Malware analysis tools

Amoco v2.6 releases: tool for analysing binaries

Amoco

Amoco is a python package dedicated to the (static) analysis of binaries.

It features:

  • a generic framework for decoding instructions developed to reduce the time needed to implement support for new architectures. For example, the decoder for most IA32 instructions (general purpose) fits in less than 800 lines of Python. The full SPARCv8 RISC decoder (or the ARM THUMB-1 set as well) fits in less than 350 lines. The ARMv8 instruction set decoder is less than 650 lines.
  • symbolic algebra module which allows to describe the semantics of every instruction and compute a functional representation of instruction blocks.
  • a generic execution model which provides an abstract memory model to deal with concrete or symbolic values transparently and other system-dependent features.
  • various classes implementing usual disassembly techniques like the linear sweep, recursive traversal, or more elaborated techniques like path-predicate which relies on SAT/SMT solvers to proceed with discovering the control flow graph or even to implement techniques like DARE (Directed Automated Random Exploration).
  • various generic “helpers” and arch-dependent pretty-printers to allow custom look-and-feel configurations (think AT&T vs. Intel syntax, absolute vs. relative offsets, decimal or hex immediate, etc).
  • a persistent database facility that allows comparing discovered graphs with another previously analysed piece of codes.
  • a graphical user interface that can either be run as a standalone client or as an IDA plugin.

Changelog v2.6

Squashed commit of the develop branch:
* add V850(E2S) architecture
* add SH2-A architecture
* add support for analysing i.MX6 HAB structures
* merge AVR architecture
* add system/structs classes
* export ‘crawl’ out of amoco tree (libclang C-to-structs)
* add eBPF instructions semantics
* add support for (old)BPF instructions specs
* add support for HEX/SREC binary format
* add MemoryMap ‘merge’ method
* add ‘step_instruction’ method in CoreExec (emulator)
* add support for UFS structures
* merge signals dispatcher for ui
* improve setuptools support
* remove tox and rely on travis only
* improve armv7 instructions semantics and code helpers
* improve armv7 instructions specs and formats
* add spec tree debug level logging
* fix decoder for archs with bigendian variable length instruction
* improve decoder efficency with indicator of extended fetcher
* add pygments support for sparc, msp430 instruction formatter
* improve expressions widening
* improve config module

Install

git clone https://github.com/bdcht/amoco.git
cd amoco
python setup.py install

Use

Copyright (C) 2014 bdcht

Source: https://github.com/bdcht/

Anastasis Vasileiadis

PC Technical || Penetration Tester || Ethical Hacker || Cyber Security Expert || Cyber Security Analyst || Information Security Researcher || Malware analyst || Malware Investigator || Reverse Engineering

Leave a Reply