This video is based on my 2016 article on cerbero-blog.com.
… or what happens when two multi-headed monsters meet. 🙂
I just released version 3.2 of Cerbero Suite which contains the anticipated proof-of-concept native interface for Ghidra. To install the necessary extension in Ghidra, open the “util” directory and extract the contents of ghidra.zip. You’ll find a PDF document with the setup instructions.
The interface works on Windows, Linux and OS X. How does it work you might wonder? It works via IPC, specifically via sockets. When I first came up with the idea I was curious about two things: to test the SDK of Cerbero against a new challenge and to see if the responsiveness of the UI would be good enough.
Regarding the responsiveness, I didn’t have an answer to that until I had a working disassembly view. I think it’s very responsive. In fact, I developed and tested the UI on different machines than the one running Ghidra and even in that scenario the UI was fast. 🙂
The PoC comes with the most fundamental views as you can see from the screen-shot. Navigation is complete, comments and bookmarks. Renaming is partially done, unfortunately renaming of variables is not yet supported. That was a feature which I wanted to have even in the PoC, but at a certain point I couldn’t delay any further the release.
Be aware that this is a PoC, I didn’t do extensive testing and there are some very important features which are still missing. Just to name a few: automatic refresh of the disassembly during analysis is missing, manual defining of code/data is missing, so is the capability to filter and sort table items.
Although things are missing, I tried to polish the UI enough to make it useful for some actual work and for a real evaluation on the user side. I didn’t experience any crash and in the worst case scenario you can just close the UI process and spawn a new one. In fact, you can even open multiple UI instances for the same file, it’s not an issue.
The whole project (research/C++ UI/Java extension) represents one month of work on my side. So I feel pretty confident that I can make the integration very smooth in a matter of a few months. The reason why I released this as a PoC is that before investing more time into it, I want to see if there’s actual interest for it from the community. The PoC itself was a nice project for myself, but now it’s up to you to decide if you want to make it mature into a real project.
Cerbero, as you know, is a commercial application, but it can be freely downloaded and used as a trial without any limitation. So trying it out shouldn’t be an issue.
Happy hacking! 🙂
Since I don’t have time to write many articles, this is my first video tutorial. 🙂 This video is based on my 2016 article on cerbero-blog.com.
If you like it and want to see more, let me know!
Edit: since I was asked to share the comments in the disassembly, here’s a small snippet to add them. You can run the snippet by pressing Ctrl+Alt+R (make sure that the disassembly view is focused when running it).
from Pro.UI import proContext
from Pro.Carbon import caComment
comments = (
(0x000000A2, "loop resolving the following APIs:\n LoadLibraryA\n WinExec\n TerminateThread\n GetTempPathA\n VirtualProtect"),
(0x000000C5, "calls VirtualProtect with stolen bytes"),
(0x000000CC, "pushes URLMON string to stack"),
(0x000000D2, "calls a gadget which calls LoadLibraryA and returns the URLMON base address"),
(0x000000D9, "resolves URLDownloadToFileA"),
(0x000000FB, "pushes \"regsvr32 -s \" to the stack"),
(0x00000109, "call GetTempFilePathA"),
(0x00000121, "appends \"wpbt0.dll\" to the path"),
(0x00000139, "calls URLDownloadToFileA with the created path with the URL:\n http://126.96.36.199/data/Home/w.php?f=16&e=4"),
(0x00000143, "calls WinExec on the downloaded file"),
(0x0000014C, "calls WinExec on \"regsvr32 -s \" followed by the downloaded file"),
(0x00000166, "calls TerminateThread"),
v = proContext().getCurrentView()
ca = v.getCarbon()
db = ca.getDB()
comment = caComment()
for c in comments:
comment.address = c
comment.text = c
# update the view