Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/xorpd/fcatalog_client

fcatalog idapython client
https://github.com/xorpd/fcatalog_client

Last synced: 19 minutes ago
JSON representation

fcatalog idapython client

Awesome Lists containing this project

README 

        
FCatalog Client (IDA Plugin)

============================



This is the FCatalog Client IDA Plugin.

FCatalog is the Functions Catalog. It is a tool for quickly finding similar

functions from a large database of functions.



You can find the [fcatalog_server repository here](https://github.com/xorpd/fcatalog_server).



Requirements:

-------------



- You need IDA (Interactive Disassembler by Hex Rays) installed. I tested this

  only on IDA of version >= 6.



- Python2.7. I think that it should come together with IDA. Note that this code

  will not work with Python3. Sorry about that, IDA doesn't support Python3

  scripting yet.



- I tested this only on Windows 7. It might work on linux, but also might not.



- You will need a working [fcatalog_server](https://github.com/xorpd/fcatalog_server).



Installation

------------

Copy the fcatalog_client directory and fcatalog_plugin.py to the plugins

directory of your IDA installation. Then restart IDA.



Main Functions

--------------



After the installation, when you open any file with IDA you should see new menu

items under the **Edit** menu: 

- FCatalog: Clean IDB

- FCatalog: Find Similars

- FCatalog: Commit Functions

- FCatalog: Configure



First, configure your client by clicking on **FCatalog: Configure**. A dialog

box will ask you for the host and port of your FCatalog server. You will also

need to specify a database name. You can pick any database name that you want.

If it does not exist, it will be created automatically.



**FCatalog: Commit Functions** will save all your good "reversed" functions into

the remote database. Functions are considered good and "reversed" if all of the

following are true:



- They have a meaningful name (Any name that doesn't contain MAYBE or RELATED)

- They weren't acquired from a previous 'FCatalog: Find Similars' operation.

- They are long enough (At least 0x40 bytes) 

- They are not fragmented (Might be implemented in the future).



The IDA console should show you which functions were sent to the database.



**FCatalog: Find Similars** will search for every "unreversed" function inside

your IDB the most similar known function from the functions catalog database.

It will then rename the function according to the name from the functions

catalog database.



The new name will be of the format:

FCATALOG__{grade}__{function_name}

grade is the similarity score, between 0 and 16. 0 means not similar at all, 16

means very similar.



"unreversed functions" are functions that don't have any meaningful name, or

they have a name picked by the fcatalog system.



**FCatalog: Clean IDB** will clean your IDB from any fcatalog function names.

If you suddenly got scared from all the new function names, you can always

click on this button.



Tests

-----

There are basic offline tests in the test directory. You can run them with

unittest as follows:



        c:\python27\python.exe -m unittest discover



There is one online test (Runs against a real server). It is

tests/live_server.py. It should be run as follows:



        c:\python27\python.exe -m fcatalog_client.tests.live_server  



Website

-------

Visit me at http://www.xorpd.net