LIEF
goblin
Our great sponsors
LIEF | goblin | |
---|---|---|
4 | 3 | |
4,137 | 1,135 | |
2.1% | - | |
9.4 | 6.6 | |
18 days ago | 9 days ago | |
C++ | Rust | |
Apache License 2.0 | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
LIEF
-
What's the Most Portable Way to Include Binary Blobs in an Executable?
My team is working on this problem in the context of creating Node.js single-executable applications. While the naive approach of just appending data at the end of the binary works, it is not friendly with code-signature in macOS and Windows given that signing operates on PE and Mach-O sections.
We have recently open-sourced a small tool called Postject (https://github.com/postmanlabs/postject), which is able to inject arbitrary data as proper ELF/Mach-O/PE sections for all major operating systems (with AIX support coming). The tool also provides C/C++ cross-platform headers for easily traversing the final binary and introspect whether the segment is present or not.
The tool is based on the LIEF (https://github.com/lief-project/LIEF) project.
At Postman, we are making use of this on our custom Node.js single-executable applications and soon on our custom Electron.js builds too.
-
Pefile python module features
https://github.com/lief-project/LIEF https://lief-project.github.io/doc/latest/api/python/index.html
-
Collection of tools for executable packing detection
Bintropy: Entropy-based packing detection featuring multiple modes (whole binary, per section or segment). Based on the awesome LIEF library, therefore supports ELF, PE, Mach-O.
-
rabin2 for scraping ELF to JSON
I've been looking at LIEF toolkit for similar purposes (https://github.com/lief-project/LIEF). It's a python framework for cross platform binary analysis. I'm curious, does rabin2 support dll format?
goblin
-
[ANN] yabridge 4.0, with chainloading, an overhauled backend, and many user experience improvements
On the backend side, a lot has changed. The biggest change is that the dependency on Boost has been completely removed, and everything has been reworked accordingly. This should make packaging easier, as yabridge now no longer depends on any system library other than the basic libraries needed to interact with X11. Some parts of Boost have been replaced by other headers-only libraries, while other parts now simply use custom implementations. All of this is explained in more detail in the 'Packaging notes' section of the changelog. Yabridgectl also lost its dependency on winedump, at least in most cases. It now tries to parse plugin libraries directly using the goblin binary parsing library. This should also speed up the syncing process. I did, however, run into one plugin that this new parser couldn't handle. If that happens then winedump will still be used instead.
-
Crash reporting in Rust
For now the minidump creation is a fairly faithful port of the Breakpad code, but like I said some of that code is really old, so there's probably cases where taking a step back and rethinking the approach based on new kernel or OS capabilities or, instead of recreating process snapshotting for each non-Windows, just have a really good parser for each OSes crash format that does a transform. Rust is a fantastic language for writing those kinds of parsers, so that would definitely be an interesting avenue to investigate, especially since in the Linux case a lot of groundwork has already been done by goblin.
-
What's your favourite under-rated Rust crate and why?
I do security-related projects in Rust, and goblin has been my go-to crate for any type of binary parsing (ELF/PE/Mach-O).
What are some alternatives?
dll-proxy-generator - Creates a proxy dll which sits between the game and original dll
pwninit - pwninit - automate starting binary exploit challenges
radare2 - UNIX-like reverse engineering framework and command-line toolset
autocxx - Tool for safe ergonomic Rust/C++ interop driven from existing C++ headers
tree-sitter-html - HTML grammar for Tree-sitter
eve-echoes-tools - Collection of tools helping in reverse engineering Eve Echoes
vivaldi_modding - Custom modifications for Vivaldi web browser.
binary-security-check - Moved: https://codeberg.org/koutheir/binary-security-check
pe - A :zap: lightweight Go package to parse, analyze and extract metadata from Portable Executable (PE) binaries. Designed for malware analysis tasks and robust against PE malformations.
biodiff - Hex diff viewer using alignment algorithms from biology
bintropy - Analysis tool for estimating the likelihood that a binary contains compressed or encrypted bytes
netease-messiah-tools - Tools working with files in NetEase's Messiah Engine (Primarily aimed towards Diablo Immortal for now)