BinaryAnalysisPlatform/qira
Qira
Qira ist eine Plattform für Binäranalyse und Execution-Tracing, die jede Instruktion und jeden Datenzugriff während der Programmausführung für interaktive Wiedergabe und Debugging aufzeichnet. Es fungiert als Laufzeitanalyseumgebung, die QEMU verwendet, um die Ausführung zu verfolgen und Speicher- sowie Registerzustände zu inspizieren.
Das System bietet ein Tool zur statischen Binäranalyse, das die Programmstruktur abbildet und Instruktionen basierend auf erfassten Laufzeitdaten annotiert. Es enthält einen Laufzeit-Speicheranalysator zur Überwachung von Lese- und Schreibvorgängen an spezifischen Adressen sowie einen interaktiven Debugger zur Navigation durch Ausführungs-Timelines.
Die Plattform deckt Workflows zur Visualisierung von Binär-Traces und zum Reverse Engineering ab, einschließlich Memory-State-Snapshotting und instruktionsebenem Event-Logging. Zudem unterstützt sie die Analyse von Datenzugriffen und die Pflege einer adressbasierten Annotationsdatenbank zur Dokumentation von Binärcode.
Features
- Binary Execution Tracing - Records every instruction and data access during program execution to analyze runtime behavior via interactive playback.
- Binary and Reverse Engineering - Supports annotating binary code and mapping program structure through combined static and runtime analysis.
- Execution - Captures register and memory values at specific execution points to enable inspection via hex editors.
- Binary Debuggers - Navigates execution timelines and inspects runtime memory through an integrated hex editor.
- Binary Execution Analysis - Records and plays back program instructions to identify logic errors and runtime behavior using QEMU.
- Runtime Memory Analyzers - Provides a memory tracking tool to monitor reads and writes to specific addresses within a binary execution trace.
- CPU Instruction Logs - Records a sequential stream of CPU state changes to enable stepping forward and backward through execution.
- QEMU-Based Binary Analysis Environments - Provides a runtime analysis environment that uses QEMU to trace execution and inspect memory and register states.
- QEMU Execution Tracing - Captures every instruction and memory access by hooking into a QEMU virtual machine's runtime execution loop.
- Static Binary Analysis - Maps program structure and annotates instructions based on captured runtime execution data.
- Data Access Tracing - Tracks reads and writes to specific memory addresses across execution traces to identify data modification points.
- Binary Execution Tracers - Records every instruction and data access during program execution for interactive playback and debugging.
- Runtime Memory Explorers - Tracks memory reads and writes to specific addresses and inspects register states during program execution.
- Processor State Inspection - Allows inspection of CPU register values and memory contents via a hex editor at specific execution points.
- Address-Mapped Annotation Databases - Stores user-defined labels and comments linked to specific binary memory addresses for persistent documentation.
- Code Annotations - Provides utilities for adding custom names and comments to specific binary addresses to document findings.
- Execution Flow Tracing - Builds a structural map of the program by analyzing the sequence of executed instructions and function calls.
- Runtime-Driven Structural Analysis - Maintains a database of addresses and tags derived from runtime traces to map overall program structure.
- Execution Trace Visualizers - Provides an interface for navigating program execution timelines and jumping between function boundaries.
- Interactive Timeline Visualizations - Indexes execution events to allow rapid jumping between specific instruction invocations and execution boundaries.
- Execution Trace Navigators - Ships a visual timeline interface for browsing program execution and jumping between instruction invocations.
- Exploitation Frameworks - Interactive runtime analyzer for binary analysis.
