Plugin Idea Wish List

[psifertex]

Please include a comment with an idea for a plugin you have that you don't have time to implement and we can use this issue to track it so when someone is looking for ideas of plugins to implement they can grab something from this list:

• LLIL emulator -- simulate binary execution by emulating IL instructions emILator (WIP)
• Auto-Unpacker -- emulate basic memory operations to automatically unpack simple packing mechanisms.
• Magic Strings -- see: https://github.com/joxeankoret/idamagicstrings
• Malware Repository search -- automate the ability to query the various online malware repositories for information about a given file's hash (or potentially hashes referenced in another file) and display the results internally. See: https://github.com/rshipp/awesome-malware-analysis#malware-corpora and https://github.com/rshipp/awesome-malware-analysis#online-scanners-and-sandboxes and https://blog.virustotal.com/2020/02/official-virustotal-plugin-for-ida-pro-7.html and https://www.sentinelone.com/labs/introducing-sentinelones-ghidra-plugin-for-virustotal/ (one example that might be helpful to start with is https://github.com/Vector35/unpacme)
• Better C++ functionality -- One example is https://github.com/0xgalz/Virtuailor
• Triton (https://github.com/JonathanSalwan/Triton): Some functionality may be met by for example the coverage data visualization of Lighthouse and bncov as well as the symbolic execution of seninja, but it would be great to have the actual plugin itself add BN support.
• Binbloom wrapper/loader -- https://github.com/quarkslab/binbloom
• Rewriting library -- I think analysis passes will be required to best implement this framework at which point something like https://eshard.com/posts/d810_blog_post_1/ for building a set of deobfuscation capabilities would be useful
• Better CAPA integration (https://github.com/fireeye/capa/releases/tag/v1.6.0) Currently only has https://github.com/fireeye/capa/blob/155de6f2b9550b9afc38d29907f9d77d95b82e7b/scripts/import-to-bn.py
• Veles or CantorDust style visualizations
• Debugger Stealth plugin (like ScyllaHide)
• Tenet support for BN (initial attempt here: Binja Support gaasedelen/tenet#20)
• TE File format parsers -- https://github.com/snare/ida-efiutils/blob/master/te_loader.py
• Better EFI support, such as https://github.com/binarly-io/efiXplorer
• intel hex support (completed with hexfiles
• retsync support (https://github.com/bootleg/ret-sync#ida-usage). Already have an integrated debugger plus generic gdb support but so does IDA, and some folks still find value in retsync so it's worth considering -- Retsync now has experimental BN support
• Binary Diffing -- see Support for Hopper joxeankoret/diaphora#29 (comment) for information on integrating with Diaphora, or consider porting/re-implementing https://github.com/google/binexport for support with bindiff or https://github.com/McGill-DMaS/Kam1n0-Plugin-IDA-Pro // BinExport (for BinDiff support) is currently a work in progress at: https://github.com/google/binexport and occasionally on test branches. I'm marking this as done, for more information, see: https://www.youtube.com/watch?v=tPw7UPnwUiY&t=257s and the included description.
• Division De-optimizer -- Take optimized division (https://zneak.github.io/fcd/2017/02/19/divisions.html / https://github.com/hcs0/Hackers-Delight) and annotate the constants with the actual division being done (Start of an implementation: https://github.com/cah011/binja-div)
• Function Recognizer (will eventually be implemented in core, but feel free to implement a prototype) -- ability to identify statically compiled functions either by: (analyzing source code and identifying dependencies/relationships) or by porting function fingerprints from a binary with symbols to a binary without symbols) -- Signature Library is a thing!
• Auditor Framework -- VulnFanatic implements this request
• Capstone -- implement a generic shim leveraging capstone for any otherwise unsupported architecture. Example PPC plugin demonstrates this capability.
• Crypto Finder -- using common constants identify various cryptographic algorithms. Bonus points for avoiding false positives by using the IL to detect equivalent uses (https://github.com/blackthorne/Codetective) -- Initial implementation by https://github.com/Rami114/cryptoscan
• IDA/IDC Sync -- Ability to import / export common elements like symbols, names, functions, comments, etc between IDA and Binary Ninja. Bonus points: implement a tool agnostic format that supports plugins so that sync between radare2, hopper, etc, can be done as well. Several plugins implement this with varying features: and there are tickets tracking internal (1, 2) features.
  • https://github.com/angr/binsync
  • https://github.com/Cryptogenic/idc_importer
  • https://zznop.github.io/bnida/
  • https://github.com/lunixbochs/revsync
  • https://github.com/williamshowalter/revsync_ghidra
• Decompiler -- that's a thing now
• Code Editor -- Snippets is a plugin in the official plugin repository
• Sibyl support -- https://github.com/cea-sec/Sibyl (https://github.com/thebabush/binja_sibyl exists for the curious but looks like upstream isn't maintained anymore and doesn't even support Python3)

