unfuck
goblin
Our great sponsors
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
unfuck
-
Show HN: A new LLVM optimization pass that aggressively reduces WebAssembly size
This is sweet! This is actually a very similar approach to how I deobfuscate Python bytecode: https://github.com/landaire/unfuck/blob/bfa164b4e261deffeb37...
My code is pretty messy, but I take the same exact approach of taking known function parameters, interpreting the instructions, and removing any condition and the instructions which built its arguments if it evaluates to a constant value. Even called it partial execution as well :p
- GitHub - landaire/unfuck: Python 2.7 bytecode d̶e̶o̶b̶f̶u̶s̶c̶a̶t̶o̶r unfucker
-
Unfuck: A utility for deobfuscating Python 2.7 bytecode
I haven't heard of this tool before, but I don't think it would work for obfuscated code. Check out the graph image on my wiki [1]. While this image doesn't show the exact scenario, imagine that the first instruction is a `JUMP_ABSOLUTE 100` and the rest of the instructions between offset [3,100) are just garbage or invalid.
A naive disassembler (like the `dis` module in python) interprets the bytecode linearly -- i.e. one instruction after another. Rizin's diassembler [2] seems to take the same approach. The way I do disassembly is to only disassemble code paths that are potentially executed by queueing non-conditional jumps, both targets of a conditional jump, and the next instruction when the current instruction is non-jumping instruction.
[1] https://github.com/landaire/unfuck/wiki/Obfuscation-Tricks
- unfuck - a deobfuscator for Python 2.7 bytecode
goblin
-
[ANN] yabridge 4.0, with chainloading, an overhauled backend, and many user experience improvements
On the backend side, a lot has changed. The biggest change is that the dependency on Boost has been completely removed, and everything has been reworked accordingly. This should make packaging easier, as yabridge now no longer depends on any system library other than the basic libraries needed to interact with X11. Some parts of Boost have been replaced by other headers-only libraries, while other parts now simply use custom implementations. All of this is explained in more detail in the 'Packaging notes' section of the changelog. Yabridgectl also lost its dependency on winedump, at least in most cases. It now tries to parse plugin libraries directly using the goblin binary parsing library. This should also speed up the syncing process. I did, however, run into one plugin that this new parser couldn't handle. If that happens then winedump will still be used instead.
-
Crash reporting in Rust
For now the minidump creation is a fairly faithful port of the Breakpad code, but like I said some of that code is really old, so there's probably cases where taking a step back and rethinking the approach based on new kernel or OS capabilities or, instead of recreating process snapshotting for each non-Windows, just have a really good parser for each OSes crash format that does a transform. Rust is a fantastic language for writing those kinds of parsers, so that would definitely be an interesting avenue to investigate, especially since in the Linux case a lot of groundwork has already been done by goblin.
-
What's your favourite under-rated Rust crate and why?
I do security-related projects in Rust, and goblin has been my go-to crate for any type of binary parsing (ELF/PE/Mach-O).
What are some alternatives?
rizin - UNIX-like reverse engineering framework and command-line toolset.
pwninit - pwninit - automate starting binary exploit challenges
cwe_checker - cwe_checker finds vulnerable patterns in binary executables
autocxx - Tool for safe ergonomic Rust/C++ interop driven from existing C++ headers
debugoff - Linux anti-debugging and anti-analysis rust library
eve-echoes-tools - Collection of tools helping in reverse engineering Eve Echoes
pocket - Mixed Boolean Arithmetic Expression Obfuscator
LIEF - LIEF - Library to Instrument Executable Formats
thefuck - Magnificent app which corrects your previous console command.
binary-security-check - Moved: https://codeberg.org/koutheir/binary-security-check
SkidSuite - A collection of java reverse engineering tools and informational links
netease-messiah-tools - Tools working with files in NetEase's Messiah Engine (Primarily aimed towards Diablo Immortal for now)