binaryninja_plugins

This repository contains Binary Ninja plugins. Binary Ninja is a reverse engineering platform, more information: https://binary.ninja/

• PE Scanner
• MSDN documentation
• MSDN documentation (without QT)
• Colorize API usage
• Graph SVG export

PE Scanner

This plugin shows an additional QT GUI with additional information concerning the analysed PE.

List of information:

• PE information (hashes, compilaiton date, metadata...)
• IAT
• EAT
• Sections
• alert API (list of suspicious API)
• VirusTotal quota
• Yara rules support

The code is initially based on pescanner.py available there: https://github.com/hiddenillusion/AnalyzePE/blob/master/pescanner.py The code was tested on Windows platforms.

Requierements

• pefile
• magic (for x64: https://github.com/pidydx/libmagicwin64)
• yara
• virus_total_apis
• pyside
• json
• re The best way to have all the dependencies is to use pip on a standalone python 2.7 install and copy the site-packages directory to the Binary Ninja install path.

TODO:

• do not use pefile but only Binary Ninja API
• do not create a temporary file
• clean the code (specialy the GUI)

Few screenshots:

MSDN documentation

This plugin shows the MSDN documentation concerning the selected symbol

Requierements

• PySide

Screenshot:

MSDN documentation without QT

This plugin is the same than the previous one but without QT. This version opens the web page in the default browser.

Colorize API usage

This plugin only works in the dev version of Binary Ninja. The block colorization is not supported in the stable.

This plugin colorize the instruction block. The color is defined by the kind of API

• Registry: Blue
• Network: Green
• File: Cyan
• Execution: Red
• Crypto: Magenta
• System information: Yellow
• Memory: Orange

TODO:

• update the API lists

Screenshot:

Graph SVG export

This plugin only works in the dev version of Binary Ninja. The block colorization is not supported in the stable.

This plugin is a patched version of the export_svg.py plugin with the background color support.