Fandom

Magic Lantern Firmware Wiki

IDAPython/Static analysis

< IDAPython

328pages on
this wiki
Add New Page
Talk0 Share

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.

This is work in progress and I don't have any formal background in this area, so don't believe all the stuff from here :)

ResourcesEdit

SymPyEdit

Symbolic math in Python. Will be very useful for data flow analysis.

metasmEdit

A nice framework, but not for ARM. They have some interesting presentations and papers:

MiscEdit

TODO: read them :)

Useful functionsEdit

See utils.py

NotationsEdit

  • unk_R0, unk_R1...: before emulating a piece of ARM code, those symbols are loaded into registers
  • arg0 ... arg3: those symbols are loaded into R0...R3 when starting emulation from the first line of a function
  • sp0: stack pointer at the beginning of the function being analyzed
  • unhandled.R1...: there was some instruction not implemented in the ARM emulation code, which referenced R1 (or other registers)
  • MEM(0x1234): memory addressing (pointer dereference operator)
  • ret_myfunc_0xFFFF1234: value returned by "myfunc" when it was called at addr 0xFFFF1234

TechniquesEdit

In theory, there is no difference between theory and practice. But, in practice, there is. [1]

Code flow analysis (code paths)Edit

Look at conditional jumps and generate a list of possible code paths.

A path is a unique sequence of branches from the function entry to the exit [2]. Any module with a succession of n decisions in it can have up to 2^n paths within it [3].

Symbolic emulation of a code pathEdit

Since we don't (always) know the initial condititions, ARM emulators are not very helpful (at least not for me). Symbolic emulation assumes there are some unknowns there, and here SymPy shows it's mighty power :D

BacktracingEdit

This is useful for guessing argument values in function calls. Much better than the old method, but also much slower.


ResultsEdit

Also on Fandom

Random Wiki