Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/bootleg/ret-sync

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.
https://github.com/bootleg/ret-sync

binaryninja debugger disassembler ghidra ida-plugin ida-pro reverse-engineering software-analysis

Last synced: 6 days ago
JSON representation

ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.

Host: GitHub
URL: https://github.com/bootleg/ret-sync
Owner: bootleg
License: gpl-3.0
Created: 2016-01-10T17:36:12.000Z (almost 9 years ago)
Default Branch: master
Last Pushed: 2024-02-29T07:08:34.000Z (10 months ago)
Last Synced: 2024-11-29T10:08:01.742Z (13 days ago)
Topics: binaryninja, debugger, disassembler, ghidra, ida-plugin, ida-pro, reverse-engineering, software-analysis
Language: C
Homepage:
Size: 2.66 MB
Stars: 2,046
Watchers: 52
Forks: 263
Open Issues: 34
Metadata Files:
- Readme: README.md
- License: COPYING

Awesome Lists containing this project

awesome-reverse-engineering - **471**星
awesome-ghidra - ret-sync - ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra disassemblers. (Ghidra Scripts/Plugins/Extension)
awesome-hacking-lists - bootleg/ret-sync - ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers. (C)

README

# ret-sync

**ret-sync** stands for Reverse-Engineering Tools SYNChronization. It is a set
of plugins that help to synchronize a debugging session
(WinDbg/GDB/LLDB/OllyDbg/OllyDbg2/x64dbg) with a disassembler (IDA/Ghidra/Binary Ninja).
The underlying idea is simple: take the best from both worlds (static and
dynamic analysis).

Debuggers and dynamic analysis provide us with:

* local view, with live dynamic context (registers, memory, *etc.*)
* built-in specialized features/API (ex: WinDbg's ``!peb``, ``!drvobj``,
``!address``, *etc.*)

Disassemblers and static analysis provide us with:

* macro view over modules
* code analysis, signatures, types, *etc.*
* fancy graph view
* decompilation
* persistent storage of knowledge within IDBs/GPRs

Key features:

* synchronize graph and decompilation views with debugger's state
* no need to deal with ASLR, addresses are rebased on-the-fly
* pass data (comment, command output) from debugger to disassembler
* multiple IDBs/GPRs can be synced at the same time allowing to easily trace
through multiple modules
* disassembler and debugger can be on different hosts / VMs

**ret-sync** is a fork of [qb-sync](https://github.com/quarkslab/qb-sync)
that I developed and maintained during my stay at
[Quarkslab](http://www.quarkslab.com).

-------------------------------------------------------------------------------
# Table of contents

- [Repository content](#repository-content)
- [General prerequisites](#general-prerequisites)
- [Binary release](#binary-release)
- [**ret-sync** configuration](#ret-sync-configuration)
- [Installation](#installation)
- [IDA extension](#ida-extension)
- [Ghidra extension](#ghidra-extension)
- [Binary Ninja extension](#binary-ninja-extension)
- [WinDbg extension](#windbg-extension)
- [GNU gdb (GDB) installation](#gnu-gdb-gdb-installation)
- [LLDB installation](#lldb-installation)
- [OllyDbg 1.10 installation](#ollydbg-110-installation)
- [OllyDbg2 installation](#ollydbg2-installation)
- [x64dbg installation](#x64dbg-installation)
- [Usage](#usage)
- [**ret-sync** debugger commands](#ret-sync-debugger-commands)
- [IDA usage](#ida-usage)
- [Ghidra usage](#ghidra-usage)
- [Binary Ninja usage](#binary-ninja-usage)
- [WinDbg usage](#windbg-usage)
- [GNU gdb (GDB) usage](#gnu-gdb-gdb-usage)
- [LLDB usage](#lldb-usage)
- [OllyDbg 1.10 usage](#ollydbg-110-usage)
- [OllyDbg2 usage](#ollydbg2-usage)
- [x64dbg usage](#x64dbg-usage)
- [Python library usage](#python-library-usage)
- [Extend](#extend)
- [TODO](#todo)
- [Known Bugs/Limitations](#known-bugslimitations)
- [License](#license)
- [Greetz](#greetz)
-------------------------------------------------------------------------------

# Repository content

The debugger plugins:

* `ext_windbg/sync`: WinDbg extension source files, once built: `sync.dll`
* `ext_gdb/sync.py`: GDB plugin
* `ext_lldb/sync.py`: LLDB plugin
* `ext_olly1`: OllyDbg 1.10 plugin
* `ext_olly2`: OllyDbg v2 plugin
* `ext_x64dbg`: x64dbg plugin

The disassembler plugins:

* `ext_ida/SyncPlugin.py`
* `ext_ghidra/dist/ghidra_*_retsync.zip`: Ghidra plugin
* `ext_bn/retsync`: Binary Ninja plugin

And the library plugin:

* `ext_lib/sync.py`: standalone Python library

# General prerequisites

IDA and GDB plugins require a valid Python setup. Python 2 (>=2.7) and Python
3 are supported.

