[Feature]: Python Bindings

[agski331]

Problem Description

Hey Johann! This project is very cool.

I've been building something similar myself: a .NET library for parsing, emulating, deobfuscating, and patching files (aimed at malware analysis), written in Cython. It works well enough for my use cases, but it doesn't scale - the control-flow deobfuscation especially gets slow and memory hungry, and the codebase has grown pretty far from a pile of analysis scripts into something messier than I'd like as I continued to add features.
I was actually planning to rewrite it in Rust this week to clean things up, then found this repo, with similar goals, and already further along than what I'd have ended up with.
I wanted to ask if you would have any interest in adding py03 Python bindings to this project down the line? I think it would be really helpful for scripting and other things. I would be happy to contribute them myself. I would also be happy to help out with other things as well - I have a lot of experience with dotnet at this point and maybe some of the concepts from the work I have can be of use here.

Let me know your thoughts - thank you!

Proposed Solution

I would like to be able to use dotscope in Python, potentially through use of py03 bindings.
I dont really have any specific details on its implementation, as that would need a bit more thought into how it could be done with a clean, easy to use API. I included an example below of how the CilObject part could look, but its definitely something that requires thought.

Alternative Solutions

No response

Feature Category

API Enhancement

Estimated Complexity

High (Major feature addition)

Use Case

It would be very useful for automated analysis pipelines, scripting, unpacking and deobfuscation.

Example Usage

For example, to access the CilObject there could be a api:
dotscope.open_file(filepath: str)
dotscope.open_from_bytes(data: bytes)

The goal would be to expose all of the functionalities that are useful for analysis deobfuscation, patching and parsing as python functions and classes.  Care would need to be taken to minimize conversions between Rust and Python types.

Priority

Medium (Would be helpful)

Additional Context

No response

Checklist

• I have searched existing issues to make sure this feature hasn't been requested already
• I have provided a clear description of the problem and proposed solution
• I understand this is a feature request and not a bug report

[BinFlip]

Thank you! I'm happy to hear other people find it useful as well.

I've thought about bindings a bit at the beginning, but so far was more focused on building out the general functionality of the crate. I do think I've more or less reached a point where most of the functionality is present, and future expansions will most likely be focusing on performance, correctness, usability or improvements for specific obfuscators and less about 'fundamental' features. So this seems to be a good time to look at bindings for other languages without having to be concerned about significant API churn between versions.

Python via pyO3 sounds like a perfect start for this. I have not used it myself, but just briefly looked into it in the past and I do think it would be a good choice. If you'd be willing to work on this, I would absolutely welcome that (or any other) contribution to the project!

Generally I think starting with the 'big' objects like CilObject, CilProject, CilAssembly etc would be the way to go as they have a 'limited' API exposure and probably are a bit more straight forward than e.g. offering support for python optimization passes that the deobfuscation engine could load. I also would like to add, that the API as it is right now, is what seemed ergonomic to me and my specific use cases and I'm more than happy to improve on that where necessary.

[agski331]

Glad you like the idea! I will take a look at proposing an implementation soon - I have a few more executables id like to test dotscope with first, then I will see if I can propose some additions for Py03 bindings.

I think your idea to start with bigger objects is absolutely the way to go with this, and I would likely start with those objects first. Will keep you updated.

Thank you!