mandiant / idawasm Goto Github PK

View Code? Open in Web Editor NEW

346.0 12.0 57.0 238 KB

IDA Pro loader and processor modules for WebAssembly

License: Apache License 2.0

Python 100.00%

fireeye-flare ida wasm ida-pro idapython

idawasm's Introduction

idawasm

These IDA Pro plugins add support for loading and disassembling WebAssembly modules.

Features:

control flow reconstruction and graph mode
code and data cross references
globals, function parameters, local variables, etc. can be renamed
auto-comment hint suport

recognizes WebAssembly modules

reconstructs control flow

parses and renders types

extracts code and data cross references

detect function frame layout (for LLVM-compiled binaries)

installation

There are three steps to install this loader and processor:

install the python module:

    python.exe setup.py install

manually install the WebAssembly file loader:

    mv loaders\wasm_loader.py %IDADIR%\loaders\wasm_loader.py

manually install the WebAssembly processor:

    mv procs\wasm_proc.py %IDADIR%\procs\wasm_proc.py

Whenever you update this project, you'll need to update the python module, but shouldn't have to touch the loader and processor files.

This plugin was developed against IDA 7.1, but probably works with IDA 7.0+.

acknowledgements

This project relies on the athre0z/wasm WebAssembly decoder and disassembler library for Python.

idawasm's People

Contributors

Stargazers

Watchers

idawasm's Issues

some error message and can't be displayed in graph mode.

What happened to idawasm/processor.py

error message

Possible file format: WebAssembly v1 executable (/Applications/IDA Pro 7.0/ida64.app/Contents/MacOS/loaders/wasm_loader.py)

  bytes   pages size description
--------- ----- ---- --------------------------------------------
   262144    32 8192 allocating memory for b-tree...
    65536     8 8192 allocating memory for virtual array...
   262144    32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
   589824            total memory allocated

Loading file '/Users/residuallaugh/Desktop/job/webassembly/quicksort/quicksort.wasm' into database...
Detected file format: WebAssembly v1 executable
Loading processor module /Applications/IDA Pro 7.0/ida64.app/Contents/MacOS/procs/wasm_proc.py for wasm...OK
Autoanalysis subsystem has been initialized.
  0. Creating a new segment  (0000000000000000-0000000000000008) ... ... OK
  1. Creating a new segment  (0000000000000008-0000000000000018) ... ... OK
  2. Creating a new segment  (0000000000000018-000000000000001D) ... ... OK
  3. Creating a new segment  (000000000000001D-0000000000000022) ... ... OK
  4. Creating a new segment  (0000000000000022-0000000000000041) ... ... OK
  5. Creating a new segment  (0000000000000041-00000000000000FA) ... ... OK
Flushing buffers, please wait...INFO:idawasm.processor:saving wasm processor state.
ok
File '/Users/residuallaugh/Desktop/job/webassembly/quicksort/quicksort.wasm' has been successfully loaded into the database.
INFO:idawasm.processor:new file: /Users/residuallaugh/Desktop/job/webassembly/quicksort/quicksort.wasm
INFO:idawasm.processor:parsing sections
INFO:idawasm.processor:parsing types
INFO:idawasm.processor:parsing globals
ERROR:idawasm.processor:exception in notify_newfile
Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 533, in notify_newfile
    self.load()
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 491, in load
    self.globals = self._parse_globals()
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 309, in _parse_globals
    global_section = self._get_section(wasm.wasmtypes.SEC_GLOBAL)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 155, in _get_section
    raise KeyError(section_id)
KeyError: 6
IDA is analysing the input file...
You may start to explore the input file right now.
------------------------------------------------------------------------------------------------------------
Python 2.7.10 (default, Aug 17 2018, 17:41:52) 
[GCC 4.2.1 Compatible Apple LLVM 10.0.0 (clang-1000.0.42)] 
IDAPython 64-bit v1.7.0 final (serial 0) (c) The IDAPython Team <[email protected]>
------------------------------------------------------------------------------------------------------------
The initial autoanalysis has been finished.

Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 900, in notify_out_operand
    f = self._get_function(ctx.insn.ea)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 861, in _get_function
    raise KeyError(ea)
KeyError: 237L
ERROR:idawasm.processor:exception in notify_out_operand
Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 900, in notify_out_operand
    f = self._get_function(ctx.insn.ea)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 861, in _get_function
    raise KeyError(ea)
KeyError: 242L
ERROR:idawasm.processor:exception in notify_out_operand
Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 933, in notify_out_operand
    f = self.functions[op.value]
KeyError: 1L
ERROR:idawasm.processor:exception in notify_out_operand
Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 900, in notify_out_operand
    f = self._get_function(ctx.insn.ea)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 861, in _get_function
    raise KeyError(ea)
KeyError: 242L
ERROR:idawasm.processor:exception in notify_out_operand
Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 933, in notify_out_operand
    f = self.functions[op.value]
KeyError: 1L
ERROR:idawasm.processor:exception in notify_out_operand
Traceback (most recent call last):
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 900, in notify_out_operand
    f = self._get_function(ctx.insn.ea)
  File "/Library/Python/2.7/site-packages/idawasm/processor.py", line 861, in _get_function
    raise KeyError(ea)
KeyError: 247L

update quickly

Hey...
I have a big problem with this plugin.
Can you repair it quickly?
Can you repair it quickly?
Can you repair it quickly?
Can you repair it quickly?
Can you repair it quickly?
Can you repair it quickly?
Can you repair it quickly?

ImportError: No module named idawasm.loader

E:\IDA_Pro_v7.0_Portable\loaders\wasm_loader.py: No module named idawasm.loader
Traceback (most recent call last):
  File "E:\IDA_Pro_v7.0_Portable\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
    execfile(script, g)
  File "E:/IDA_Pro_v7.0_Portable/loaders/wasm_loader.py", line 1, in <module>
    import idawasm.loader
ImportError: No module named idawasm.loader
E:\IDA_Pro_v7.0_Portable\loaders\wasm_loader.py: No module named idawasm.loader
Traceback (most recent call last):
  File "E:\IDA_Pro_v7.0_Portable\python\ida_idaapi.py", line 553, in IDAPython_ExecScript
    execfile(script, g)
  File "E:/IDA_Pro_v7.0_Portable/loaders/wasm_loader.py", line 1, in <module>
    import idawasm.loader
ImportError: No module named idawasm.loader

idawasm fails to decompile

idawasm dies with the following error message:

Possible file format: WebAssembly v1 executable (C:\Desktop Sync\ExeCrackers\Tools\IDA 7.0\loaders\wasm_loader.py)

  bytes   pages size description
--------- ----- ---- --------------------------------------------
   262144    32 8192 allocating memory for b-tree...
    65536     8 8192 allocating memory for virtual array...
   262144    32 8192 allocating memory for name pointers...
-----------------------------------------------------------------
   589824            total memory allocated

Loading file 'C:\Users\Undefined\Desktop\wasm-inno\build\index.wasm' into database...
Detected file format: WebAssembly v1 executable
Loading processor module C:\Desktop Sync\ExeCrackers\Tools\IDA 7.0\procs\wasm_proc.py for wasm...OK
Autoanalysis subsystem has been initialized.
  0. Creating a new segment  (00000000-00000008) ... ... OK
  1. Creating a new segment  (00000008-00000025) ... ... OK
  2. Creating a new segment  (00000025-000000A5) ... ... OK
  3. Creating a new segment  (000000A5-000000B9) ... ... OK
  4. Creating a new segment  (000000B9-000000C1) ... ... OK
DEBUG:idawasm.processor:missing global: 1
  5. Creating a new segment  (000000C1-000000CC) ... ... OK
  6. Creating a new segment  (000000CC-000000DA) ... ... OK
DEBUG:idawasm.processor:missing global: 0
  7. Creating a new segment  (000000DA-000009F4) ... ... OK
  8. Creating a new segment  (000009F4-00000A45) ... ... OK
Flushing buffers, please wait...INFO:idawasm.processor:saving wasm processor state.
ok
File 'C:\Users\Undefined\Desktop\wasm-inno\build\index.wasm' has been successfully loaded into the database.
INFO:idawasm.processor:new file: C:\Users\Undefined\Desktop\wasm-inno\build\index.wasm
INFO:idawasm.processor:parsing sections
INFO:idawasm.processor:parsing types
INFO:idawasm.processor:parsing globals
INFO:idawasm.processor:parsing functions
INFO:idawasm.processor:computing branch targets
ERROR:idawasm.processor:exception in notify_newfile
Traceback (most recent call last):
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 533, in notify_newfile
    self.load()
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 507, in load
    self.branch_targets = self._compute_branch_targets()
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 281, in _compute_branch_targets
    branch_targets.update(self._compute_function_branch_targets(pcode, body.code))
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 260, in _compute_function_branch_targets
    raise NotImplementedError('else')
NotImplementedError: else
IDA is analysing the input file...
You may start to explore the input file right now.
---------------------------------------------------------------------------------------
Python 2.7.15 (v2.7.15:ca079a3ea3, Apr 30 2018, 16:30:26) [MSC v.1500 64 bit (AMD64)] 
IDAPython v1.7.0 final (serial 0) (c) The IDAPython Team <[email protected]>
---------------------------------------------------------------------------------------
ERROR:idawasm.processor:exception in notify_ana
Traceback (most recent call last):
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 1181, in notify_ana
    insn.Op2.value = bc.imm.target_table
  File "C:\Desktop Sync\ExeCrackers\Tools\IDA 7.0\python\ida_ua.py", line 216, in __set_value__
    return _ida_ua.op_t___set_value__(self, *args)
TypeError: Expected an ea_t type
DEBUG:idawasm.processor:missing global: 1
ERROR:idawasm.processor:exception in notify_ana
Traceback (most recent call last):
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 58, in wrapper
    return f(*args, **kwargs)
  File "build\bdist.win-amd64\egg\idawasm\processor.py", line 1181, in notify_ana
    insn.Op2.value = bc.imm.target_table
  File "C:\Desktop Sync\ExeCrackers\Tools\IDA 7.0\python\ida_ua.py", line 216, in __set_value__
    return _ida_ua.op_t___set_value__(self, *args)
TypeError: Expected an ea_t type
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
DEBUG:idawasm.processor:missing global: 2
The initial autoanalysis has been finished.

Analyzed file was:
index.zip

IDA: Version 7.0.170914 Windows x64 (32-bit address size)

Is there any chance that sooner or later it gets supported? Not even a single hello world application can be decompiled which was using the latest compiler. :|

don't assume global sections exists (and other sections)

see #2 for motivation.