GitPlanet

Cheap and reliable Node.js hosting starts at $3/month, and $1/month static HTML hosting

Created with love in Canada, visit hostnodejs.com today

Feel like to post an Ad? Learn Details
All Projects → anhvvcs → corana

anhvvcs / corana

Licence: MIT License
Corana is a Dynamic Symbolic Execution Engine for ARM Cortex-M aiming to incrementally reconstruct the precise Control Flow Graph (CFG) of IoT malware under the presence of obfuscation techniques e.g., indirect jumps and opaque predicates

Programming Languages

c
50402 projects - #5 most used programming language
C++
36643 projects - #6 most used programming language
java
68154 projects - #9 most used programming language
python
139335 projects - #7 most used programming language
C#
18002 projects
smalltalk
420 projects

Labels

malware-analysis

Projects that are alternatives of or similar to corana

stringsifter
A machine learning tool that ranks strings based on their relevance for malware analysis.
Stars: ✭ 567 (+2884.21%)
Mutual labels:  malware-analysis
malwinx
Just a normal flask web app to understand win32api with code snippets and references.
Stars: ✭ 76 (+300%)
Mutual labels:  malware-analysis
calamity
A script to assist in processing forensic RAM captures for malware triage
Stars: ✭ 24 (+26.32%)
Mutual labels:  malware-analysis
rtfraptor
Extract OLEv1 objects from RTF files by instrumenting Word
Stars: ✭ 50 (+163.16%)
Mutual labels:  malware-analysis
pftriage
Python tool and library to help analyze files during malware triage and analysis.
Stars: ✭ 77 (+305.26%)
Mutual labels:  malware-analysis
bazaar
Android security & privacy analysis for the masses
Stars: ✭ 191 (+905.26%)
Mutual labels:  malware-analysis
speakeasy
Windows kernel and user mode emulation.
Stars: ✭ 1,017 (+5252.63%)
Mutual labels:  malware-analysis
malice-av
Malice AntiVirus Plugins
Stars: ✭ 98 (+415.79%)
Mutual labels:  malware-analysis
xray
Hexrays decompiler plugin that colorizes and filters the decompiler's output based on regular expressions
Stars: ✭ 97 (+410.53%)
Mutual labels:  malware-analysis
csbd
The repository contains the python implementation of the Android Malware Detection paper: "Empirical assessment of machine learning-based malware detectors for Android: Measuring the Gap between In-the-Lab and In-the-Wild Validation Scenarios"
Stars: ✭ 20 (+5.26%)
Mutual labels:  malware-analysis
OLEPackagerFormat
OLE Package Format Documentation
Stars: ✭ 18 (-5.26%)
Mutual labels:  malware-analysis
malhunt
Hunt malware with Volatility
Stars: ✭ 30 (+57.89%)
Mutual labels:  malware-analysis
decrypticon
Java-layer Android Malware Simplifier
Stars: ✭ 17 (-10.53%)
Mutual labels:  malware-analysis
malware-writeups
Personal research and publication on malware families
Stars: ✭ 104 (+447.37%)
Mutual labels:  malware-analysis
HomebrewOverlay
Browser extension adware (showHomebrewOverlayOuter)
Stars: ✭ 52 (+173.68%)
Mutual labels:  malware-analysis
assemblyline client
Python client for Assemblyline 3 and 4 / Client python pour AssemblyLine 3 and 4
Stars: ✭ 19 (+0%)
Mutual labels:  malware-analysis
Malware-Detection-Tools
A list of awesome malware detection tools
Stars: ✭ 30 (+57.89%)
Mutual labels:  malware-analysis
python-icap-yara
An ICAP Server with yara scanner for URL and content.
Stars: ✭ 50 (+163.16%)
Mutual labels:  malware-analysis
MalwareDatabase
One of the few malware collection
Stars: ✭ 37 (+94.74%)
Mutual labels:  malware-analysis
mobileAudit
Django application that performs SAST and Malware Analysis for Android APKs
Stars: ✭ 140 (+636.84%)
Mutual labels:  malware-analysis
View All Similar Projects ➔

Corana

Corana is an on-going project providing a Dynamic Symbolic Execution tool for ARM Cortex-M. It takes an ARM binary file as the input and outputs its precise Control Flow Graph (CFG) under the presence of obfuscations like indirect jumps. Since it is currently a preliminary version and still being regularly improved, bugs may occur. The number of supported instruction is also limited.

Installation

Important note: This installation is for Linux/MacOS only. For Windows, please take a look at the detailed instruction of each individual component.

Java and File

Corana is written entirely in Java. Thus, make sure that you already installed Java (version 1.8+). In addition, Corana use file command to check the format of an input binary file. In fact, file is already installed by default in Linux/MacOS, but for Windows, please install it first.

Capstone Engine

Corana utilizes Capstone as a single-step disassembler engine. It is worth noting that, we use the older version cloned by TRANScurity instead of the latest one since the maven library used in Corana is not compatible with newer releases. Please follow the installation below:

Z3 Solver

Corana uses Z3 as a back-end SMT Solver to check the satisfiability of path constraints. Z3 can be installed either from source code or command line.

  • Using command line: sudo apt-get update -y; sudo apt-get install -y z3
  • From source code: Please clone Z3 repository https://github.com/Z3Prover/z3 (or using the Z3 repository included in /libs) and follow its instruction.

Build Corana

We provide a pre-built Corana as a .jar file. However, you can still re-build it by simply creating a new artifact from sources. After successfully building, make sure that corana.jar is successfully generated.

Execution

Corana inputs an ARM binary file and outputs its CFG. The CFG is represented as .dot file, thus you can arbitrarily further plot it in any graphic or data structure format as you want. Use this command to execute Corana:

 java -Xss16m -Xmx10240m -jar corana.jar -execute /path/to/input/file

where

  • -Xss: the maximum memory allocated for stack size. We recommend to set it around 16MB or larger.
  • -Xmx: the maximum memory allocated for the execution. We recommend to set it as much as possible since the dynamic symbolic execution consumes a lot of memory.
  • /path/to/input/file: the path to the ARM binary file for analyzing.

If you want to specify an ARM variation, please append the variation name (M0, M0_Plus, M3, M4, M7, M33) to the end of the command above. Otherwise, Corana runs with the general ARM configurations.

 java -Xss16m -Xmx10240m -jar corana.jar -execute /path/to/input/file M7

Contact

Anh V. Vu - Project maintainer - Email

License

This project is licensed under the MIT License.

Acknowledgments

We thank JAIST for financially supporting our project and thank Jan Willem Janssen for his useful library for effectively parsing ELF binary file: https://github.com/jawi/java-binutils

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].