The IDA Pro plug-in for Kam1n0 creates a folder ~/Kam1n0/ to store the plug-in data and errors.
This tutorial first introduces Kam1n0's basic functionalities and then goes through a simple index and search example.
The Kam1n0 engine with the plug-in provides the functionalities to index and search assembly functions.
| Icon | Functionality | Description | Hot key |
|---|---|---|---|
 |
Search current function | Search the function at current address | Ctrl+Shift+S |
 |
Select functions to search | Select functions to search | Ctrl+Shift+A |
 |
Index current function | Index the function at current address | Ctrl+Shift+K |
 |
Select functions to index | Select functions to index | Ctrl+Shift+J |
 |
Manage connections | Manage connections to different repositories | NA |
 |
Manage storage | Mange local/remote accounts and storage | NA |
 |
Fragment search (new) | Search with the selected assembly fragment | NA |
These functionalities can be found in the:
-
IDA Pro Search Toolbar:
-
IDA Pro Functions Window:
-
IDA Pro Search Menu:
-
IDA Pro Edit Menu:
-
IDA Pro View A (popup menu):
Even though you can select functions from the popup menu of the IDA Pro Functions Window to search/index functions, using and at other places (e.g. toolbar) opens a Selection Window which provides a more detailed configuration for multiple search. While using the plugin, we recommend to keep the Output Window open in IDA Pro.
For example, you can apply different filters and choose which connection you want to use to search/index them.
Let's go through a simple index and search case using the engine and plugin.
Suppose we have two binary files libpng-1.7.0b54.dll from libpng and zlib-1.2.7.dll from zlib. These two files are included in our release file Kam1n0_IDA_Pro_v0.0.2.zip. We suggest you to try them first as to be consistent with the following descriptions. You may index other binary files later as you wish. We try to index the first binary file libpng-1.7.0b54.dll and search the second one zlib-1.2.7.dll against it.
In this step, we need to create a repository and start the Kam1n0 engine. To create a repository using the Kam1n0 workbench, click the new button and pick a folder for this repository, select metapc.xml in the drop-down box as architecture, and assign a name to the repository . An example is given in the figure below:
Select the newly created repository in the upper table and click the start button to run the Kam1n0 engine. More details on creating repository and starting Kam1n0 engine can be found in our workbench tutorial. Your default browser should pop up a login page after a couple seconds. Close the browser since we are not using the web user interface at this moment. Details about the web interface can be found in our web UI tutorial.
Open IDA Pro and disassemble the libpng-1.7.0b54.dll binary file as usual. Click on the Manage Connection Button in the toolbar 
. You are now able to review and edit the connections of the plug-in. There is already a default connection for the local engine. These connections will be stored for future use.
To index the functions, click on the Select Functions to Index Button in the toolbar (or in the other aforementioned location). Check the Select All Functions Option and click the Index Button (shown as Steps 1, 2 and 3 in the image below). Each indexed binary is uniquely identified by its path, and each indexed function by its binary ID and starting address.
Wait until the indexing process finishes as shown in the Progress Form. Detailed progress information is printed in the IDA Pro Output Window. Press the OK Button to close the form when you see 100% shown.
Open IDA Pro and disassemble the target zlib-1.2.7.dll binary file as usual. Click on the Select Functions to Search Button in the toolbar 
. Suppose we want to search for the alder32 and compress2 functions. Select them using ctrl+click in the list. Click on the Search Button (shown as Step 1 and Step 2 in image below).
You will see a progress form during the search. The search should end in seconds, and it will pop up two windows: the Kam1n0 window and the Clone Tree window.
The Kam1n0 window contains a Clone Graph View. It can be dragged and zoomed in/out with mouse scrolling. Each circle represents a function. Each color represents different binary. A link between two nodes indicates their similarity. The two blue circles are our selected queries. By double-clicking on the alder32 node (blue node in the center), we open the Clone List window as shown below:
The window lists all the connected nodes with more details about their similarity and binary name. There are three views to inspect each result. We will discuss them in the next section.
Instead of showing the clone relationship in a force graph, the Clone Tree window shows it in a tree structure. It is much easier to browse the clones when the number of clone is large.
Similar to the Clone List window, each entry in the Clone Tree window has three different views. We use these views to compare clones. By clicking on any of them, a new window will be popped up with a different view.
The Flow View explores the cloned control flow graph structure between two functions. The cloned areas are highlighted in different convex hubs. As you can see in this example, even though two functions have different entry blocks, they share several cloned subgraphs. Each is highlighted using a convex hub with a different color. Currently, we ignore blocks with less than 4 instructions. Both graphs can be zoomed in/out and dragged. We provide a scroll (blue) for each of them.
The Text-Diff View tries to fully align two assembly functions using a basic string comparison algorithm. It is useful to compare two functions with a high degree of similarity. The lines with a red background mean deletion while the ones with a green background mean addition.
The Clones View lists different cloned subgraphs and compares their differences. The panel below the two text views lists the cloned subgraphs as cloned groups. Each group consists of pairs of cloned basic blocks between two functions. These basic blocks belong to the same group since they can be connected in the control flow. By clicking on each clone pair, the above two text views will jump to the corresponding basic blocks and compare their differences using string alignment.
In the Clone View, you are able to add rich comments to each assembly code instruction of each function. Move the mouse to the line for which you want to add a comment and click on the + button to show the Comment Form. Markdown language is supported.
Starting from version 1.x.x, we support assembly fragment search in IDA Pro. This is still an experimental feature at this moment. You can simply select a couple lines of assembly code and right click on it to pop out the menu. Select the entry Query fragment. You will see a pop up window in which you are able to edit the selected assembly code. Then click the search button.
After that, a search progress form will pop up and the search will finish in seconds. The same windows as we see for assembly function search are popped up once the search completes.
The plug-in is written inPpython using idaapi. The root of this repository is the Windows installer. The source code of the plug-in can be found here.
The user interface consists of two parts:
- The native
idaapiforms and controls: the Connection Management Form, the Search Progress Form, the Index Progress Form, the Select Function to Search Form, and the Select Function to Index Form. - The local webpages: the Clone Graph View, the Clone List View, the Text-Diff View, the Flow View, and the Clones View. These local webpages are rendered using the embeded Chromium shipped with cefpython, and the frame used to hold Chromium is wxpython. We tried cefpython with the build-in pyside of IDA Pro. Unfortunately, pages cannot be rendered, so we switch to wxpython.
We find it difficult to update the IDA Pro UI asynchronously using idaapi. If a thread other than the main thread updates the interface while the user interacts with (e.g. clicks on) the interface, IDA Pro will freeze/crash.
To interact with the Kam1n0 web services, we use the built-in urllib in Python to send requests and the json lib to parse the json results. After that, the json results are passed to javascripts using cefpython.