[lucasduffey]

• Decompiler - IL based
• Auditor - "potential findings" tab plugins could append findings to. For instance, a quick sweep of system call usage could flag everything hat has arg0 as unknown or possibly tainted. Could have a "reviewed" checkbox, and clickable xref that would send you to the code in question.
• capstone - plugin to provide architectures not supported by binja

[Martyx00]

An attempt to provide auditor plugin: https://github.com/Martyx00/VulnFanatic (already submitted to be included in Plugin Store)

[psifertex]

Thanks for the reminder about that, sorry for the delay. I had added it locally but not pushed yet!

[psifertex]

I'm marking all these as done as decompiler is about to land on dev, auditor is in the plugin manager, and we've published https://github.com/Vector35/ppc-capstone as an example capstone plugin.

[psifertex]

Marking this as an answer jus so that this post doesn't show up on our "unanswered" list.

[polsab]

• Binary differ - BinDiff/Diaphora/DarunGrim for binja

[kongo86]

• Binary differ - BinDiff/Diaphora/DarunGrim for binja

[withzombies]

• Arbitrary data flow labels. Allow plugins to create arbitrary dataflow labels (e.g. "Sensitive", "Crypto") and register callbacks to handle instances where they mix and sink.

[psifertex]

@withzombies Not sure that could be done effectively with a third-party plugin? Sounds more like a core change.

[withzombies]

It could, but it'd end up with someone re-implementing data flow on top of the IL as a plugin.

[psifertex]

Gotcha. I'll add it to the list with the caveat that it'll also be one of those likely to be implemented in the core later as well. Though it will be a lot easier to do with SSA about to land.

[psifertex]

Commenting since I'm on my phone: https://github.com/McGill-DMaS/Kam1n0-Plugin-IDA-Pro might be a good basis for a function comparator.

[cah011]

Division De-optimizer - WIP
https://github.com/cah011/binja-div

[lucasduffey]

intel hex file support (https://en.wikipedia.org/wiki/Intel_HEX)

[shiftre]

An IDA importer would be nice, I guess it's similar to IDA/IDC Sync, either export an IDB to an IDC or just import the whole IDB.

[psifertex]

IDA Importer exists: https://github.com/Vector35/BinaryNinjaImporter

[tonylambiris]

FWIW I hacked up a python script to attempt to install and enable all current plugins.

Copy and paste the following into the script console:
https://gist.github.com/tonylambiris/2168f3853f486efb0eb62bef7bbf0fc0

[plafosse]

We've now got a UI for installing plugins, so this is much less relevant

[nbanmp]

I've got a working pattern-agnostic division deoptimizer that operates on MLIL, and to a less tested extent a modulo deoptimizer. I've got to clean up the code and fix a couple easy bugs, but I'll open source it relatively soon.

