everse engineering framework in python
This is a meta repository for :
- miasm: http://code.google.com/p/miasm/
- elfesteem: http://hg.secdev.org/elfesteem/
- grandalf: https://github.com/bdcht/grandalf/
What is Miasm?
Miasm is a a free and open source (GPLv2) reverse engineering framework. Miasm aims at analyzing/modifying/generating binary programs. Here is a non exhausting list of features:
- opening/modifying/generating PE/ELF 32/64 le/be using Elfesteem
- Assembling/Disassembling ia32/ppc/arm
- Representing assembly semantic using intermediate language
- Emulating using jit (dynamic code analysis, unpacking, ...)
- Expression simplification for automatic de-obfuscation
- Graphic disassembler using Grandalf
- ...
How does it work?
Miasm embed its own disassembler, intermediate language and instruction semantic. It is written in Python.
To emulate code, it uses libtcc to jit C code generate from intermediate representation. It can emulate shellcodes, parts of binaries. Python callback can be executed to emulate library functions.
Documentation
Documentation can be found under =doc/=.
Obtain Miasm
clone repo: http://code.google.com/p/smiasm/
Software requirements
Miasm uses:
- Grandalf (https://github.com/bdcht/grandalf) in order to render graphical disassembler.
- Modified libtcc (http://bellard.org/tcc/) to Jit code for emulation mode. see below
- python-ply for parsing
- numpy
- python-virtualenv
- python-dev
- python-qt4
- python-numpy
Configuration
- The libtcc needs a little fix in makefile to be used on 64bit systems
- remove libtcc-dev from the system to avoid conflicts
- clone git://repo.or.cz/tinycc.git
- edit makefile
- add option -fPIC to the CFLAGS definition
- ./configure && make && make install
To install:
hg clone https://code.google.com/p/smiasm/ smiasm
cd smiasm
make
make install
To install in virtual env:
hg clone https://code.google.com/p/smiasm/ smiasm
cd smiasm
make
make virtinstall
source vmiasm/bin/activate
To test (after install or virtual install):
cd miasm/example/
python disas_and_graph.py /bin/ls
Note:
retry on github fail...
Misc
- Man, does miasm has a link with rr0d?
- Yes! crappy code and uggly documentation.
source link: https://code.google.com/p/smiasm/