{"id":13500171,"url":"https://github.com/h311d1n3r/Cerberus","last_synced_at":"2025-03-29T05:33:13.302Z","repository":{"id":178058349,"uuid":"582836524","full_name":"h311d1n3r/Cerberus","owner":"h311d1n3r","description":"A C++ tool to unstrip Rust/Go binaries (ELF and PE)","archived":false,"fork":false,"pushed_at":"2024-02-03T11:39:44.000Z","size":365,"stargazers_count":284,"open_issues_count":2,"forks_count":12,"subscribers_count":4,"default_branch":"main","last_synced_at":"2024-08-01T22:52:46.139Z","etag":null,"topics":["linux","reverse-engineering","rust","static-analysis"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/h311d1n3r.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-12-28T02:11:28.000Z","updated_at":"2024-07-28T22:53:02.000Z","dependencies_parsed_at":"2024-01-13T19:05:08.835Z","dependency_job_id":"d6da2860-742c-4192-bd20-0e9f1565ad55","html_url":"https://github.com/h311d1n3r/Cerberus","commit_stats":null,"previous_names":["h311d1n3r/cerberus"],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h311d1n3r%2FCerberus","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h311d1n3r%2FCerberus/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h311d1n3r%2FCerberus/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/h311d1n3r%2FCerberus/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/h311d1n3r","download_url":"https://codeload.github.com/h311d1n3r/Cerberus/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":222465871,"owners_count":16989100,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["linux","reverse-engineering","rust","static-analysis"],"created_at":"2024-07-31T22:00:52.310Z","updated_at":"2024-10-31T18:31:46.987Z","avatar_url":"https://github.com/h311d1n3r.png","language":"C++","funding_links":[],"categories":["C++","Blue Team"],"sub_categories":["Reverse Engineering"],"readme":"# Cerberus\n## Description\n### A C++ tool to unstrip Rust and Go binaries (ELF and PE) \n**Cerberus** is the tool you want to use to make RUST and GO static analysis a lot easier.  \nBased on hashing and scoring systems, it can retrieve lots of symbol names.\n## How does it work ?\nAfter analyzing your ELF/PE binary to find the used libraries, **Cerberus** will download and build them.  \nThen the tool will hash (in various ways) the functions in your file and in the libraries to make matches.  \n## Table of contents\n[Installation](#install)  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;[Download a release](#install_release)  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;[Build the tool with Docker](#install_build_docker)  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;[Build the tool on host](#install_build_host)  \n[How to use ?](#how)  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;[Syntax](#how_syntax)  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;[Parameters](#how_params)  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;[Flags](#how_flags)  \n\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;\u0026nbsp;[Example](#how_example)  \n[Warning](#warning)  \n\n\u003ca name=\"install\"/\u003e\n\n## Installation\n\n\u003ca name=\"install_release\"/\u003e\n\n### Download a release\nCheck the [Releases](https://github.com/h311d1n3r/Cerberus/releases/) tab on the Github project and download the latest one.  \n\n\u003ca name=\"install_build_docker\"/\u003e\n\n### Build the tool with Docker\n1. Clone the repository `git clone https://github.com/h311d1n3r/Cerberus \u0026\u0026 cd cerberus`.\n2. Check the available Dockerfiles under `Cerberus/docker/{OS}`.  \n3. Build the docker image of your choice `docker build -f ./docker/{OS}/Dockerfile-{version} .`.\n4. You can run **Cerberus** from inside the docker or extract the binary on your host. This second choice needs to install the libraries listed in [this section](#install_build_host).  \n\n\u003ca name=\"install_build_host\"/\u003e\n\n### Build the tool on host  \n1. You need to have **libarchive**, **libcurl4-openssl**, **zlib1g**, **libelf** and the **uuid-dev** libraries installed on your system.  \nWith APT just do `apt -y install libarchive-dev libcurl4-openssl-dev zlib1g-dev libelf-dev`\n2. Clone the repository `git clone https://github.com/h311d1n3r/Cerberus \u0026\u0026 cd cerberus`.\n3. Initialize git dependencies : `git submodule update --init`  \n4. Create the build directory `mkdir build \u0026\u0026 cd build`.  \n5. Run CMake to configure the project `cmake ..`.\n6. Run make to compile the project `make`.  \n\n\u003ca name=\"how\"/\u003e\n\n## How to use ?\n\n\u003ca name=\"how_syntax\"/\u003e\n\n### Syntax\n`cerberus binary [-param value] [--flag]`\n\n\u003ca name=\"how_params\"/\u003e\n\n### Parameters\n`output` -\u003e Specifies the path for the resulting ELF file.  \n`part_hash_len` -\u003e Specifies the length of a `part hash`. The `part hash` of a function is just a reduction of the function with a linear pace.\nThis technique is used to prevent fixed addresses from corrupting a standard hash. Default value : 20  \n`part_hash_trust` -\u003e Specifies minimum ratio of similarity between the two hashed functions to compare. The kept function will be the one with the most matches anyway.\nIncreasing this value will reduce the number of matched functions but speed up execution time. Default value : 0.6  \n`min_func_size` -\u003e The minimum length a function must be to get analyzed. Decreasing this value will increase matches but also false positives. Default value : 10  \n\n\u003ca name=\"how_flags\"/\u003e\n\n### Flags\n`help` -\u003e Displays a help message.  \n`debug` -\u003e Displays outputs of commands.  \n`no-prompt` -\u003e Automatically skips user prompts.  \n\n\u003ca name=\"how_example\"/\u003e\n\n### Example\n#### Command\nThe following command will try to unstrip the file ./rust_example into a new ELF called ./rust_example_syms.  \n`cerberus ./rust_example -output ./rust_example_syms`\n#### Result\nHere is a comparison of the main function in the two files using Binary Ninja :  \n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://i.imgur.com/uvpC63E.png\" alt=\"before.png\"/\u003e\n\u003c/p\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"https://i.imgur.com/Sp3ct49.png\" alt=\"after.png\"/\u003e\n\u003c/p\u003e\n\n\u003ca name=\"warning\"/\u003e\n\n## Warning\n**This software must only be used to carry out lawful experiments and I am not responsible for any breach of this rule !**  \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fh311d1n3r%2FCerberus","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fh311d1n3r%2FCerberus","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fh311d1n3r%2FCerberus/lists"}