[psifertex]

Just a heads up that a new feature is about to hit the development builds called "workflows" that lets you replace MLIL. This would let a division de-optimizer actually re-write the IL to produce extremely clean decompilation results which is one of the main reasons we hadn't been pursuing deoptimizers or idiom replacers yet as we wanted this generic capability first.

[0xdevalias]

Docs:

• https://docs.binary.ninja/dev/workflows.html

[psifertex]

That's great news -- that was actually on our todo list for HLIL after launch, but it's great to hear you've already got something going on that front.

[yrp604]

Instruction extender, specifically the ability to get system manual information easily from disassembly views (tooltip, comment, whatever).

Examples:
https://github.com/NeatMonster/AMIE
https://github.com/alexhude/FRIEND

[psifertex]

Pretty sure one like this existed as a UI hack plugin before we had official UI pluginss but I'm trying to remember where it was.

[psifertex]

https://github.com/ehennenfent/binja_explain_instruction

[psifertex]

It hasn't been updated to the new plugin format unfortunately.

[nbanmp]

@psifertex Here's my work on division & modulo deoptimization.

https://github.com/jmprdi/binja-division-deoptimization

[psifertex]

Thanks! Marked that one as done. 👍👍

[psifertex]

Looks like @cblichmann has committed an MVP for BinDiff BN support! I'm going to leave the box above unchecked for now until the following features are completed:

• switch table support
• names/symbols/comments
• operands as expressions

Once those are complete I'd consider this complete enough to check off. That said, from Christian's thread, some other optional improvements would be:

• integrate tests
• headless exporter
• totally stand-alone like the Ghidra exporter
• fix multi-arch support
• lots of testing!

https://mobile.twitter.com/AdmVonSchneider/status/1254571681911386112

[marcusx2]

Here's a list of plugins that IDA Pro has that I'd like to see on BN. Some may or may not have already been implemented:

1. deREferencing
2. Karta
3. IDAFuzzy
4. BinCAT
5. SimplifyGraph
6. Ponce
7. Keypatch
8. AutoRE
9. DIE
10. HexRaysCodeXplorer
11. idafunctionstringassociate
12. Class Informer

When I saw these plugins I thought they should not be plugins at all, but at the core of IDA. Same for BN, I think the functionalities these plugins provide are very useful and would be great if they were implemented in the core, or as free plugins.

Also I would love the follwing features for the decompiler:

1. Meaningful variable names
2. Simplified C++ Names

[psifertex]

1. Is primarily for debugging, right? I think the de-referencing pointers already occurs, but that belongs more as a feature request over on: https://github.com/Vector35/debugger

2. Haven't tried this before, thanks for the suggestion. Is it more for function signature matching (statically compiled software) or just matching function headers from imported open source (flirt/flair style matching?). This does actually seem like a good fit for an external plugin and not a core feature.

3. This has been built-in to BN for quite some time. Use the command-palette. (CTl/CMD-P)
   I guess the only thing we don't support by default is the ability to do it for structs (symbol fuzzy matching is the default behavior when clicking into the function/symbol list and typing).

4. Again, this is exactly the thing that BN does already out of the box with the exception that we don't ship specific UAF and double-free detection built on top of it, but there are several example scripts that do (https://github.com/trailofbits/binjascripts). But one of our biggest selling points is this is a first-class feature and doesn't require an additional plugin that only supports some architectures.

5. This has some features we need better support for custom graph representations before it could be implemented.

6. Symbolic execution is something we may implement as a native feature internally, but we're always happy to have a plugin like this ported in the meantime.

7. Again -- this is literally something BN has done even better than KeyPatch and from the very beginning of the product. Have you even used BN before? 😛

8. A one line change to https://gist.github.com/psifertex/6fbc7532f536775194edd26290892ef7#file-functional_tags-py-L23 would do the same thing. :-)

9. Our debugger will already automatically inform the current analysis with things like new branch targets or indirect control flow. Additionally, the debugger already can automatically render types in live memory view which seems like another main feature. Maybe there's some other features that would be worth filing as issues directly on the debugger repo?

10. Yeah, better C++ support is definitely something I think we'll address as a core competency but it's a ways out, probably not something we'll look into until 2021. In the meantime, we'd welcome plugins like this.

11. We've got a much, much better version of this baking internally. No ETA right now, but you can see a bit of the preview capability in the recent live stream we did on Josh Watson's twitch channel: https://www.twitch.tv/videos/641697592?t=00h44m01s

12. RTTI is in the bucket of "C++ future plans"

So the good news is almost half of the things you think should be built in already are. 😛

This definitely feels like you don't have much experience with BN itself before making these suggestions. It would probably be more effective for you to first try it out for a while and give feedback on the current state of things. Given your list of suggestions I think you'll actually like BN a lot since it already does so many of those things built-in.

[marcusx2]

Thanks for the clarifications, I have made 2 requests on the debugger repo based on what you said. No comments on Meaningful variable names though? It's an awesome feature that IDA doesn't have. I think it would put your decompiler way ahead if this was implemented.

[psifertex]

See the video link I posted, it's a part of that.

[d0mnik]

Translation of integers to its named constant equivalent. Basically porting over IDA Pro's Named Constant feature over to Binary Ninja.
More Info: FLARE IDA Pro Script Series: MSDN Annotations Plugin for Malware Analysis

[marcusx2]

@alloygoh related Vector35/debugger#115

[rvrecen]

• Sibyl I think is supported now (https://github.com/thebabush/binja_sibyl)
• For malware searching I think (https://blog.virustotal.com/2020/02/official-virustotal-plugin-for-ida-pro-7.html, https://www.sentinelone.com/labs/introducing-sentinelones-ghidra-plugin-for-virustotal/) has good starting points
• Depending on level of capa support desired, I have a small update I can share, that would just be a PR to capa though right?
• Similarly wrapping floss (comments function score, creates interactive HMTL to navigate, not sure on license issues so not openly available, but can pass along)
  • Assumes floss is installed and in path
    

[psifertex]

Unfortunately it looks like sibyl itself is no longer maintained/supported: cea-sec/Sibyl#102

I took a brief look at updating the BN plugin itself but yeah, I'm going to remove it from the list as it doesn't look valid anymore.

Good suggestion on the search plugins, I'll update the list accordingly.

RE: Capa, yeah, just submit a PR to them and I can check it off here. Among other things, having it as an actual plugin in the plugin manager would be great for discoverability now that we support plugin subfolders.

RE: FLOSS, It's Apache 2 so not sure what licensing issues there might be? Same thing regarding the capa discoverability though.
In fact, here's all you need in the requiremens.txt for the plugin to support auto-dependency installation:

$ cat requirements.txt
git+https://github.com/mandiant/flare-floss#egg=flare-floss

[rvrecen]

Less on the "I expect/encountered license issues" and more "I just have as my own plugin, so not sure what the actual licenses were".

Should either of capa/floss just be their own standalone repos, for discoverability to community repos, and if so, I can just create repos now and start that process to get the plugin checking passing.

[psifertex]

I think it's easier to make the plugins inside of the main repo. The only downside is the main repo maintainers have to be the one to cut new releases. If they're already doing it it's hopefully not a big deal but if they'd rather not then just having the pip dependency and a separate plugin is better, so it kinda depends on them.

[0xdevalias]

I haven’t tried the existing division de-optimiser plugins since i’m only on free; but that was something I was definitely interested in a few weeks back, when I first stumbled upon this thread.

