34 ms·

It might be interesting to tie this into something I had a daydream about once and then never bothered to actually do: generate header files from debug info (an

by mhh__ 2y ago

It might be interesting to tie this into something I had a daydream about once and then never bothered to actually do: generate header files from debug info (and then possibly have some LLM tidy it up)

jchw 2y ago
Actually there are a few attempts at this! Here's one for Microsoft Program Database: https://github.com/wbenny/pdbex https://github.com/wbenny/pdbex As for using an LLM to tidy it up... It doesn't seem like there has been a ton of success applying LLM models to reverse engineering yet... A part of me is wondering if this will wind up being a place where the LLM architecture proves insufficient. I'm not an expert but if I had to place a bet I'd bet on diffusion models being more interesting for a lot of reverse engineering use cases. That said, it's not really the same thing, but with Binary Ninja they have a feature called Sidekick that uses an LLM to try to clean up the disassembly; I'm kind of unimpressed but maybe it is useful to somebody.
- dvdkon 2y ago
  I'll add my attempt here: https://gitlab.com/dvdkon/pdb2hpp https://gitlab.com/dvdkon/pdb2hpp Its output is kind of ugly, limited by limitations of either the PDB format or Microsoft's terrible parser library, but I've successfully used it for calling functions from a proprietary DLL.
- mhh__ 2y ago
  The idea is more that you use the LLM for quick guesses about behaviour/names and so on rather than actually relying on it for reverse engineering as per se.
boricj 2y ago
Tangentially, I've considered generating debugging symbols for the exported object files, based on the contents of the Ghidra database, in order to improve the debugging experience when using them. I haven't implemented that feature yet because so far I've managed to get by without it. Also, it sounds like a rather deep rabbit hole to fall into and the one I'm currently inside of is big enough as it is.
chc4 2y ago
pahole gives you compilable C header files from ELF DWARF information. LLMs seems irrelevant here: either your header files have all the types exported from the executable correctly so they are usable with the original values, or they aren't correct/complete and having an LLM make up some more doesn't help. Ghidra also has native functionality to export its data structures, which it can create from DWARF structures (Right click -> Export to C header).
debatem1 2y ago
I wrote a tool a few years ago which automatically generated and inserted type-aware fuzzers for C APIs from DWARF info: https://github.com/intel/fffc https://github.com/intel/fffc Generating headers and also mutators that you could then modify to meet type constraints was part of that. Edit: just to add onto the LLM side, I can see this labelling anonymous structs or similar but I'm not sure that's a good idea. What might be interesting would be to try to get an LLM to verbalize/summarize known type constraints for documentation purposes.

by mhh__ 2y ago

jchw 2y ago

Actually there are a few attempts at this! Here's one for Microsoft Program Database: https://github.com/wbenny/pdbex https://github.com/wbenny/pdbex As for using an LLM to tidy it up... It doesn't seem like there has been a ton of success applying LLM models to reverse engineering yet... A part of me is wondering if this will wind up being a place where the LLM architecture proves insufficient. I'm not an expert but if I had to place a bet I'd bet on diffusion models being more interesting for a lot of reverse engineering use cases. That said, it's not really the same thing, but with Binary Ninja they have a feature called Sidekick that uses an LLM to try to clean up the disassembly; I'm kind of unimpressed but maybe it is useful to somebody.

dvdkon 2y ago
I'll add my attempt here: https://gitlab.com/dvdkon/pdb2hpp https://gitlab.com/dvdkon/pdb2hpp Its output is kind of ugly, limited by limitations of either the PDB format or Microsoft's terrible parser library, but I've successfully used it for calling functions from a proprietary DLL.
mhh__ 2y ago
The idea is more that you use the LLM for quick guesses about behaviour/names and so on rather than actually relying on it for reverse engineering as per se.

boricj 2y ago

Tangentially, I've considered generating debugging symbols for the exported object files, based on the contents of the Ghidra database, in order to improve the debugging experience when using them. I haven't implemented that feature yet because so far I've managed to get by without it. Also, it sounds like a rather deep rabbit hole to fall into and the one I'm currently inside of is big enough as it is.

chc4 2y ago

pahole gives you compilable C header files from ELF DWARF information. LLMs seems irrelevant here: either your header files have all the types exported from the executable correctly so they are usable with the original values, or they aren't correct/complete and having an LLM make up some more doesn't help. Ghidra also has native functionality to export its data structures, which it can create from DWARF structures (Right click -> Export to C header).

debatem1 2y ago

I wrote a tool a few years ago which automatically generated and inserted type-aware fuzzers for C APIs from DWARF info: https://github.com/intel/fffc https://github.com/intel/fffc Generating headers and also mutators that you could then modify to meet type constraints was part of that. Edit: just to add onto the LLM side, I can see this labelling anonymous structs or similar but I'm not sure that's a good idea. What might be interesting would be to try to get an LLM to verbalize/summarize known type constraints for documentation purposes.