ida_name_binding_reven_to_ida.py

• Linux path to script:
  • Not shipped on Linux (IDA script)
• Windows path to script:
  • amd64: C:\Program Files (x86)\Reven-PythonAPI-amd64\python-examples\ida\ida_name_binding_reven_to_ida.py
  • x86: C:\Program Files (x86)\Reven-PythonAPI-x86\python-examples\ida\ida_name_binding_reven_to_ida.py

This is an example of IDA script using the REVEN Python API. Must be run from IDA!

See the script's documentation below for more information:

"""
Purpose:
    This script updates names in a IDA analyzed binary project using symbol names
    of the corresponding binary analyzed in REVEN.

Usage:
    Use IDA to load the binary, and customize the following arguments before
    executing the script:
        host = your REVEN server name, and
        port = your REVEN project on this host.

Remark:
    This script takes all "symbol names" of the corresponding binary in REVEN to bind
    locations of the analyzed binary in IDA. We should note that:
        - the name of the binary must be obtained from REVEN (that is usually the
          case if "dump process" is executed properly), and be case insentively
          identical with the one analyzed in IDA (i.e. we do not rename the binary)

        - if there is several binaries of the same name (but located at different
          paths), then the first one will be used for name binding only.
"""


import idaapi
import idautils
import idc

import reven


def main(host, port):
    project = reven.Project(host, port)
    name_binding = get_reven_name_binding(project)
    if name_binding is not None:
        update_binding(name_binding)
        print 'binding names from REVEN to IDA done.'
    else:
        print 'binary {:s} cannot found in the REVEN project'.format(os.path.basename(idc.GetInputFilePath()))


def get_reven_name_binding(reven_project):
    """
    Retrieve all known REVEN's symbols for current IDA's binary and return them as a map of {address: name}.
    If no matching binary is found in REVEN's binary list, return None
    """
    # Binary path is irrelevant, only the name matters.
    binary_basename = os.path.basename(idc.GetInputFilePath()).lower()
    name_binding = {}

    # `Project.binaries()` returns a map {path: binary_object}, see documentation for more details.
    for path, binary in reven_project.binaries().items():
        if os.path.basename(path) == binary_basename:
            name_binding = {symbol.rva: symbol.name for symbol in binary.symbols}
            break
    else:
        name_binding = None

    return name_binding


def update_binding(name_binding):
    base_addr = idaapi.get_imagebase()
    for offset in name_binding:
        print 'bind 0x{:x} as {:s}'.format(base_addr + offset, name_binding[offset])
        idaapi.set_name(base_addr + offset, name_binding[offset],
                        idaapi.SN_NOCHECK | idaapi.SN_NOWARN)


if __name__ == '__main__':
    host_port_str = idc.AskStr('localhost:13370', "REVEN's project address")
    if host_port_str is not None:
        try:
            host, port_str = host_port_str.split(':')
            port = int(port_str)
            print("REVEN's project: {}:{}").format(host, port)
            main(host, port)
        except ValueError:
            print("please give a correct REVEN\'s project address, e.g. localhost:13370")
        except RuntimeError as e:
            print('{}').format(e)
        except:
            print('unknown error')