GitHub - endgameinc/xori
source link: https://github.com/endgameinc/xori
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.
README.md
Xori - Custom disassembly framework
Xori is an automation-ready disassembly and static analysis library that consumes shellcode or PE binaries and provides triage analysis data.
Architectures:
- i386
- x86-64
File Formats
- PE, PE+
- Plain shellcode
Current Features
- Outputs json of the 1) Disassembly, 2) Functions, and 3) Imports.
- Manages Image and Stack memory.
- 2 modes:
- Light Emulation - meant to enumerate all paths (Registers, Stack, Some Instructions).
- Full Emulation - only follows the code’s path (Slow performance).
- Simulated TEB & PEB structures.
- Evaluates functions based on DLL exports.
- Displays strings based on referenced memory locations.
- Uses FLIRT style signatures (Fast Library Identification and Recognition Technology).
- Allows you to use your own exports for simulating the PEB.
- Will detect padding after a non-returning call.
- Will try to identify function references from offsets.
What it doesn't do yet:
- The engine is interactive.
- Does not dump strings.
- Does not process non-executable sections.
- TEB and PEB are not enabled for non-pe files.
- Only some x86 instructions are emulated, not all.
- Patching and assembling.
- No plugins or scripting.
Documentation
Requirements
rustc 1.27.0
Install rust for OSX & Linux Distros
curl https://sh.rustup.rs -sSf | sh
Install rust for Windows
https://www.rust-lang.org/en-US/other-installers.html
Select:
- x86_64-pc-windows-gnu or
- x86_64-pc-windows-msvc (Visual Studio Build Tools Required)
Installation
1. Build Xori
This command will also create other binaries such as pesymbols ans peinfo.
git clone https://github.com/endgameinc/xori.git
cd xori
cargo build --release
2. Create xori.json config file
cp xori.json.example xori.json
[edit if desired]
3. (Optional) Build the symbols files
If you want to create your own symbol files you need to set the dll folders to where you stored your windows dlls.
"function_symbol32": "./src/analysis/symbols/generated_user_syswow64.json",
"function_symbol64": "./src/analysis/symbols/generated_user_system32.json",
"symbol_server": {
"dll_folder32": "./dlls/32bit",
"dll_folder64": "./dlls/64bit"
Run pesymbols to overwrite the function_symbol json
./target/release/pesymbols
Run
./target/release/xori -f test.exe
Run all tests
cargo test
Browser GUI
Chrome Firefox Safari IE Opera Latest ✔ Latest ✔ Latest ✔ x Latest ✔Requirements
nodejs yarn (optional for UI dev)
Build
cd gui
npm install
Run
In one terminal
cd gui
node src/server.js
In another terminal
cd gui
npm start
It will open your default browser to http://localhost:3000/. The backend API is listening on localhost:5000.
Recommend
About Joyk
Aggregate valuable and interesting links.
Joyk means Joy of geeK