Skip to content

A Python tool to unstrip Rust/Go binaries on Linux

License

Notifications You must be signed in to change notification settings

c3rb3ru5d3d53c/Cerberus

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

77 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Cerberus

Description

A Python tool to unstrip Rust and Go binaries on Linux

Cerberus is the tool you want to use to make Rust and Go static analysis a lot easier.
Based on hashing and scoring systems, it can retrieve lots of symbol names.

How does it work ?

After analyzing your ELF binary to find the used libraries, Cerberus will download and build them.
Then the tool will hash (in various ways) the functions in your file and in the libraries to make matches.

Table of contents

Build the tool
How to use ?
      Syntax
      Parameters
      Flags
      Example
Warning

  1. You need to have Python3, Cargo, Go and the binutils package installed on your system.
  2. Clone the repository.
  3. Install Python dependencies using pip3 install -r requirements.txt.
  4. Build the tool using ./build.sh.
  5. Add the generated dist directory to your path using PATH=$PATH:~/path/to/the/repo/dist.

cerberus binary [-param value] [--flag]

output -> Specifies the path for the resulting ELF file.
part_hash_len -> Specifies the length of a part hash. The part hash of a function is just a reduction of the function with a linear pace. This technique is used to prevent fixed addresses from corrupting a standard hash. Default value : 20
part_hash_trust -> Specifies minimum ratio of similarity between the two hashed functions to compare. The kept function will be the one with the most matches anyway. Increasing this value will reduce the number of matched functions but speed up execution time. Default value : 0.6
min_func_size -> The minimum length a function must be to get analyzed. Decreasing this value will increase matches but also false positives. Default value : 10

help -> Displays a help message.
debug -> Enable debug level of logging.
no-prompt -> Automatically skips user prompts

Command

The following command will try to unstrip the file ./rust_example into a new ELF called ./rust_example_syms.
cerberus ./rust_example -output ./rust_example_syms

Result

Here is a comparison of the main function in the two files using Binary Ninja :

before.png

after.png

This software must only be used to carry out lawful experiments and I am not responsible for any breach of this rule !

About

A Python tool to unstrip Rust/Go binaries on Linux

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 94.5%
  • Go 3.2%
  • Rust 1.6%
  • Shell 0.7%