OpenRCE

📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.

About Articles Book Store Distributed RCE Downloads Event Calendar Forums Live Discussion Reference Library RSS Feeds Search Users What's New

Customize Theme

Flag: Tornado! Hurricane!

Created: Sunday, August 28 2005 01:48.11 CDT

Modified: Sunday, August 28 2005 04:04.52 CDT

Printer Friendly ...

ArchShadow

Author: daeken

# Views: 194

Well, I'm now in the process of rewriting a large bit of the core of my decompiler ArchShadow, now nearing its 3rd year of development (though not on the same codebase)

ArchShadow originally started as a proof of concept decompiler that was fully standalone.  It was written in PHP (please don't martyr me for that) and used its own, very poorly written, disassembler.  It actually could decompile a number of large test binaries, but it was gcc-specific and very specific to certain ways of using constructs.  It was a hack, by any definition of the word.

From there it grew into a pure C project, still implementing its own disassembler.  This implementation didn't last long, as it simply wasn't worth the hastle for the limited return.  It did make the disassembler core a decent bit cleaner, though.

After that, I worked on an implementation in Python, still using my own disassembler.  This lasted for a while and let me get a lot of the SSA theory down. Eventually it was elimited when the analysis work on the disassembler side (especially function detection) got to be too big to handle.

All of this taught me a big, very important issue.  If the option to use an existing disassembler is there, USE IT.

ArchShadow is now in Python, sitting on top of IDA.  It reads in a good bit of information from the DB and caches it allowing you to run it away from IDA as long as you don't change the code to the point that the information read from the DB is different.  I'll eventually make it pull the entire IDA DB so that that's not such a big deal, but that's going to be a while in coming.  The current version works good enough for now.

The problem with the current revision is that my SSA support for variables (used for detecting the modifications to different things over the course of a given function) is simply poor.  It works, but to change names from the SSA name (var_#) I have to do a string replace which simply feels like a hack.  I'm going to address this in my partial rewrite.

Anyway, enough history.

I'm considering building a system that can export data from an IDA database and then be used in an external interface.  The main reason being that the interface for IDA on Linux is very poor, and there's absolutely no way for me to run any sort of IDA interface natively on OS X as it stands.  One other option is writing a network layer where tvision would currently stand in the linux version and building a GUI that works with that, but I'm not sure of what is exposed ot tvision.

Well, enough blogging for now.  Let me know if you have any ideas/questions/comments.

Take care.
Cody Brocious

PS.  Stop by #openrce on irc.freenode.net if you're so inclined.  I'd love to start a nice sized channel for reverse-engineering of all sorts, and I think it's easily doable if I can just get the word out a bit :)

There are 31,328 total registered users.

Recently Created Topics
[help] Unpacking VMP...	Mar/12
Reverse Engineering ...	Jul/06
let 'IDAPython' impo...	Sep/24
set 'IDAPython' as t...	Sep/24
GuessType return une...	Sep/20
About retrieving the...	Sep/07
How to find specific...	Aug/15
How to get data depe...	Jul/07
Identify RVA data in...	May/06
Question about memor...	Dec/12

Recent Forum Posts
Finding the procedur...	rolEYder
Question about debbu...	rolEYder
Identify RVA data in...	sohlow
let 'IDAPython' impo...	sohlow
How to find specific...	hackgreti
Problem with ollydbg	sh3dow
How can I write olly...	sh3dow
New LoadMAP plugin v...	mefisto...
Intel pin in loaded ...	djnemo
OOP_RE tool available?	Bl4ckm4n

Recent Blog Entries
	halsten	Mar/14
Breaking IonCUBE VM
	oleavr	Oct/24
Anatomy of a code tracer
	hasherezade	Sep/24
IAT Patcher - new tool for ...
	oleavr	Aug/27
CryptoShark: code tracer ba...
	oleavr	Jun/25
Build a debugger in 5 minutes
More ...

Recent Blog Comments
	nieo on:	Mar/22
IAT Patcher - new tool for ...
	djnemo on:	Nov/17
Kernel debugger vs user mod...
	acel on:	Nov/14
Kernel debugger vs user mod...
	pedram on:	Dec/21
frida.github.io: scriptable...
	capadleman on:	Jun/19
Using NtCreateThreadEx for ...
More ...

Imagery

SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit