-
-
Notifications
You must be signed in to change notification settings - Fork 372
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Research ideas #251
Comments
Hope this makes sense as a feature. |
About the relative position for functions, in the currently in development version of Diaphora I'm using the concept of compilation units to try to workaround this problem. In case you are curious, compilation units boundaries are guessed using the old version of CodeCut's LFA (Local Function Affinity) algorithm and also IDA Magic Strings to extract and use (when it's available) the source code file names from debugging strings. Basically, if CodeCut says "there is a compilation unit from this address to this address", and then IDAMagicStrings says "these functions belongs to this source code", Diaphora will take the minimum address assigned by either IDA Magic Strings or CodeCut, as well as the maximum address found by any of these two methods, and create a single compilation unit for them. Compilation units are them, later on, used in Diaphora heuristics in various ways to favour matching functions in the same compilation unit instead of matching in random different areas. However, we don't always have meaningful enough information as to do this properly. About mangled and unmangled names, Diaphora uses both and, if I remember correctly, it handles both cases properly, but I will put this review task in my to-do and verify at some point. The development of Diaphora 3.0 is still going on and it will take me quite some time yet to finish it, as I do it in my spare time (which is fine and fun). |
CodeCut's LFA was new to me but IDA Magic Strings is something I am familiar with. Used it quite a lot to get an idea of what type libraries to create or if I should create a FLIRT signature using flair. As for IDA Magic Strings determining what functions belong to what source code, is that separate from how it generates Candidate Function names? The candidates it suggests have been quite hit and miss. Especially since it on several occasions presented candidates based on a single .rodata refererence (example from what I am looking at now it suggests "sinherit" (string in rodata="%*sinherit" ) and only giving a one word lower case candidate while the function also does another function call to a function named "CRYPTO_free" and one other rodata xref in the function named "CryptoX509v3V3". This lead me to assume the proper name for the Class could be CryptoX509v3 and function SubjectInheritance. In the other Issue i participated in that were about Diaphora freezing during certain heuristics I mentioned a plugin for creating signatures that I have had good success with and it was not the first one I tried but the only one that would produce proper wildcard signatures that were consistent not only between databases with recent version change but also several years in between and developer going from using old ndk-build for compiling and not stripping symbols in one version and matching pattern in future version where developer changed to current standard for compiling native C shared libraries on Android and stripped symbols. |
IDA Magic Strings in Diaphora is only used to get potential source file names, not function names. And, yes, it's normal that it fails a lot: it's using debugging strings after all. |
|
Feel free to put your feature requests that require some research here (take a look to the below list to see what I mean):
The text was updated successfully, but these errors were encountered: