Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Broken IDA export script? #217

Open
Hamid-K opened this issue Aug 19, 2021 · 2 comments
Open

Broken IDA export script? #217

Hamid-K opened this issue Aug 19, 2021 · 2 comments

Comments

@Hamid-K
Copy link

Hamid-K commented Aug 19, 2021

Hi,
It seems that the cwe_checker_to_ida.py script fails to properly generate output for IDA, when a valid JSON input file is supplied to the script. I have tested both latest and stable releases.

The result is the same regardless of provided json input, generated from different binaries.
Ghidra v10.0 is installed on the system running the script. The json file loads fine in Ghidra and the plugin correctly highlights the findings, so it is not in a corrupt state.

Am I missing something?

This seems to be similar to a previously fixed and closed issue:
#34

image

@Enkelmann
Copy link
Contributor

Unfortunately, the IDA export script is just broken at the moment. Currently I do not have access to a version of IDA Pro to test any fixes due to working from home. And the free version of IDA does not support python scripting. So it may take some weeks until I can start working on fixing the script myself.

In the meantime any help in fixing the script would be greatly appreciated! Below is a list of problems with the current script (at least those that I am aware of):

  • The json format used by the cwe_checker changed in the latest stable release. The IDA script still assumes the old format and thus ends up missing all CWE warnings.
  • The list of CWEs in the IDA script is not up-to-date anymore.
  • The addresses as reported by the cwe_checker use the same base offset as Ghidra uses when disassembling. This offset is likely different to the one IDA Pro uses. There is no function implemented to compute the difference in base offsets between Ghidra and IDA Pro.

@Enkelmann
Copy link
Contributor

A short update on this: Most of the issues were fixed in PRs #279 and #281. It may still take some time until I can properly test everything to see whether some unfixed issues remain. I will leave the issue open until then.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants