{"id":18579413,"url":"https://github.com/msm-code/greenbox","last_synced_at":"2025-04-10T10:31:30.952Z","repository":{"id":82343405,"uuid":"62171164","full_name":"msm-code/Greenbox","owner":"msm-code","description":"Function fingerprinter tool for reverse-engineers","archived":false,"fork":false,"pushed_at":"2016-07-28T23:51:33.000Z","size":22,"stargazers_count":5,"open_issues_count":1,"forks_count":3,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-24T19:40:08.621Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/msm-code.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-06-28T20:14:23.000Z","updated_at":"2022-09-23T01:40:48.000Z","dependencies_parsed_at":null,"dependency_job_id":"bf970971-18e8-44af-8c8b-022689f6a9ae","html_url":"https://github.com/msm-code/Greenbox","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msm-code%2FGreenbox","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msm-code%2FGreenbox/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msm-code%2FGreenbox/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/msm-code%2FGreenbox/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/msm-code","download_url":"https://codeload.github.com/msm-code/Greenbox/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248199136,"owners_count":21063641,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-06T23:40:44.460Z","updated_at":"2025-04-10T10:31:30.944Z","avatar_url":"https://github.com/msm-code.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Greenbox\n\n## About\n\nGreenbox is my research side-project. It is still under construction, and there is still a lot of things to do (to be honest, this project is not very practical for now).\n\nMy goal is to help kickstart reverse-engineering of complex codebases by recognising and tagging typical functions performing operations like:\n - functions from various standard libraries (like memcpy, strlen, etc)\n - common hashes and cryptographic functions (like sha1, crc32, etc)\n - simple mathematical operations (like addition, division, xoring with constant, etc)\n - common obfuscations and malware patterns (maybe TEB traversing? And/or EH tricks? Detecting self-modifying code would be nice too)\n - no-op functions (wrappers for other functions, and subroutines with empty body)\n - you get the point.\n\n## Technical summary\n\nGreenbox is purely blackbox analyzer (so far, considering a goal of this project, I don't see any sensible reason for adding static features).\n\nCurrently only supported mode is signature scan - every function detected in source binary is executed with some preconditions (i.e. parameters on a stack), and then postconditions are checked.\nThat means (simplifying things a bit) that when some function executed with parameters \"2\" and \"3\" gives back, we could guess that it's addition. Or when function called with string \"banana\" returns \"72b302bf297a228a75730123efef7c41\" we can be fairly sure that someone implemented md5.\n\n## Example\n\nSimple reference and playground for implemented signatures can be found in a repository (in reference.c file). But for the sake of example, let's consider following, simple C program:\n\n```c\nvoid memcpy(char *dst, char *src, int n) {\n    for (int i = 0; i \u003c n; i++) {\n        dst[i] = src[i];\n    }\n}\n\nvoid memzero(char *dst, int n) {\n    memset(dst, 0, n);\n}\n\nvoid memset(char *dst, int val, int n) {\n    for (int i = 0; i \u003c n; i++) {\n        dst[i] = val;\n    }\n}\n\nint main() {\n}\n```\n\nNow compile it:\n\n```\nvagrant@precise64:/vagrant/greenbox$ gcc fun.c -o fun -std=c99 -m32\n```\n\nAnd then test it:\n\n```\nvagrant@precise64:/vagrant/greenbox$ python engine.py fun\nsignature memcpy found at offset 3e4\nsignature memzero found at offset 412\nsignature memset found at offset 434\nsignature noop found at offset 4e2\n```\n  \nYou can see that greenbox correctly recognized memset, memcpy, and memzero, and even marked an empty main function as no-op.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmsm-code%2Fgreenbox","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fmsm-code%2Fgreenbox","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fmsm-code%2Fgreenbox/lists"}