Hello World

.gitignore

@@ -0,0 +1 @@
+*.pyc

LICENSE

@@ -0,0 +1,7 @@
+Copyright (c) <year> <copyright holders>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,19 @@
+# Colorize (v0.1.0)
+Author: **Wilson Wong**
+_Highlight interesting instructions like function calls, non-zero XORs, anti-VM, anti-debug, and push/ret combinations._
+## Description:
+Highlight interesting instructions like function calls, non-zero XORs, anti-VM, anti-debug, and push/ret combinations.
+
+See the [blog post](https://practicalmalwareanalysis.com/2012/03/25/decorating-your-disassembly/) that inspired this plugin for more information.
+## Minimum Version
+
+This plugin requires the following minimum version of Binary Ninja:
+
+ * dev - 1.0.dev-576
+ * release - 9999
+
+
+
+## License
+This plugin is released under a [MIT](LICENSE) license.
+

__init__.py

@@ -0,0 +1,5 @@
+from binaryninja import *
+from color import run_plugin_globally, run_plugin_on_function
+
+PluginCommand.register_for_function("Colorize Suspicious Instructions in Function", "Highlight suspicious instructions. Based on setColorsSiko.py from the Practical Malware Analysis blog.", run_plugin_on_function)
+PluginCommand.register("Colorize All Suspicious Instructions", "Highlight suspicious instructions. Based on setColorsSiko.py from the Practical Malware Analysis blog. Runs at start-up on all known functions.", run_plugin_globally)

color.py

@@ -0,0 +1,92 @@
+from binaryninja import *
+
+HL_ANTI_DEBUG  = highlight.HighlightColor(red=0xff, green=0xff, blue=0x00)
+HL_ANTI_VM     = highlight.HighlightColor(red=0x00, green=0x00, blue=0xff)
+HL_CALL        = highlight.HighlightColor(red=0xc7, green=0xfd, blue=0xff)
+HL_PUSH_RET    = highlight.HighlightColor(red=0xff, green=0x00, blue=0xff)
+HL_XOR         = highlight.HighlightColor(red=0x00, green=0xa5, blue=0xff)
+
+ANTI_VM_INSTRUCTIONS = set(['sidt', 'sgdt', 'sldt', 'smsw', 'str', 'in',
+                            'cpuid', 'rdtsc', 'icebp'])
+
+def run_plugin_globally(bv):
+    call_hits = []
+    xor_hits = []
+    antidebug_hits = []
+    antivm_hits = []
+    pushret_hits = []
+    for function in bv.functions:
+        call_hits += colorize_calls(bv, function)
+        xor_hits += colorize_xor(bv, function)
+        antidebug_hits += colorize_antidebug(bv, function)
+        antivm_hits += colorize_antivm(bv, function)
+        pushret_hits += colorize_push_ret(bv, function)
+    print_results(call_hits, xor_hits, antidebug_hits, antivm_hits,pushret_hits)
+
+def run_plugin_on_function(bv, function):
+    call_hits = colorize_calls(bv, function)
+    xor_hits = colorize_xor(bv, function)
+    antidebug_hits = colorize_antidebug(bv, function)
+    antivm_hits = colorize_antivm(bv, function)
+    pushret_hits = colorize_push_ret(bv, function)
+    print_results(call_hits, xor_hits, antidebug_hits, antivm_hits,pushret_hits)
+
+def print_results(call_hits, xor_hits, antidebug_hits, antivm_hits, pushret_hits):
+    print("Number of calls: %d" % len(call_hits))
+    print("Number of xor: %d" % len(xor_hits))
+    print("Number of push-ret: %d" % len(pushret_hits))
+
+    print("Number of potential Anti-VM instructions: %d" % len(antivm_hits))
+    for addr in antivm_hits:
+        print("Anti-VM potential at 0x%x" % addr)
+
+    print("Number of potential Anti-Debug instructions: %d" % len(antidebug_hits))
+    for addr in antidebug_hits:
+        print("Anti-Debug potential at 0x%x" % addr)
+
+def colorize_calls(bv, function):
+    hits = []
+    for block in function.llil:
+        for op in block:
+            if op.operation.name == 'LLIL_CALL':
+                hits.append(op.address)
+                function.set_auto_instr_highlight(op.address, HL_CALL)
+    return hits
+
+def colorize_xor(bv, function):
+    hits = []
+    for block in function.llil:
+        for op in block:
+            if op.operation.name == 'LLIL_SET_REG' \
+            and isinstance(op.operands[1], lowlevelil.LowLevelILInstruction) \
+            and op.operands[1].operation.name == 'LLIL_XOR':
+                hits.append(op.address)
+                function.set_auto_instr_highlight(op.address, HL_XOR)
+    return hits
+
+def colorize_push_ret(bv, function):
+    hits = []
+    prev_op = None
+    for block in function.llil:
+        for op in block:
+            if op.operation.name == 'LLIL_RET' and prev_op == 'LLIL_PUSH':
+                hits.append(op.address)
+                function.set_auto_instr_highlight(op.address, HL_PUSH_RET)
+            prev_op = op.operation.name
+    return hits
+
+def colorize_antivm(bv, function):
+    hits = []
+    for instr, addr in function.instructions:
+        if  instr[0].text in ANTI_VM_INSTRUCTIONS:
+            hits.append(addr)
+            function.set_auto_instr_highlight(addr, HL_ANTI_VM)
+    return hits
+
+def colorize_antidebug(bv, function):
+    hits = []
+    for instr, addr in function.instructions:
+        if  instr[0].text == 'int3' or instr[0].text == 'int' and instr[2].text == '0x2d':
+            hits.append(addr)
+            function.set_auto_instr_highlight(addr, HL_ANTI_DEBUG)
+    return hits

generate_readme.py

@@ -0,0 +1,73 @@
+''' Python script to generate a stub README.md files from a plugin.json file '''
+import json
+import argparse
+import os
+import sys
+import io
+
+parser = argparse.ArgumentParser(description = 'Generate README.md (and optional LICENSE) from plugin.json metadata')
+parser.add_argument('filename', type = argparse.FileType('r'), help = 'path to the plugin.json file')
+parser.add_argument("-f", "--force", help = 'will automatically overwrite existing files', action='store_true')
+
+args = parser.parse_args()
+
+plugin = json.load(args.filename)['plugin']
+
+outputfile = os.path.join(os.path.dirname(args.filename.name), 'README.md')
+licensefile = os.path.join(os.path.dirname(args.filename.name), 'LICENSE')
+
+if not args.force and (os.path.isfile(outputfile) or os.path.isfile(licensefile)):
+	print("Cowardly refusing to overwrite an existing license or readme.")
+	sys.exit(0)
+
+if 'license' in plugin and 'name' in plugin['license'] and 'text' in plugin['license']:
+	name = plugin['license']['name']
+	text = plugin['license']['text']
+	license = u'''## License
+This plugin is released under a [{name}](LICENSE) license.
+'''.format(name=plugin['license']['name'])
+	print("Creating {licensefile}".format(licensefile=licensefile))
+	io.open(licensefile,'w',encoding='utf8').write(plugin['license']['text'])
+
+elif ('license' in plugin and 'name' in plugin['license']):
+	name = plugin['license']['name']
+	license = u'''## License
+	This plugin is released under a {name}] license.
+'''.format(name=plugin['license']['name'])
+else:
+	license = ''
+
+if 'minimumBinaryNinjaVersion' in plugin:
+	minimum = '## Minimum Version\n\nThis plugin requires the following minimum version of Binary Ninja:\n\n'
+	for chan in plugin['minimumBinaryNinjaVersion']:
+		version = plugin['minimumBinaryNinjaVersion'][chan]
+		minimum += u" * {chan} - {version}\n".format(chan = chan, version = version)
+	minimum += '\n'
+else:
+	minimum = ''
+
+if 'dependencies' in plugin:
+	dependencies = u'## Required Dependencies\n\nThe following dependencies are required for this plugin:\n\n'
+	for dependency in plugin['dependencies']:
+		dependencylist = u', '.join(plugin['dependencies'][dependency])
+		dependencies += u" * {dependency} - {dependencylist}\n".format(dependency = dependency, dependencylist = dependencylist)
+	dependencies += '\n'
+else:
+	dependencies = ''
+
+template = u'''# {PluginName} (v{version})
+Author: **{author}**
+_{description}_
+## Description:
+{longdescription}
+{minimum}
+{dependencies}
+{license}
+'''.format(PluginName = plugin['name'], version = plugin['version'],
+		   author = plugin['author'], description = plugin['description'],
+		   longdescription = plugin['longdescription'], license = license,
+		   dependencies = dependencies, minimum = minimum)
+
+print("Writing {outputfile}".format(outputfile=outputfile))
+io.open(outputfile, 'w', encoding='utf8').write(template)
+

plugin.json

@@ -0,0 +1,19 @@
+{
+	"plugin": {
+		"name": "Colorize",
+		"type": ["ui"],
+		"api": "python2",
+		"description": "Highlight interesting instructions like function calls, non-zero XORs, anti-VM, anti-debug, and push/ret combinations.",
+		"longdescription": "Highlight interesting instructions like function calls, non-zero XORs, anti-VM, anti-debug, and push/ret combinations.\n\nSee the [blog post](https://practicalmalwareanalysis.com/2012/03/25/decorating-your-disassembly/) that inspired this plugin for more information.",
+		"license": {
+			"name": "MIT",
+			"text": "Copyright (c) <year> <copyright holders>\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the \"Software\"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE."
+		},
+		"version": "0.1.0",
+		"author": "Wilson Wong",
+		"minimumBinaryNinjaVersion": {
+			"dev": "1.0.dev-576",
+			"release": "9999"
+		}
+	}
+}