REVEN API Cookbook

Welcome to the REVEN API Cookbook.

This book is a collection of examples that demonstrate good practices to accomplish common tasks using the REVEN API.

Pre-requisites

This book assumes that you already read the Python API quick start guide.

Furthermore, all the examples of this book assume that you are in an environment where you can import reven2 successfully.
If this is not the case, please refer to the installation documentation of the Python API before starting this guide.

64-bit examples

This book assumes that you are analyzing scenarios in a 64-bit context. If analyzing a scenario in a 32-bit context, then you should read from the 32-bit variants of registers or using 32-bit addresses.

So, if an example use regs.rax, the register should be replaced by regs.eax, like the following example:
ctx.read(regs.rax, U64) # 64-bit
ctx.read(regs.eax, U32) # 32-bit

Common abbreviations and variable names

REVEN scripts tend to re-use the same abbreviations and variable names for common objects.

Abbreviation	Description
`server`	A `reven2.RevenServer` instance representing a connection to a REVEN server
`pm`	A `reven2.preview.project_manager.ProjectManager` instance representing a connection to the Project Manager
`trace`	A `reven2.trace.Trace` instance, usually obtained from `server.trace`
`tr`	A `reven2.trace.Transition` instance, usually obtained from `trace.transition(tr_id)`
`ctx`	A `reven2.trace.Context` instance, usually obtained from e.g. `trace.context_before(tr_id)`