51–60 of 90 posts
Author here. Panopticon grew out of my frustration about the lack of usable implementations of cutting-edge program analysis research and the fact that the industry standard for RE is a proprietary software that looks like Windows 95. I toyed with the idea of rewriting it in Rust since 1.0 became stable. The whole port took around 3 months. I got the size down from 10.000 to 8.000 loc. Looking back it was the right d…
Btw, that guy isn't me.
Earlier quoted context omitted.
There are sometimes tricks that get you around this problem, too: you can sometimes patch in a trampoline, which gives you some flexibility in the instructions you get to use.
An alternate direction rather than your standard jmp/displacement/nop'ing-to-align would be to use Dyninst[1] and live patch in memory[2]. Really though, your standard hex-editor will have facilities to alter all the necessary relatives. If you have access to modify the binary, no need to put in a trampoline (though it's awfully handy when playing CTFs!) Honestly, do we really need another static analysis tool? Hoppe…
Definitely. IDA Pro is proprietary software and the possibilities of IDAPython are limited. IDA Pro mostly ignores the last two decades of research done in the field of binary program analysis. It still relies on pattern matching compilers instead of using semantics driven methods that have been around for >10ys. While there exist tools like BAP, BitBlaze, Jackstab and Bindead. They are not really usable for people w/o graduate student level understanding of program analysis. This is where Panopticon fits in.
Earlier quoted context omitted.
If your job can justify it, great, but mine can't. I want it for personal use and I can't justify it.
If you have more time than money, here's a possible option: - Buy IDA Pro using a credit card - Find bug or two, submit to bug bounty [1] - Pay back credit using bug bounty money [1] - https://www.hex-rays.com/bugbounty.shtml
Author here. Panopticon grew out of my frustration about the lack of usable implementations of cutting-edge program analysis research and the fact that the industry standard for RE is a proprietary software that looks like Windows 95. I toyed with the idea of rewriting it in Rust since 1.0 became stable. The whole port took around 3 months. I got the size down from 10.000 to 8.000 loc. Looking back it was the right d…
Btw, that guy isn't me.
Metasm: https://github.com/jjyg/metasm/
Radare: http://radare.org/
Capstone: http://www.capstone-engine.org/
Capstone is based on LLVM, that you cannot beat in term of architectures and industrial quality, and has great plugins, which make it kind of my favorite.
Of course, for non-scripting needs, you need decent graphical interfaces, as provided by these ones:
IDA: https://www.hex-rays.com/products/ida/
Hopper: http://www.hopperapp.com/
IDA is clearly the best, but Hopper is a fair choice if you need it and you can't afford IDA license for personal use.
[Edit: add forgotten IDA and Hopper...]
Earlier quoted context omitted.
An alternate direction rather than your standard jmp/displacement/nop'ing-to-align would be to use Dyninst[1] and live patch in memory[2]. Really though, your standard hex-editor will have facilities to alter all the necessary relatives. If you have access to modify the binary, no need to put in a trampoline (though it's awfully handy when playing CTFs!) Honestly, do we really need another static analysis tool? Hoppe…
>Honestly, do we really need another static analysis tool? Definitely. IDA Pro is proprietary software and the possibilities of IDAPython are limited. IDA Pro mostly ignores the last two decades of research done in the field of binary program analysis. It still relies on pattern matching compilers instead of using semantics driven methods that have been around for >10ys. While there exist tools like BAP, BitBlaze, Ja…
Requisite Rust fanboy'ing: GitHub stats say 90% Rust code.
Great work. Therefore that's one more disassembler in the wide. Some of the great open source ones, reverse oriented, that I have been able to test are: Metasm: https://github.com/jjyg/metasm/ Radare: http://radare.org/ Capstone: http://www.capstone-engine.org/ Capstone is based on LLVM, that you cannot beat in term of architectures and industrial quality, and has great plugins, which make it kind of my favorite. Of…
x64dbg: http://x64dbg.com/
Great work. Therefore that's one more disassembler in the wide. Some of the great open source ones, reverse oriented, that I have been able to test are: Metasm: https://github.com/jjyg/metasm/ Radare: http://radare.org/ Capstone: http://www.capstone-engine.org/ Capstone is based on LLVM, that you cannot beat in term of architectures and industrial quality, and has great plugins, which make it kind of my favorite. Of…
Great work. Therefore that's one more disassembler in the wide. Some of the great open source ones, reverse oriented, that I have been able to test are: Metasm: https://github.com/jjyg/metasm/ Radare: http://radare.org/ Capstone: http://www.capstone-engine.org/ Capstone is based on LLVM, that you cannot beat in term of architectures and industrial quality, and has great plugins, which make it kind of my favorite. Of…