tkmru / nao Goto Github PK

View Code? Open in Web Editor NEW

267.0 13.0 60.0 218 KB

Simple No-meaning Assembly Omitter for IDA Pro (This is just a prototype)

License: GNU General Public License v3.0

C 7.46% Python 92.54%

idapython ida-plugin malware-analysis unicorn-emulator

nao's Introduction

nao

nao(no-meaning assembly omiter) is simple dead code eliminator plugin for IDA pro.

Nao is just a prototype

before:

after:

Requirement

IDAPython
Unicorn and Python binding

How to Install Unicorn

Please follow the link.

Download – Unicorn – The ultimate CPU emulator

Installation

Please copy the contents of nao directory in this repository to $IDA_ROOT/plugins folder, or just run nao/nao.py as the IDAPython script. After you install nao.py, you'll see eliminate dead code button on Edit/Plugins menu.

Usage

Shift-D display eliminated disassemble code from current function.

Licence

GPL v3 license

nao's People

Contributors

Stargazers

Watchers

nao's Issues

handle UNMAPPED ERROR

hook write and read memory, check address and write data to memory.

support branch

hook jxx instruction, get LBR. judge for loop or infinite loop by checking ecx .

copyed from handle infinite loop · Issue #19 · tkmru/nao

In unitetest, ImportError: No module named idaapi

nao> python -m unittest discover
E
======================================================================
ERROR: tests.test_eliminate (unittest.loader.ModuleImportFailure)
----------------------------------------------------------------------
ImportError: Failed to import test module: tests.test_eliminate
Traceback (most recent call last):
  File "C:\Python27\lib\unittest\loader.py", line 254, in _find_tests
    module = self._get_module_from_name(name)
  File "C:\Python27\lib\unittest\loader.py", line 232, in _get_module_from_name
    __import__(name)
  File "C:\Downloads\nao\tests\test_eliminate.py", line 6, in <module>
    from nao import eliminate
  File "C:\Downloads\nao\nao\eliminate.py", line 6, in <module>
    import idaapi
ImportError: No module named idaapi


----------------------------------------------------------------------
Ran 1 test in 0.000s

FAILED (errors=1)

unicornでdeadcode除去

独自graph view

handle infinite loop

use timeout on unicorn
hook jxx instruction, get LBR. judge for loop or infinite loop by checking ecx .

dead codeが削除出来ずに落ちるケース

dsを使う(dead_code.exe)

mov ecx, ds:?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ; std::basic_istream<char,std::char_traits<char>> std::cin

exessive eliminate (using return value)

関数の返り値を利用するコードを削除してしまう

cool project!

looks like a very useful tool! linked to your project from our site now: http://www.unicorn-engine.org/showcase/

keep it up, cheers.

Error : String index out of range

Hello,

I tried running this plugin on a CTF binary from GreHack 2015 (This one) and the plugin crashes when I try to run dead code elimination.

Here is the python traceback :

Traceback (most recent call last):
  File "D:/Logiciels/IDA6.8/scripts/nao/nao.py", line 201, in create_view
    view.Create()
  File "D:/Logiciels/IDA6.8/scripts/nao/nao.py", line 104, in Create
    self.load(ea)
  File "D:/Logiciels/IDA6.8/scripts/nao/nao.py", line 118, in load
    if not self.eliminate_deadcode(ea):
  File "D:/Logiciels/IDA6.8/scripts/nao/nao.py", line 149, in eliminate_deadcode
    if b'\x90' != i[1][0]:  # check dead code
IndexError: string index out of range

"xrange" is not defined

Windows 10 1607
IDA PRO 7.5
Python 3.8

Nao cannot remove this piece of deadcode

stc
cmc

This does not get removed by nao for some reason.

mapping .data

undefined function PLUGIN_ENTRY

To resolve issue, make PLUGIN_ENTRY function.

Scriptable plugins – Hex Blog

IDA 7.0 Support

Can you update it to new version?

write test code

It is troublesome to check operation using IDA.

z3pyでdead code除去できるようにする

exessive eliminate (function parameter)

関数呼び出し時の引数をロードする処理を除去してしまっている。
(lea命令)

ファイルの読み込み

non block ui

use PyQt IDLE event.

GLib-ERROR: gmem.c: 103: failed to allocate 20970880 bytes

How to reproduce error.

python -m unittest tests.test_eliminate.TestEliminate.test_check_heavy_deadcode