Panopticon: A libre, cross platform disassembler for reverse engineering • Hacker News Board

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#31

Post by dman » Mon, May 09, 2016, 7:17 PM UTC

Someone wrote: post #27

dman wrote: post #23

Earlier quoted context omitted.

Isnt this whole category of bugs easily avoided by using 1. _SECURE_SCL on windows 2. _GLIBCXX_DEBUG on glibc based toolchains

Those do not remove any bugs; it just changes how they are handled (ignore and hope for the best vs print diagnostic and terminate program, and the latter not in all cases)

Assuming that tests exist, and have good coverage, wont the checked iterator implementations mentioned above catch most issues with invalid iterators?

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#32

Post by pcwalton » Mon, May 09, 2016, 7:17 PM UTC

dman wrote: post #23

pcwalton wrote: post #8

Earlier quoted context omitted.

Yeah, it's really interesting how many iterator invalidation bugs you find in real C++ codebases. It's so easy to think that they don't exist until you have a tool (or a human) actively searching for them…

Isnt this whole category of bugs easily avoided by using 1. _SECURE_SCL on windows 2. _GLIBCXX_DEBUG on glibc based toolchains

No. You can dereference those "safe" iterators into dangling references.

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#33

Post by q3k » Mon, May 09, 2016, 7:18 PM UTC

School-Cotton wrote: post #10

Anyone know how this compares to IDA Pro ?

This has almost none of the important features of IDA Pro:

  - advanced interactivity (function boundary change, switch table options...)
  - stack pointer tracking and stack recovery
  - structure and enum definition, use in disassembly
  - compiler and static library recognition
  - an industry-standard decompilation plugin (Hex-Rays Decompiler)
  - support for quick scripting using a high-level interpreter language (IDC/IDAPython)

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#34

Post by khan20 » Mon, May 09, 2016, 7:20 PM UTC

Author here. Panopticon grew out of my frustration about the lack of usable implementations of cutting-edge program analysis research and the fact that the industry standard for RE is a proprietary software that looks like Windows 95. I toyed with the idea of rewriting it in Rust since 1.0 became stable. The whole port took around 3 months. I got the size down from 10.000 to 8.000 loc. Looking back it was the right decision. Programming in Rust is not only more fun, it's definitely easier too. Panopticon used alot sum types that were implemented using boost::variant. Like everything with Boost it kind of worked but was incredible ugly and complex. Replacing them with enums was probably the biggest reason I switched to Rust. Also I found iterator invalidation bugs simply by translating C++ to Rust, thanks Borrow Checker!

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#35

Post by dikaiosune » Mon, May 09, 2016, 7:20 PM UTC

dman wrote: post #31

Someone wrote: post #27

Earlier quoted context omitted.

Those do not remove any bugs; it just changes how they are handled (ignore and hope for the best vs print diagnostic and terminate program, and the latter not in all cases)

Assuming that tests exist, and have good coverage, wont the checked iterator implementations mentioned above catch most issues with invalid iterators?

A big part of what makes Rust great is that it catches those issues at compile-time, no test coverage required, no extra run-time checks required (not that it moots tests, of course). In my experience so far this is a very powerful ally to have when writing software, as it's very useful to surface those issues as early as possible.

EDIT: Also:

> Assuming that tests exist, and have good coverage

That's a very big assumption. Granted my current job is often to clean up codebases that are the opposite of that, so maybe I've got a bias here.

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#36

Post by pcwalton » Mon, May 09, 2016, 7:21 PM UTC

dman wrote: post #31

Someone wrote: post #27

Earlier quoted context omitted.

Those do not remove any bugs; it just changes how they are handled (ignore and hope for the best vs print diagnostic and terminate program, and the latter not in all cases)

Assuming that tests exist, and have good coverage, wont the checked iterator implementations mentioned above catch most issues with invalid iterators?

I don't know of any large, widely used, security critical, heavily scrutinized C++ program that uses those flags in production. I also don't know of any such C++ program that hasn't had game-over use after free bugs. So the answer to your question is somewhere ranging from "we don't know, but unlikely" to "no".

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#37

Post by q3k » Mon, May 09, 2016, 7:21 PM UTC

busterarm wrote: post #26

School-Cotton wrote: post #20

Earlier quoted context omitted.

Yeah, it matters. If this is better, I'll use this; if IDA is better, I'll use IDA. I'm not 100% sure I understand your comment. Btw, most companies can afford an IDA license. It's pretty cheap compared to the salary of a developer, at least in the coastal US.

If your job can justify it, great, but mine can't. I want it for personal use and I can't justify it.

If you have more time than money, here's a possible option:

  - Buy IDA Pro using a credit card
  - Find bug or two, submit to bug bounty [1]
  - Pay back credit using bug bounty money

[1] - https://www.hex-rays.com/bugbounty.shtml

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#38

Post by corecoder » Mon, May 09, 2016, 7:21 PM UTC

dkopi wrote: post #22

joshuamcginnis wrote: post #13

Earlier quoted context omitted.

I mean even more high level than this. If I open a binary, can I just write the new machine code to it directly and not be concerned with recompiling?

Usually. Just make sure the new machine code is the same size as the old. That said, if the code is signed and there's a signature check - the check will fail if you modify the code. If the signature is a simple crc/checksum, you could also update the checksum. If it's a cryptographic signature, it might be a lot more difficult.

Or, you also have to modify the check code.

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#39

Post by busterarm » Mon, May 09, 2016, 7:27 PM UTC

jcranmer wrote: post #29

busterarm wrote: post #26

Earlier quoted context omitted.

If your job can justify it, great, but mine can't. I want it for personal use and I can't justify it.

There's an evaluation version of IDA that's an older version and doesn't include 64-bit disassembly (just x86 and ARM IIRC), but it's free.

And is not available for my operating system.

Re: Panopticon: A libre, cross platform disassembler for reverse engineering

#40

Post by StripeNoGood » Mon, May 09, 2016, 7:31 PM UTC

School-Cotton wrote: post #10

Anyone know how this compares to IDA Pro ?

It doesn't. IDA is a result of years of development & research, it's so big no other project got even closer to it. It's so big, the comparison is like you would compare a new startup to Google.