# Binary release

Pre-built binaries for WinDbg/OllyDbg/OllyDbg2/x64dbg debuggers are proposed
through an ``Azure DevOps`` pipeline: [![Build Status](https://dev.azure.com/bootlegdev/ret-sync-release/_apis/build/status/ret-sync-release-CI?branchName=master)](https://dev.azure.com/bootlegdev/ret-sync-release/_build/latest/ret-sync-release-CI?definitionId=8?branchName=master)

Select the last build and check the artifacts under the ``Related`` section: ``6 published``.

![](img/pipeline.png)

A pre-built plugin archive of the Ghidra plugin is provided in `ext_ghidra/dist`.

# **ret-sync** configuration

**ret-sync** should work out of the box for most users with a typical setup:
debugger and disassembler(s) on the same host, module names matching.

Still, in some scenarios a specific configuration may be used. For that,
extensions and plugins check for an optional global configuration file named
`.sync` in the user's home directory. It must be a valid ``.INI`` file.

Additionally, the IDA and Ghidra plugins also look for the configuration file
in the IDB or project directory (`.rep`) first to allow local,
per-IDB/project, settings. If a local configuration file is present, the
global configuration file is ignored.

Values declared in these configuration files override default values. Please
note, that **no** `.sync` file is created by default.

Below we detail, three common scenarios where a configuration file is
useful/needed:

* Remote debugging
* Modules names mismatch
* Missing PID

## Remote debugging: debugger and disassembler are on different hosts

The ``[INTERFACE]`` section is used to customize network related settings.
Let's suppose one wants to synchronize IDA with a debugger running inside a
virtual machine (or simply another host), common remote kernel debugging
scenario.

Simply create two ``.sync`` file:

* one on the machine where IDA is installed, in the IDB directory:
* For Ghidra, place at home directory, ex. "/home/user" or "C:\Users\user".
```
[INTERFACE]
host=192.168.128.1
port=9234
```

It tells **ret-sync** ``IDA`` plugin to listen on the interface
``192.168.128.1`` with port ``9234``. It goes without saying that this
interface must be reachable from the remote host or virtual machine.

* one on the machine where the debugger is executed, in the user's home directory:

```
[INTERFACE]
host=192.168.128.1
port=9234
```

It tells **ret-sync** debugger plugin to connect to the **ret-sync** ``IDA``
plugin configured previously to listen in this interface.

***NOTE:*** You must specify a real IP here, and not use `0.0.0.0`. This is
because the variable is used by multiple sources both for binding and
connecting, so using `0.0.0.0` will result in weird errors.

## IDB and debugger modules names are different

```
[ALIASES]
ntoskrnl_vuln.exe=ntkrnlmp.exe
```

The ``[ALIASES]`` section is used to customize the name which is used by a
disassembler (IDA/Ghidra) to register a module to its dispatcher/program
manager.

By default, disassembler plugins use the name of the input file. However one
may have renamed the file beforehand and it doesn't match anymore the name of
the actual process or loaded module as seen by the debugger.

Here we simply tell to the dispatcher to match the name `ntkrnlmp.exe` (real
name) instead of `ntoskrnl_vuln.exe` (IDB name).

## gdb with Qt Creator debugging frontend

The Qt Creator debugging frontend changes the way gdb command output is logged. Since
this would interfere with the synchronization an option exists to use the raw gdb output
for synchronization instead of a temporary file. In the .sync configuration file use

```
[GENERAL]
use_tmp_logging_file=false
```

if you wish to use the Qt debugging frontend for the target.

## Embedded devices and missing ``/proc//maps``

In some scenarios, such as debugging embedded devices over serial or raw
firmware in QEMU, gdb is not aware of the PID and cannot access
``/proc//maps``.

In these cases, The ``[INIT]`` section is used to pass a custom context to the
plugin. It allows overriding some fields such as the PID and memory mappings.

`.sync` content extract:

```
[INIT]
context = {
"pid": 200,
"mappings": [ [0x400000, 0x7A81158, 0x7681158, "asav941-200.qcow2|lina"] ]
}
```

Each entry in the mappings is: ``mem_base``, ``mem_end``, ``mem_size``, ``mem_name``.

## Bypassing automatic address rebasing

In some scenarios, such as debugging embedded devices or connecting to
minimalist debug interfaces, it may be more convenient to bypass the
automatic address rebasing feature implemented in the disassembler plugins.

The `use_raw_addr` option is currently supported only for Ghidra. In
the .sync configuration file use:

```
[GENERAL]
use_raw_addr=true
```

# Installation

## IDA extension

### IDA prerequisites

IDA 7.x branch is required. For older versions (6.9x) please see archived
release ``ida6.9x``.

### Install the IDA extension

For IDA installation, copy ``Syncplugin.py`` and ``retsync`` folder from
``ext_ida`` to IDA plugins directory, for example:

* ``C:\Program Files\IDA Pro 7.4\plugins``
* ``%APPDATA%\Hex-Rays\IDA Pro\plugins``
* ``~/.idapro/plugins``

### Run the IDA extension

1. Open IDB
2. Run the plugin in IDA (``Alt-Shift-S``) or ``Edit`` -> ``Plugins`` -> ``ret-sync``

```
[sync] default idb name: ld.exe
[sync] sync enabled
[sync] cmdline: "C:\Program Files\Python38\python.exe" -u "C:\Users\user\AppData\Roaming\Hex-Rays\IDA Pro\plugins\retsync\broker.py" --idb "target.exe"
[sync] module base 0x100400000
[sync] hexrays #7.3.0.190614 found
[sync] broker started
[sync] plugin loaded
[sync] << broker << dispatcher not found, trying to run it
[sync] << broker << dispatcher now runs with pid: 6544
[sync] << broker << connected to dispatcher
[sync] << broker << listening on port 63107

```

### IDA plugin troubleshooting

To troubleshoot issues with the IDA extension two options are available in the
file `retsync/rsconfig.py`:

```
LOG_LEVEL = logging.INFO
LOG_TO_FILE_ENABLE = False
```

Setting `LOG_LEVEL` value to ` logging.DEBUG` makes the plugin more verbose.

Setting `LOG_TO_FILE_ENABLE` value to `True` triggers the logging of exception
information from `broker.py` and `dispatcher.py` into dedicated files. Log file
are generated in the `%TMP%` folder with a name pattern `retsync.%s.err` .

## Ghidra extension

### Build the Ghidra extension

Either use the pre-built version from the `ext_ghidra/dist` folder or follow the instruction to build it.
Each extension build only supports the version of Ghidra specified in the plugin's file name.
E.g. `ghidra_9.1_PUBLIC_20191104_retsync.zip` is for Ghidra 9.1 Public.

1. Install Ghidra
2. Install gradle

```bash
apt install gradle
```

3. Build extension for your Ghidra installation (replace `$GHIDRA_DIR` with your installation directory)

```bash
cd ext_ghidra
gradle -PGHIDRA_INSTALL_DIR=$GHIDRA_DIR
```

### Install the Ghidra extension

1. From Ghidra projects manager: ``File`` -> ``Install Extensions...``, click on the
`+` sign and select the `ext_ghidra/dist/ghidra_*_retsync.zip` and click OK.
This will effectively extract the `retsync` folder from the zip into
`$GHIDRA_DIR/Extensions/Ghidra/`
2. Restart Ghidra as requested
3. After reloading Ghidra, open a module in CodeBrowser. It should tell you a
new extension plugin has been detected. Select "yes" to configure it. Then
tick "RetSyncPlugin" and click OK. The console should show something like:

```
[*] retsync init
[>] programOpened: tm.sys
imageBase: 0x1c0000000
```

4. From Ghidra CodeBrowser tool: use toolbar icons or shortcuts to enable (``Alt+s``)/disable (``Alt+Shift+s``)/restart (``Alt+r``)
synchronization.

A status window is also available from ``Windows`` -> ``RetSyncPlugin``. You
generally want to drop it on the side to integrate it with the Ghidra
environment windows.

## Binary Ninja extension

Binary Ninja support is experimental, make sure to backup your analysis
databases.

### Binary Ninja prerequisites

**ret-sync** requires Binary Ninja version 2.2 at minimum as well as Python 3
(Python 2 is not supported).

### Install the Binary Ninja extension

**ret-sync** is not yet distributed through the Binary Ninja's Plugin Manager;
a manual installation is required. Simply copy that content of the `ext_bn`
folder into Binary Ninja's plugins folder, for example:

`%APPDATA%\Binary Ninja\plugins`

After restarting Binary Ninja, the following output should be present in the
console window:

```
[sync] commands added
Loaded python3 plugin 'retsync'
```

## WinDbg extension

### Build the WinDbg extension

Either use pre-built binaries or use the Visual Studio 2017
solution provided in ``ext_windbg``, (see
https://docs.microsoft.com/en-us/visualstudio/releasenotes/vs2017-relnotes if
needed).

This will build the `x64\release\sync.dll` file.

### Install the WinDbg extension

You will need to copy the resulting `sync.dll` file into the
appropriate Windbg extension path.

* WinDbg Classic:

For earlier versions of Windbg this is is something like this (be
careful of ``x86``/``x64`` flavours), for example

`C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\winext\sync.dll`

* Windbg Preview

The folder for storing extension seems to be based on the PATH, so you need to
put it one of the queried locations.

One example is to put it here:

`C:\Users\user\AppData\Local\Microsoft\WindowsApps\sync.dll`

### Run the WinDbg extension

1. Launch WinDbg on target
2. Load extension (``.load`` command)

```
0:000> .load sync
[sync.dll] DebugExtensionInitialize, ExtensionApis loaded
```

3. Sync WinDbg

```
0:000> !sync
[sync] No argument found, using default host (127.0.0.1:9100)
[sync] sync success, sock 0x5a8
[sync] probing sync
[sync] sync is now enabled with host 127.0.0.1
```

E.g. in IDA's Output window

```
[*] << broker << dispatcher msg: add new client (listening on port 63898), nb client(s): 1
[*] << broker << dispatcher msg: new debugger client: dbg connect - HostMachine\HostUser
[sync] set debugger dialect to windbg, enabling hotkeys
```

If Windbg's current module matches IDA file name

```
[sync] idb is enabled with the idb client matching the module name.
```

### WinDbg installation troubleshooting

Note: If you get the following error, it is because you haven't copied the file
to the right folder in the above steps.

```
0: kd> .load sync
The call to LoadLibrary(sync) failed, Win32 error 0n2
"The system cannot find the file specified."
Please check your debugger configuration and/or network access.
```

The error below usually means that Windbg tried to load the incorrect flavour
of the extension, ex: ``x64`` in place of the ``x86`` `sync.dll`.

```
0:000> .load sync
The call to LoadLibrary(sync) failed, Win32 error 0n193
"%1 is not a valid Win32 application."
Please check your debugger configuration and/or network access.
```

As WinDbg Preview loads both plugins (``x86`` and ``x64``) from the same
directory, one can rename the ``x86`` file `sync32.dll`.

```
0:000> .load sync32
```

## GNU gdb (GDB) installation

1. Copy the `ext_gdb/sync.py` to the directory of your choice
2. Load the extension (see auto-load-scripts)

```
gdb> source sync.py
[sync] configuration file loaded 192.168.52.1:9100
[sync] commands added
```

## LLDB installation

LLDB support is experimental, however:

1. Load extension (can also be added in ``~/.lldbinit``)

```
lldb> command script import sync
```

## OllyDbg 1.10 installation

OllyDbg 1.10 support is experimental, however:

1. Build the plugin using the VS solution (optional, see pre-built binaries)
2. Copy the dll within OllyDbg's plugin directory

## OllyDbg2 installation

OllyDbg2 support is experimental, however:

1. Build the plugin using the VS solution (optional, see pre-built binaries)
2. Copy the dll within OllyDbg2's plugin directory

## x64dbg installation

Based on testplugin, https://github.com/x64dbg/testplugin. x64dbg support is experimental, however:

1. Build the plugin using the VS solution (optional, see pre-built binaries).
May you need a different version of the plugin sdk,
a copy can be found in each release of x64dbg.
Paste the "``pluginsdk``" directory into "``ext_x64dbg\x64dbg_sync``"
2. Copy the dll (extension is ``.d32`` or ``.dp64``) within x64dbg's plugin directory.

# Usage

## **ret-sync** debugger commands

For command-line oriented debuggers (mainly Windbg and GDB) a set of commands
is exposed by **ret-sync** to assist in the reverse-engineering task.

The commands below are generic (Windbg and GDB), please note that a `!`
prefix is needed on WinDbg (e.g.: `sync` in GDB, `!sync` in Windbg).

| Debugger command | Description |
|----------------------------|-------------------------------------------------------------------------------------------|
| `synchelp` | Display the list of available commands with short explanation |
| `sync` | Start synchronization |
| `syncoff` | Stop synchronization |
| `cmt [-a address] ` | Add a comment at current ip in disassembler |
| `rcmt [-a address]` | Reset comment at current ip in disassembler |
| `fcmt [-a address] ` | Add a function comment for function in which current ip is located |
| `raddr ` | Add a comment with rebased address evaluated from expression |
| `rln ` | Get symbol from the disassembler for the given address |
| `lbl [-a address] ` | Add a label name at current ip in disassembler |
| `cmd ` | Execute a command in debugger and add its output as comment at current ip in disassembler |
| `bc <\|\|on\|off\|set 0xBBGGRR>` | Enable/disable path coloring in disassembler |
| `idblist` | Get list of all IDB clients connected to the dispatcher |
| `syncmodauto ` | Enable/disable disassembler auto switch based on module name |
| `idbn ` | Set active IDB to the nth client |
| `jmpto ` | |
| `jmpraw ` | If an IDB is enabled then disassembler's view is synced with the resulting address. |
| `translate ` | rebase an address with respect to its module's name and offset |

WinDbg specific commands:

| Debugger command | Description |
|----------------------------|-------------------------------------------------------------------------------------------|
| `curmod` | Display module infomation for current instruction offset (for troubleshooting) |
| `modlist` | Debugger Markup Language (DML) enhanced module list meant for smoother active idb switching |
| `idb ` | Set given module as the active idb (see `modlist` enhanced version of `lm`) |
| `modmap ` | A synthetic ("faked") module (defined using its base address and size) is added to the debugger internal list |
| `modunmap ` | Remove a previously mapped synthetic module at base address |
| `modcheck <\|\|md5>` | Use to check if current module really matches IDB's file (ex: module has been updated) |
| `bpcmds <\|\|save\|load\|>` | **bpcmds** wrapper, save and reload **.bpcmds** (breakpoints commands list) output to current IDB |
| `ks` | Debugger Markup Language (DML) enhanced output of **kv** command |

GDB specific commands:

| Debugger command | Description |
|----------------------------|-------------------------------------------------------------------------------------------|
|`bbt` | Beautiful backtrace. Similar to **bt** in GDB but requests symbols from disassembler |
| `patch` | Patch bytes in disassembler based on live context |
| `bx` | Similar to GDB **x** but using a symbol. The symbol will be resolved by disassembler |
| `cc` | Continue to cursor in disassembler |

## IDA usage

### IDA plugin's GUI

The ``Overwrite idb name`` input field is meant to change the default IDB
name. It is the name that is used by the plugin to register with the
dispatcher. IDB automatic switch is based on module name matching. In case of
conflicting names (like a ``foo.exe`` and ``foo.dll``), this can be used to
ease matching. Please note, if you modify the input field while the sync is
active, you have to re-register with the dispatcher; this can be done simply
by using the "``Restart``" button.

As a reminder it is possible to alias by default using the ``.sync`` configuration file.

### IDA global shortcuts

**ret-sync** defines these global shortcuts in IDA:

* ``Alt-Shift-S`` - Run **ret-sync** plugin
* ``Ctrl-Shift-S`` - Toggle global syncing
* ``Ctrl-H`` - Toggle Hex-Rays syncing

Two buttons are also available in the Debug toolbar to toggle global and
Hex-Rays syncing.

### IDA bindings over debugger commands

``Syncplugin.py`` also registers debugger command wrapper hotkeys.

* ``F2`` - Set breakpoint at cursor address
* ``F3`` - Set one-shot breakpoint at cursor address
* ``Ctrl-F2`` - Set hardware breakpoint at cursor address
* ``Ctrl-F3`` - Set one-shot hardware breakpoint at cursor address
* ``Alt-F2`` - Translate (rebase in debugger) current cursor address
* ``Alt-F5`` - Go
* ``Ctrl-Alt-F5`` - Run (GDB only)
* ``F10`` - Single step
* ``F11`` - Single trace

These commands are only available when the current IDB is active. When
possible they have also been implemented for others debuggers.

## Ghidra usage

### Ghidra plugin's GUI

Once the RetSyncPlugin opened, you can add it to the CodeBrowser window by simple
drag'n'drop:

![](img/ghidra.png)

If you want to view several modules, files need to be open in the same CodeBrowser
viewer, simply drag'n'drop the additional ones in the CodeBrowser window to obtain
the result as above.

### Ghidra global shortcuts

**ret-sync** defines these global shortcuts in Ghidra:

* ``Alt-S`` - Enable syncing
* ``Alt-Shift-S`` - Disable syncing
* ``Alt-R`` - Restart syncing
* ``Alt-Shift-R`` - Reload configuration

### Ghidra bindings over debugger commands

Bindings over debugger commands are also implemented. They are similar to the
ones from IDA's extension (except the "Go" command).

* ``F2`` - Set breakpoint at cursor address
* ``Ctrl-F2`` - Set hardware breakpoint at cursor address
* ``Alt-F3`` - Set one-shot breakpoint at cursor address
* ``Ctrl-F3`` - Set one-shot hardware breakpoint at cursor address
* ``Alt-F2`` - Translate (rebase in debugger) current cursor address
* ``F5`` - Go
* ``Alt-F5`` - Run (GDB only)
* ``F10`` - Single step
* ``F11`` - Single trace

## Binary Ninja usage

### Binary Ninja global shortcuts

**ret-sync** defines these global shortcuts in Binary Ninja:

* ``Alt-S`` - Enable syncing
* ``Alt-Shift-S`` - Disable syncing

### Binary Ninja shortcuts

Bindings over debugger commands are also implemented. They are similar to the
ones from IDA's extension.

* ``F2`` - Set breakpoint at cursor address
* ``Ctrl-F2`` - Set hardware breakpoint at cursor address
* ``Alt-F3`` - Set one-shot breakpoint at cursor address
* ``Ctrl-F3`` - Set one-shot hardware breakpoint at cursor address
* ``Alt-F2`` - Translate (rebase in debugger) current cursor address
* ``Alt-F5`` - Go
* ``F10`` - Single step
* ``F11`` - Single trace

## WinDbg usage

### WinDbg plugin commands

* **!sync**: Start synchronization
* **!syncoff**: Stop synchronization
* **!synchelp**: Display the list of available commands with short explanation.
* **!cmt [-a address] **: Add comment at current ip in IDA

```
[WinDbg]
0:000:x86> pr
eax=00000032 ebx=00000032 ecx=00000032 edx=0028eebc esi=00000032 edi=00000064
eip=00430db1 esp=0028ed94 ebp=00000000 iopl=0 nv up ei pl nz na po nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00000202
image00000000_00400000+0x30db1:
00430db1 57 push edi

0:000:x86> dd esp 8
0028ed94 00000000 00433845 0028eebc 00000032
0028eda4 0028f88c 00000064 002b049e 00000110

0:000:x86> !cmt 0028ed94 00000000 00433845 0028eebc 00000032
[sync.dll] !cmt called

[IDA]
.text:00430DB1 push edi ; 0028ed94 00000000 00433845 0028eebc 00000032
```

* **!rcmt [-a address]**: Reset comment at current ip in IDA

```
[WinDbg]
0:000:x86> !rcmt
[sync] !rcmt called

[IDA]
.text:00430DB1 push edi
```

* **!fcmt [-a address] **: Add a function comment for function in which current ip is located

```
[WinDbg]
0:000:x86> !fcmt decodes buffer with key
[sync] !fcmt called

[IDA]
.text:004012E0 ; decodes buffer with key
.text:004012E0 public decrypt_func
.text:004012E0 decrypt_func proc near
.text:004012E0 push ebp
```

Note: calling this command without argument reset the function's comment.

* **!raddr **: Add a comment with rebased address evaluated from expression
* **!rln **: Get symbol from the disassembler for the given address
* **!lbl [-a address] **: Add a label name at current ip in disassembler

```
[WinDbg]
0:000:x86> !lbl meaningful_label
[sync] !lbl called

[IDA]
.text:000000000040271E meaningful_label:
.text:000000000040271E mov rdx, rsp
```

* **!cmd **: Execute a command in WinDbg and add its output as comment at current ip in disassembler

[IDA]
.text:00430DB1 push edi ; edi=00000064
```

* **!bc <||on|off|set 0xBBGGRR>** : Enable/disable path coloring in disassembler.
This is NOT a code tracing tool,
there are efficient tools for that. Each manually stepped instruction is
colored in the graph. Color a single instruction at current ip if called
without argument.
"set" argument is used to set path color with a new hex rgb code (reset color
if called with a value > 0xFFFFFF).
* **!idblist**: Get list of all IDB clients connected to the dispatcher:

```
[WinDbg]
0:000> !idblist
> currently connected idb(s):
[0] target.exe
```

* **!syncmodauto **: Enable/disable disassembler auto switch based on module name:

```
[WinDbg]
0:000> !syncmodauto off

[IDA]
[*] << broker << dispatcher msg: sync mode auto set to off
```

* **!idbn **: Set active IDB to the nth client. n should be a valid decimal value.
This is a semi-automatic mode (personal tribute to the tremendous jj)

```
[WinDbg]
0:000:> !idbn 0
> current idb set to 0
```

In this example, current active IDB client would have been set to:

```
[0] target.exe.
```

* **!jmpto **: Expression given as argument is evaluated in the context of the current debugger's status.
disassembler's view is then synced with the resulting address if a matching module is registered.
Can be seen as a manual syncing, relocation is automatically performed, on the fly.
Especially useful for randomly relocated binary.
* **!jmpraw **: Expression given as argument is evaluated in the context of the current debugger's status.
If an IDB is enabled then disassembler's view is synced with the resulting address. Address is not rebased
and there is no IDB switching.
Especially useful for dynamically allocated/generated code.
* **!modmap **: A synthetic ("faked") module (defined using its base address and size) is added to the debugger internal list.
From msdn: "If all the modules are reloaded - for example, by calling Reload with the Module parameter set to an empty string - all synthetic modules will be discarded."
It can be used to more easily debug dynamically allocated/generated code.
* **!modunmap **: Remove a previously mapped synthetic module at base address.
* **!modcheck <||md5>**: Use to check if current module really matches IDB's file (ex: module has been updated)
When called without an argument, pdb's GUID from Debug Directory is used. It can alternatively use md5,
but only with a local debuggee (not in remote kernel debugging).
* **!bpcmds <||save|load|>**: **bpcmds** wrapper, save and reload **.bpcmds** (breakpoints commands list) output to current IDB.
Display (but not execute) saved data if called with no argument.
Persistent storage is achieved using IDA's netnode feature.
* **!ks**: Debugger Markup Language (DML) enhanced output of **kv** command. Code Addresses are clickable (**!jmpto**) as well as data addresses (**dc**).
* **!translate **: Meant to be used from IDA (``Alt-F2`` shortcut), rebase an address with respect to its module's name and offset.

#### Address optional argument

**!cmt**, **!rcmt** and **!fcmt** commands support an optional address option: ``-a`` or ``--address``.
Address should be passed as an hexadecimal value. Command parsing is based on python's
``argparse`` module. To stop line parsing use ``--``.

```
[WinDbg]
0:000:x86> !cmt -a 0x430DB2 comment
```

The address has to be a valid instruction's address.

## GNU gdb (GDB) usage

Sync with host:

```
gdb> sync
[sync] sync is now enabled with host 192.168.52.1

gdb> r
Starting program: /bin/ls
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/libthread_db.so.1".
```

### GDB plugin commands

Use commands, **without "!" prefix**

```
(gdb) cmd x/i $pc
[sync] command output: => 0x8049ca3: push edi

(gdb) synchelp
[sync] extension commands help:
> sync
> syncoff
> cmt [-a address]
> rcmt [-a address]
> fcmt [-a address]
> cmd
> bc
> rln

> bbt
> patch
> bx /i
> cc
> translate
```

* **rln**: Get symbol from the IDB for the given address
* **bbt**: Beautiful backtrace. Similar to **bt** but requests symbols from disassembler

```
(gdb) bt
#0 0x0000000000a91a73 in ?? ()
#1 0x0000000000a6d994 in ?? ()
#2 0x0000000000a89125 in ?? ()
#3 0x0000000000a8a574 in ?? ()
#4 0x000000000044f83b in ?? ()
#5 0x0000000000000000 in ?? ()
(gdb) bbt
#0 0x0000000000a91a73 in IKE_GetAssembledPkt ()
#1 0x0000000000a6d994 in catcher ()
#2 0x0000000000a89125 in IKEProcessMsg ()
#3 0x0000000000a8a574 in IkeDaemon ()
#4 0x000000000044f83b in sub_44F7D0 ()
#5 0x0000000000000000 in ()
```

* **patch**: Patch bytes in disassembler based on live context
* **bx**: Beautiful display. Similar to **x** but using a symbol. The symbol
will be resolved by disassembler.
* **cc**: Continue to cursor in disassembler. This is an alternative to using ``F3`` to
set a one-shot breakpoint and ``F5`` to continue. This is useful if you prefer
to do it from gdb.

```
(gdb) b* 0xA91A73
Breakpoint 1 at 0xa91a73
(gdb) c
Continuing.

Breakpoint 1, 0x0000000000a91a73 in ?? ()
(gdb) cc
[sync] current cursor: 0xa91a7f
[sync] reached successfully
(gdb)
```

## LLDB usage

1. Sync with host

```
lldb> process launch -s
lldb> sync
[sync] connecting to localhost
[sync] sync is now enabled with host localhost
[sync] event handler started
```

2. Use commands

```
lldb> synchelp
[sync] extension commands help:
> sync = synchronize with or the default value
> syncoff = stop synchronization
> cmt = add comment at current eip in IDA
> rcmt = reset comments at current eip in IDA
> fcmt = add a function comment for 'f = get_func(eip)' in IDA
> cmd = execute command and add its output as comment at current eip in IDA
> bc = enable/disable path coloring in IDA
color a single instruction at current eip if called without argument
lldb> cmt mooo
```

## OllyDbg 1.10 usage

1. Use Plugins menu or shortcuts to enable (``Alt+s``)/disable (``Alt+u``)
synchronization.

## OllyDbg2 usage

1. Use Plugins menu or shortcuts to enable (``Ctrl+s``)/disable (``Ctrl+u``)
synchronization.

Due to the beta status of OllyDbg2 API, only the following features have been implemented:

- Graph sync [use ``F7``; ``F8`` for stepping]
- Comment [use ``CTRL+;``]
- Label [use ``CTRL+:``]

## x64dbg usage

1. Use Plugins menu or commands enable ("``!sync"``) or disable ("``!syncoff``") synchronization.

2. Use commands