Of particularly note was this comment around using workflows to update the MLIL:

• Plugin Idea Wish List #626 (reply in thread)

The various links across that thread seem to be:

• https://web.archive.org/web/20210729122405/https://zneak.github.io/fcd/2017/02/19/divisions.html
• https://github.com/hcs0/Hackers-Delight
• https://github.com/jmprdi/binja-division-deoptimization
• https://github.com/cah011/binja-div

binja-div seems super old (last update ~7 years ago), and suggests it’s pretty basic, and only seems to add comments rather than re-write IL.

binja-division-deoptimization seems newer (last update ~4 years ago), I didn't look deeply into how it works and if it is doing IL rewriting, so maybe that's still good.

I’m not really sure of the best way of maintaining/updating a list like this.. perhaps it would be better in a markdown file people could raise PR’s to update/modify; or in a github wiki or similar? Or perhaps it’s fine as a discussion.. but I guess my main thought here is that, using the division stuff as an example, there seem to be things that are technically ticked off, that maybe shouldn’t necessarily be, or that could still definitely have some better/modern improvements done to them.

[0xdevalias]

From @CouleeApps on Slack:

fwiw we added first-party division deoptimization in version 3.5 last year

https://binary.ninja/2023/09/15/3.5-expanded-universe.html#moddiv-deoptimization

See also:

• de-optimized math replacements / idiom detection #2043

Simplification of optimized division and modulus has been added in build 3.5.4311

Not all division and modulus code patterns currently simplify. The following issues track cases that are not yet handled:

#4362: Optimized modulus using a combination of divide and shifted multiply with masking of low bits
#4363: Optimized modulus using arithmetic of mixed integer sizes
#4364: Optimized division and modulus are not simplified on armv7
#4365: Indirect sign extension through variable for dividend in optimized divide
#4366: Unsigned shift of signed value during optimized signed divide that is only valid because of additional multiplication
#4367: Use of partially written variable during optimized divide

Originally posted by @D0ntPanic in #2043 (comment)

[0xdevalias]

From Slack (Ref):

RE: the fast division stuff in this binary that I was referring to earlier, I haven’t found where it was yet, but searching my history, the following links came up for it.

Which I believe I stumbled upon by searching for one of the ‘magic numbers’ I saw in the binary. So if I can’t find where I made the comments, I will try brute force searching my binary for the magic constants till I find it :p

• https://lemire.me/blog/2020/02/26/fast-divisionless-computation-of-binomial-coefficients/
• https://github.com/lemire/Code-used-on-Daniel-Lemire-s-blog/tree/master/2020/02/26
• https://github.com/dmikushin/binom
• https://github.com/bmkessler/fastdiv
• https://github.com/jmtilli/fastdiv

Ooo.. chrome history search ‘by group’ is even more useful!

Ok, so the comment I left on it was:

0xf83e0f83e0f83e1 relates to ‘Fast divisionless computation of binomial coefficients’: https://github.com/lemire/Code-used-on-Daniel-Lemire-s-blog/blob/master/2020/02/26/binom.c#L49

And this is what it looks like in the decompilation:

[vikke1234]

Could some plugin to hide the debugger be added? For example using scyllahide (https://github.com/x64dbg/ScyllaHide).

[xusheng6]

We have no interest to develop such as thing as a first-party plugin for this purpose because it will be too much work. My plan is to integrate ScyllaHide as a plugin: Vector35/debugger#420, though I have not had the time to get to it

Also, you could try TTD since normal anti-debugging techniques do not work with it: https://dev-docs.binary.ninja/guide/debugger/dbgeng-ttd.html

[vikke1234]

We have no interest to develop such as thing as a first-party plugin for this purpose because it will be too much work. My plan is to integrate ScyllaHide as a plugin: Vector35/debugger#420, though I have not had the time to get to it

Oh I see, yeah making a scyllahide plugin seems very doable.

Also, you could try TTD since normal anti-debugging techniques do not work with it: https://dev-docs.binary.ninja/guide/debugger/dbgeng-ttd.html

Unfortunately, BN TTD doesn't seem to support attaching(?), the program I'm trying to debug creates a subprocess which is the "real" target. So I'm not sure it works here.

[psifertex]

Added to the list above.