polypyus icon indicating copy to clipboard operation
polypyus copied to clipboard

Published 20 hours ago • verified publisher icon seemoo-lab

Importing found functions from Polypyus

Open Nikolasel opened this issue 4 years ago • 7 comments

In the readme it is stated that the exported functions can be imported into IDA. How can this be accomplished? Do you use an own IDAPython script or can this IDA by default? Does also a workflow exist to import the functions into Ghidra?

Thanks for your help and kind regards, Nikolas

Nikolasel avatar May 24 '20 09:05 Nikolasel

Hi @Nikolasel,

we currently have import/export scripts for IDA 6.8 and 7.x. Sorry, they were missing in this initial commit, we will push them these days and I will ping you again :)

We're also working on scripts for Ghidra and Binary Ninja, as well as several benchmarks.

jiska2342 avatar May 24 '20 09:05 jiska2342

Sounds great, thanks in advance.

Nikolasel avatar May 24 '20 16:05 Nikolasel

Found the scripts, tested them on IDA 7.2 with Python 2 and IDA 7.4 with Python 3. I hope they work, it's quite experimental. I mainly worked with parsing .csv via awk and piping them into Python scripts that IDA can execute, but that is no user-friendly workflow I guess. Anyway, would be great if you could test the scripts and tell me your IDA version :)

For the overall workflow to improve the IDA database quality I also added the overall workflow including Thumbs Up, BinDiff, and Diaphora to the main README.

jiska2342 avatar May 30 '20 11:05 jiska2342

Thank you, I will test it.

Nikolasel avatar May 30 '20 11:05 Nikolasel

I tested the scripts a little bit. Currently, I am using IDA Pro 7.4 with Python 3. The script pp_import.py works in my setup. The script pp_export_all_names.py doesn't work due to line 36. Here the old Python 2 print statement is used and this doesn't work in Python 3. And after the successful export, I noticed that the CSV has the order [name addr size type mode] and polypyus instead uses the order [name addr size mode type].

Nikolasel avatar Jun 01 '20 10:06 Nikolasel

Thanks for testing :) @FlorianKosterhon has a more recent version of those scripts on his machine and will push them in the upcoming week.

Slightly off-topic question: Which firmware did you run Polypyus on? So far, we only tested it on ARM Cortex M3/M4 Bluetooth firmware as well as some of the Nexmon Wi-Fi firmware.

jiska2342 avatar Jun 01 '20 11:06 jiska2342

I used Polypyus with different versions of Broadcom/Nexmon Wi-Fi firmware.

Nikolasel avatar Jun 01 '20 11:06 Nikolasel