```
[sync] synchelp command!
[sync] extension commands help:
> !sync = synchronize with or the default value
> !syncoff = stop synchronization
> !syncmodauto = enable / disable idb auto switch based on module name
> !synchelp = display this help
> !cmt = add comment at current eip in IDA
> !rcmt = reset comments at current eip in IDA
> !idblist = display list of all IDB clients connected to the dispatcher
> !idb = set given module as the active idb (see !idblist)
> !idbn = set active idb to the n_th client. n should be a valid decimal value
> !translate = rebase an address with respect to local module's base
```

Note: using the **!translate** command from a disassembler (IDA/Ghidra,
``Alt-F2`` shortcut), will make the disassembler window to "jump" to the
specific address (equivalent of running **disasm ** in x64dbg
command line).

## Python library usage

One may want to use **ret-sync** core features (position syncing with a
disassembler, symbol resolution) even though a full debugging environment is
not available or with a custom tool. To that end, a minimalist Python library
has been extracted.

The example below illustrates the usage of the Python library with a script
that walks through the output of an event based logging/tracing tool.

```python
from sync import *

HOST = '127.0.0.1'

MAPPINGS = [
[0x555555400000, 0x555555402000, 0x2000, " /bin/tempfile"],
[0x7ffff7dd3000, 0x7ffff7dfc000, 0x29000, " /lib/x86_64-linux-gnu/ld-2.27.so"],
[0x7ffff7ff7000, 0x7ffff7ffb000, 0x4000, " [vvar]"],
[0x7ffff7ffb000, 0x7ffff7ffc000, 0x1000, " [vdso]"],
[0x7ffffffde000, 0x7ffffffff000, 0x21000, " [stack]"],
]

EVENTS = [
[0x0000555555400e74, "malloc"],
[0x0000555555400eb3, "open"],
[0x0000555555400ee8, "exit"]
]

synctool = Sync(HOST, MAPPINGS)

for e in EVENTS:
offset, name = e
synctool.invoke(offset)
print(" 0x%08x - %s" % (offset, name))
print("[>] press enter for next event")
input()
```

# Extend

While initially focused on dynamic analysis (debuggers), it is of-course
possible to extend the plugins set and integrate with other tools.

- Integration with **REVEN** Timeless Analysis and Debugging Platform by [Tetrane](https://www.tetrane.com/):
- http://blog.tetrane.com/2015/02/reven-in-your-toolkit.html
- https://twitter.com/tetrane/status/1374768014193799175
- Integration with **EFI DXE Emulator** by Assaf Carlsbad ([@assaf_carlsbad](https://twitter.com/assaf_carlsbad)):
- https://twitter.com/assaf_carlsbad/status/1242114356881641474
- https://github.com/assafcarlsbad/efi_dxe_emulator

Other resource(s):

- "*Combining static and dynamic binary analysis - ret-sync*" by Jean-Christophe Delaunay
- https://www.synacktiv.com/ressources/bieresecu1_ret-sync_en.pdf

# TODO

- Sure.

# Known Bugs/Limitations

- Tested with Python 2.7/3.7, IDA 7.7 (Windows, Linux and Mac OS X), Ghidra 10.1.1, Binary Ninja 3.0.3225-dev, GNU gdb (GDB) 8.1.0 (Debian), lldb 310.2.37.
- **THERE IS NO AUTHENTICATION/ENCRYPTION** whatsoever between the parties; you're on your own.
- Self modifying code is out of scope.

With GDB:

- it seems that stop event is not called when using 'return' command.
- multi-threading debugging have issues with signals.

With WinDbg:

- IDA's client plugin gets notified even though encountered breakpoint
uses a command string that makes it continue ('``g``'). This can cause major slow-down
if there are too much of these events. A limited fix has been implemented, the
best solution is still to sync off temporarily.
- Possible race condition

With Ghidra:

- Shortcuts are not working as expected in decompiler widget.

With IDA:

- Graph window redrawing is quite slow for big graphs.
- **ret-sync** shortcuts conflicts in Linux environments.

Conflict(s):

- Logitech Updater software is known to use the same default port (9100). A solution
is to use a global `.sync` configuration file to define a different port.

```
[INTERFACE]
host=127.0.0.1
port=9234
```

# License

**ret-sync** is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should have received a copy of the GNU General Public License
along with this program. If not, see http://www.gnu.org/licenses/.

The Binary Ninja plugin is released under the MIT licence.

# Greetz

Hail to Bruce Dang, StalkR, @Ivanlef0u, Damien Aumaître, Sébastien Renaud and
Kévin Szkudlapski, @_m00dy_, @saidelike, Xavier Mehrenberger, ben64, Raphaël
Rigo, Jiss for their kindness, help, feedbacks and thoughts. Ilfak Guilfanov,
Igor Skochinsky and Arnaud Diederen for their help with IDA's internals and
outstanding support. Thank you to Jordan Wiens and Vector 35. Finally, thank
you also to all the contributors and everyone who reported issues/bugs.