function Recognition on large binaries

  1. #1
    ::[ Reverse Engineer ]:: OHPen's Avatar
    Join Date
    Nov 2002
    Location
    .text
    Posts
    399
    Blog Entries
    5

    IDA Pro - Automated Function Recognition on large binaries

    Hi,

    I'm currently working on very large binary round about 40 MB. Because I'm facing frequent updates on the binary I have to write a plugin which automatically identifies all the functions I already have reverse engineered ( sure, I mean only the unchanged ones... ). I don't want my comments and changes to be applied manually on and on and on, all the time. I know there are free tools out for binary diffing, but i need a custom tool. My approach would be to retrieve all relevant data of a certain function and hash whatever all parts which are somehow static ( excluding opcodes which have relocations applied on and so on... ). Afterwards I would store the signature + information in a database, so that pattern can be used for searching the next time. If a special signature is no longer found ( lets say after the 3rd update of the binary, i discard it, because i can assume that this code was either heavily changed and thus have to be reverse engineered manually again or it was removed )

    I've never done this but now i need it because of the size and the frequent changes of the binary.

    What do you think ?

    What is the most efficient way to approach this ? I have no problem to invest few weeks on this, so even more complex ideas are welcome. Looking forward to your replys !!

    Thx in advanced!

    Regards,
    OHPen
    - Reverse Enginnering can be everything, but sometimes it's more than nothing. Really rare moments but then they appear to last ages... -

  2. #2

    As Above

    IDA Signature tools (ones creating the .sig files) would be your best bet. While not really able to take care of relocated code, it can easily work with identification of bytes in the functions that remain static (mostly).

    For adding comments and identifying parameters (or naming them) creating .til files will help you there.

    Have Phun
    Blame Microsoft, get l337 !!

  3. #3
    ::[ Reverse Engineer ]:: OHPen's Avatar
    Join Date
    Nov 2002
    Location
    .text
    Posts
    399
    Blog Entries
    5
    hey aimless,

    i used flirt stuff before, but this is not exactly what I need. Sure it is widely used for signature creation, but as you already mentioned not a "complete" solution. I have to admit that i already forgot about the til export feature , but nevertheless i want a combined solution..

    I will have to continue my thinking about my problem. I'm pretty sure that I will end-up with coding something custom ;D

    Thank you anyway!

    Regards,
    OHPen
    - Reverse Enginnering can be everything, but sometimes it's more than nothing. Really rare moments but then they appear to last ages... -

  4. #4

    As Above

    Alternatively,

    http://old.idapalace.net/

    There are plugins that convert IDB to SIG and vice versa. Should be useful?

    Have Phun
    Blame Microsoft, get l337 !!

  5. #5
    ::[ Reverse Engineer ]:: OHPen's Avatar
    Join Date
    Nov 2002
    Location
    .text
    Posts
    399
    Blog Entries
    5
    That might be interesting, thank you!

    I will have a look this evening.

    Regards,
    OHPen
    - Reverse Enginnering can be everything, but sometimes it's more than nothing. Really rare moments but then they appear to last ages... -

  6. #6
    <script>alert(0)</script> disavowed's Avatar
    Join Date
    Apr 2002
    Posts
    1,281
    http://recon.cx/2012/schedule/attachments/51_recon-crowdre-final-120621174609-phpapp02.pdf

  7. #7

    As Above

    Too much glitter.

    Not enough gold.

    Presentation leans towards "CORPORATE" language. Corporate-hep, I call it.

    CrowdRE indeed. Sounds more like a wannabe Microsoft in the making.

    I'll pass, personally.

    The consideration, however, did not go wasted. Thanks, as always Disa. Always ready to help. A bow of the hat to you.

    Have Phun
    Blame Microsoft, get l337 !!

  8. #8
    Zynamics/Google BinDiff is a IDA diffing tool that has a "port" feature where you can take names, labels, comments that it finds matches from one IDB to another. AFAIK it's currently the only one that has such a feature.
    BinDiff used to choke on anything but small IDBs; it would take maybe a day or more to process a medium to large IDB if it didn't crash first leaving behind tens of thousands of little temp files behind.
    Then around the time that Jeong Wook's DarunGrim (another diffing tool but free and probably better) BlackHat USA 2010 talk, BinDiff mysteriously got fixed quite a bit.
    I tried a later BinDiff ver 4.0.1 and while they did fix the weird temp file allocation architecture for general diffing, I'll be damned but they left the same crazy machination for the port feature. Try it (with Process Explorer or something) and you see it R/W who knows how many thousands of temp files per second. My hard drive clatters off sounding like a A-10 Warthog chaingun. I thought it would seriously lead to premature HD death letting it do it's thing for hours.
    Please Zynamics, it's okay to use memory; most users PC's will have gigabytes of free memory. You don't have to use an archaic 1970's architecture design with tiny ~1KB file buffers and work in ten zillion little temp files. It's also terribly slow, as hello! - such file I/O can be a major bottleneck.
    Maybe it can be workable (and save your drives) if you can somehow make it use a RAM disk for it's temp file space.

    DarunGrim unfortunately has no "port" feature, but I'm currently rewriting a version of it that is faster (to better facilitate large IDBs) that has one.
    You could do the same using the DarunGrim, or Turbodiff, source et al to make your own with a porting feature that you want.

    If you want to go the SIG route. My plug-in will make a .PAT file that you can make a signature of:
    "IDA2PAT Reloaded" http://www.macromonkey.com/bb/viewtopic.php?f=65&t=710
    Last edited by Sirmabus; December 15th, 2012 at 06:31.

Similar Threads

  1. Precompiled PySide binaries for IDA Pro
    By Hex Blog in forum Blogs Forum
    Replies: 0
    Last Post: May 18th, 2011, 12:20
  2. Windows Error-Program too large to fit in memory
    By charcoal in forum OllyDbg Support Forums
    Replies: 1
    Last Post: April 25th, 2003, 15:02
  3. ReVirgin 1.31 problem with large IAT
    By Lbolt99 in forum Tools of Our Trade (TOT) Messageboard
    Replies: 2
    Last Post: May 6th, 2002, 19:48
  4. Softice and large memory configuration
    By Anticode in forum Tools of Our Trade (TOT) Messageboard
    Replies: 3
    Last Post: November 14th, 2001, 17:01
  5. WDASM page faults with large files?
    By nud in forum Tools of Our Trade (TOT) Messageboard
    Replies: 1
    Last Post: January 22nd, 2001, 00:58

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •