1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
use binaryninja::low_level_il::expression::{ExpressionHandler, LowLevelILExpressionKind};
use binaryninja::low_level_il::instruction::InstructionHandler;
use binaryninja::low_level_il::VisitorAction;
use binaryninja::tracing::TracingLogListener;
use binaryninja::workflow::{Activity, AnalysisContext, Workflow};
const RUST_ACTIVITY_NAME: &str = "analysis.plugins.rustexample";
const RUST_ACTIVITY_CONFIG: &str = r#"{
"name": "analysis.plugins.rustexample",
"title" : "Rust Example",
"description": "This analysis step logs out some information about the function...",
"eligibility": {
"auto": { "default": true },
"runOnce": false
}
}"#;
fn example_activity(analysis_context: &AnalysisContext) {
let func = analysis_context.function();
println!(
"Activity `{}` called in function {} with workflow {:?}!",
RUST_ACTIVITY_NAME,
func.start(),
func.workflow().map(|wf| wf.name())
);
// If we have llil available, replace that as well.
if let Some(llil) = unsafe { analysis_context.llil_function() } {
for basic_block in &func.basic_blocks() {
for instr in basic_block.iter() {
if let Some(llil_instr) = llil.instruction_at(instr) {
llil_instr.visit_tree(&mut |expr| {
if let LowLevelILExpressionKind::Const(_op) = expr.kind() {
// Replace all consts with 0x1337.
tracing::debug!(
"Replacing llil expression @ 0x{:x} : {}",
instr,
expr.index
);
unsafe {
llil.replace_expression(expr.index, llil.const_int(4, 0x1337))
};
}
VisitorAction::Descend
});
}
}
}
analysis_context.set_llil_function(&llil.finalized());
}
}
pub fn main() {
tracing_subscriber::fmt::init();
let _listener = TracingLogListener::new().register();
// This loads all the core architecture, platform, etc plugins
let headless_session =
binaryninja::headless::Session::new().expect("Failed to initialize session");
tracing::info!("Registering workflow...");
let activity = Activity::new_with_action(RUST_ACTIVITY_CONFIG, example_activity);
// Update the meta-workflow with our new activity.
Workflow::cloned("core.function.metaAnalysis")
.expect("Couldn't find meta workflow")
.activity_after(&activity, "core.function.runFunctionRecognizers")
.expect("Couldn't find runFunctionRecognizers")
.register()
.expect("Couldn't register activity");
tracing::info!("Loading binary...");
let bv = headless_session
.load("/bin/cat")
.expect("Couldn't open `/bin/cat`");
// traverse all llil expressions and look for the constant 0x1337
for func in &bv.functions() {
if let Ok(llil) = func.low_level_il() {
for block in &llil.basic_blocks() {
for instr in block.iter() {
instr.visit_tree(&mut |expr| {
if let LowLevelILExpressionKind::Const(value) = expr.kind() {
if value.value() == 0x1337 {
tracing::info!(
"Found constant 0x1337 at instruction 0x{:x} in function {}",
instr.address(),
func.start()
);
}
}
VisitorAction::Descend
});
}
}
}
}
}
|
