吾爱破解 - LCG - LSG |安卓破解|病毒分析|www.52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

搜索
查看: 2254|回复: 10
上一主题 下一主题

[Disassemblers] BinaryNinja Debugger Plugin 1.2

[复制链接]
跳转到指定楼层
楼主
冥界3大法王 发表于 2020-6-16 09:24 回帖奖励
本帖最后由 冥界3大法王 于 2020-6-16 09:25 编辑

这是二进制忍者的调试器插件:BinaryNinja Debugger Plugin 1.2

It’s been over a month since we announced the Binary Ninja Debugger Plugin (BNDP) in beta, and as it begins to near the time it can shed its “BETA” tag, we wanted to show off the current state of the features and capabilities. Note that the debugger is being implemented as an open source plugin and feedback and code are always welcome.First, the highlights: BNDP does most of the usual things you’d expect from a debugger:
  • instrument processes
  • pause/resume
  • step into/step over/step until return
  • detach
  • inspect memory
  • see/change register state
  • disassemble new regions of memory as it executes through them
And it can do a few things you might not expect from all debuggers:
  • automatically update functions and branch points in a binary based on execution through it
  • apply arbitrary types and structure decoding to live memory
  • annotate calls with run-time specific arguments
Though there’s a few features still in development that aren’t done yet:Finally, the debugger runs on the most common architectures and platforms but more importantly, it’s implemented on an extensible architecture that makes it easy to add support for new platforms and debugging APIs.DemosLet’s do the fun stuff first and show off some demos. You can skip to the end for specifications and architecture discussions.Switch/Case DiscoveryThe static analysis is adept and finding switch statements and their corresponding jump tables, but with considerable effort it can be fooled into missing a case. If a new case is observed at runtime, analysis is updated:Undiscovered CountryIf a function is purposely hidden or even just the result of a virtual function call or other indirect control flow, static analysis might miss it. But during runtime, analysis can be told the address of call destinations great improving function identification.Prior to the call ebx, address 0x100000f25 is just data. But once this instruction is reached, Binja wisens up:Indirect Jump AnnotationWith the debugger.extra_annotations setting, function starts get annotated with context information and targets of indirect calls are logged as comments:Connect To MAMEWith the right plugin, Binja can analyze Z80 binary code in Colecovision ROMS. And since MAME exposes a gdb stub, we can connect to it:A headless script that breakpoints all Binja-identified functions and updates a live graphical map of the binary reveals which functions are responsible for gameplay elements and shows their relative sizes and proximity:Count OpcodesThe UI is not the only consumer of BNDP’s API. You can write “headless” scripts too. Here’s a simple example that runs md5 and single-steps while counting all the opcodes executed:CLI DebuggerThe headless API is complete enough that a respectable little CLI debugger can be made in a few hundred lines.DesignMultiplatform ArchitectureBNDP can connect to three back-ends: gdb, lldb, and dbgeng. The target is decoupled from BNDP in the first two modes, communicating using the RSP protocol over a socket. Theoretically any platform for which a gdb server exists can be debugged. In dbgeng mode, BNDP is runtime linked to Windows debugger engine and can debug local binaries.Supported PlatformsBNDP is tested on x64-linux, arm-android and aarch64-android binaries in gdb mode, x64-macos binaries in lldb mode, and x64-windows binaries in dbgeng mode.You should have success on the 32-bit x86 versions of the above binaries, but they’re not as rigorously tested as 64-bit.Adapter Classes: Generalizing Back-EndsEach of the adapters is expected to provide some primitive operations, like reading registers, stepping, breakpoints, etc. The comprehensive, but still short, list is the abstract functions in class DebugAdapter in DebugAdapter.py.With classes and inheritance, we’re able to factor out common behavior among adapters. For instance, GDB and LLDB have much in common, with LLDB speaking an augmented RSP protocol. The current class diagram has plenty of room for an additional adapter and its corresponding back-end:Higher level operations like “step over” are provided by some back-ends (like dbgeng) but not others (like gdb and lldb). For these, the operation is synthesized with primitive operations. “Step over” might involve disassembling to detect call or loop instructions and setting a one-shot breakpoint. “Go up” might involve reading the stack and setting a one-shot breakpoint at the return address.Note that we intentionally did not write this blog post to be documentation on all features of the debugger, or a how-to guide for using it. Rather, we want to show what’s possible and talk about the design of the debugger. If you’re interested in simpler user documentation, keep an eye out on the project repository where we’ll post updated user documentation as it’s released.

https://github.com/Vector35/debugger/archive/1.2.zip
https://binary.ninja/

免费评分

参与人数 2吾爱币 +2 热心值 +2 收起 理由
yaoyao7 + 1 + 1 我很赞同!
cr4ck + 1 + 1 用心讨论,共获提升!

查看全部评分

本帖被以下淘专辑推荐:

  • · Time|主题: 302, 订阅: 82

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

推荐
netspirit 发表于 2020-6-16 10:24
Can you speak chinese?
3#
yunkof 发表于 2020-6-16 09:29
4#
iamok 发表于 2020-6-16 09:50
5#
深爱我的女孩 发表于 2020-6-16 10:44
是国外的朋友发的吗,我来不明白,
6#
viczc 发表于 2020-6-16 13:12
你的主题数量“1868年”?出BUG了
7#
壹分叁拾秒 发表于 2020-6-16 13:48
太高深了 看不懂
8#
cr4ck 发表于 2020-6-17 05:50
Mark cross platform
9#
luli1111 发表于 2020-6-17 06:47
谢谢分享.但图片看不见.
10#
psx1lin 发表于 2020-6-17 08:01
必學
谢谢分享
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则 警告:本版块禁止灌水或回复与主题无关内容,违者重罚!

快速回复 收藏帖子 返回列表 搜索

RSS订阅|小黑屋|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2020-7-16 22:06

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表