WIP: Implement a Binary Ninja plugin

binja_plugin/__init__.py

@@ -0,0 +1,47 @@
+from binaryninja import *
+
+from miasm.analysis.binary import Container
+from miasm.analysis.machine import Machine
+from miasm.core.asmblock import disasmEngine
+from miasm.core.interval import interval
+from miasm.core.locationdb import LocationDB
+from miasm.ir.ir import Lifter
+
+SUPPORTED_ARCHS = ["x86_64"]
+
+
+def deobfuscate_at_address(bv: BinaryView, address: int) -> None:
+    arch = str(bv.platform.arch)
+    if arch not in SUPPORTED_ARCHS:
+        return
+
+    # Sort sections by start address
+    sections = list(bv.sections.values())
+    sorted_section = sorted(sections, key=lambda s: s.start)
+
+    br = BinaryReader(bv)
+    last_section_address = bv.original_base
+    exe_data = bytearray()
+    for section in sorted_section:
+        # Pad with zeroes
+        padding_size = section.start - last_section_address
+        exe_data += b"\x00" * padding_size
+        exe_data += br.read(section.length, section.start)
+        last_section_address = section.start + section.length
+
+    loc_db = LocationDB()
+    machine = Machine(arch)
+    assert machine.dis_engine is not None
+
+    container = Container.from_string(exe_data, loc_db, addr=bv.original_base)
+    mdis = machine.dis_engine(container.bin_stream, loc_db=loc_db)
+    lifter = machine.lifter(loc_db)
+
+    asm_cfg = mdis.dis_multiblock(address)
+    print(asm_cfg)
+
+    # bv.update_analysis()
+
+
+PluginCommand.register_for_address("themida-unmutate", "Deobfuscate mutated code from this address",
+                                   deobfuscate_at_address)

plugin.json

@@ -0,0 +1,27 @@
+{
+  "pluginmetadataversion": 2,
+  "name": "themida-unmutate",
+  "type": ["binaryview"],
+  "api": ["python3"],
+  "description": "This is a short description meant to fit on one line.",
+  "longdescription": "",
+  "license": {
+    "name": "GPL-3.0-or-later",
+    "text": ""
+  },
+  "platforms": ["Darwin", "Linux", "Windows"],
+  "installinstructions": {
+    "Darwin": "",
+    "Linux": "",
+    "Windows": ""
+  },
+  "dependencies": {
+    "pip": [],
+    "apt": [],
+    "installers": [],
+    "other": []
+  },
+  "version": "0.1.0",
+  "author": "Erwan Grelet",
+  "minimumbinaryninjaversion": 3164
+}