Skip to content

Commit 02a8d11

Browse files
committed
doc: migration to zensical
Signed-off-by: Eloïse Brocas <ebrocas@quarkslab.com>
1 parent ecd5360 commit 02a8d11

9 files changed

Lines changed: 273 additions & 273 deletions

File tree

README.md

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,12 @@
1616
</p>
1717

1818

19-
Pyrrha is a filesystem cartography and correlation software focusing on visualization. It currently focuses on the relationship between executable files but aims at enabling anyone to map and visualize any relationship types. It uses the open-source code source
19+
Pyrrha is a firmware cartography tool which provide three level of details:
20+
- an overview of the import/export relationships between executables;
21+
- a firmware-wide callgraph;
22+
- a complete map of a given decompiled binary.
23+
24+
It uses the open-source code source
2025
explorer [NumbatUI](https://github.com/quarkslab/NumbatUI) to provide users with an easy way to navigate through and search for
2126
path to function.
2227
<!-- # --8<-- [end:intro]-->

docs/index.md

Lines changed: 18 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,7 @@
1+
---
2+
title: Home
3+
---
4+
15
--8<-- "README.md:intro"
26

37
<div class="grid cards" markdown>
@@ -10,7 +14,13 @@
1014
## Installation
1115

1216

13-
??? code "Install Visualisation Tool"
17+
!!! note "Install Visualisation Tool"
18+
19+
=== "NumbatUI (Ubuntu/Debian)"
20+
21+
For Debian like distribution, download the [`.deb`](https://github.com/quarkslab/NumbatUI/releases) package and install it on your system (`sudo dpkg -i numbatui.deb`)
22+
23+
For other systems, you can also compile it manually or use a Docker, check [NumbatUI documentation](https://quarkslab.github.io/NumbatUI/installation/) for further details.
1424

1525
=== "Sourcetrail"
1626

@@ -39,34 +49,8 @@
3949

4050
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), and install it following [Sourcetrail documentation](https://github.com/CoatiSoftware/Sourcetrail/releases).
4151

42-
43-
=== "NumbatUI (Ubuntu/Debian)"
44-
45-
_Tested only for last Ubuntu/Debian._
46-
47-
Run the following script that will clone and build `NumbatUI` and install `Pyrrha`. `NumbatUI` executable will be in `numbatui/build/Release/app`.
48-
49-
```sh
50-
# Prerequisites for Numbat UI
51-
sudo apt-get update
52-
sudo apt-get install -y \
53-
cmake \
54-
git \
55-
build-essential \
56-
libboost-filesystem-dev libboost-program-options-dev libboost-system-dev libboost-date-time-dev \
57-
qt6-svg-dev qt6-base-dev qt6-5compat-dev \
58-
unzip wget \
59-
libclang-17-dev clang-17
60-
61-
# Clone and Build NumbatUI
62-
git clone https://github.com/quarkslab/NumbatUI.git numbatui
63-
cd numbatui
64-
mkdir -p build/Release
65-
cd build/Release
66-
cmake -DCMAKE_BUILD_TYPE="Release" -DBUILD_CXX_LANGUAGE_PACKAGE=ON -DBUILD_PYTHON_LANGUAGE_PACKAGE=ON ../.. && make NumbatUI -j $(nproc)
67-
```
68-
69-
!!! code "Install Pyrrha"
52+
53+
!!! note "Install Pyrrha"
7054
=== ":fontawesome-brands-python: Python Package"
7155
Require a local installation of **IDA Pro 9.1+** and/or **Ghidra 12.0+** except for `fs` mapper.
7256
```python
@@ -81,12 +65,12 @@
8165
```
8266

8367

84-
!!! note
68+
!!! info
8569
Detailed instructions can be found on the [dedicated documentation page](installation.md).
8670

8771
--8<-- "README.md:usage"
8872

89-
!!! code "Run Pyrrha"
73+
!!! note "Run Pyrrha"
9074
=== ":fontawesome-brands-python: Python Package"
9175
If your backend is not on `PATH`, indicate its directory using the matching environment variable.
9276
```sh
@@ -106,14 +90,14 @@
10690
docker run --rm -t -v $PWD:/tmp/pyrrha ghcr.io/quarkslab/pyrrha:latest MAPPER [OPTIONS] ROOT_DIRECTORY
10791
```
10892

109-
!!! code "Visualize results"
93+
!!! note "Visualize results"
11094
You should have a `*.srctrlprj` file corresponding to the project file and a `*.srctrldb` file for the DB.
11195
Run `NumbatUI` or `Sourcetrail` on the project file. You can now navigate into the results.
11296

11397
The user interface is described in depth in the [NumbatUI documentation](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#user-interface).
11498
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#custom-trail-dialog).
115-
!!! note
116-
The detailed documentation of each mapper is available in the [documentation](mappers/mappers.md).
99+
!!! info
100+
The detailed documentation of each mapper is available in the [documentation](mappers/index.md).
117101

118102
--8<-- "README.md:publications"
119103
--8<-- "README.md:authors"

docs/installation.md

Lines changed: 57 additions & 74 deletions
Original file line numberDiff line numberDiff line change
@@ -10,89 +10,72 @@ The installation is done in three parts:
1010

1111
## Pyrrha Installation
1212

13-
=== ":fontawesome-brands-python: Python Package"
14-
**Pyrrha** relies on a backend (IDA or Ghidra) to generate its results, except for the light mapper `fs`. This installation is not covered here, we consider the following prerequisites:
13+
!!! note ""
14+
=== ":fontawesome-brands-python: Python Package"
15+
**Pyrrha** relies on a backend (IDA or Ghidra) to generate its results, except for the light mapper `fs`. This installation is not covered here, we consider the following prerequisites:
1516

16-
- Python **≥ 3.10**.
17-
- A local installation of **IDA Pro 9.1+** and/or **Ghidra 12.0+** —
18-
required by the InterCG mapper.
17+
- Python **≥ 3.10**.
18+
- A local installation of **IDA Pro 9.1+** and/or **Ghidra 12.0+** —
19+
required by the InterCG mapper.
1920

20-
Then you can install **Pyrrha** Python package in a virtual environment with `pip`.
21-
```sh
22-
# Do not forget to activate your virtualenv
23-
pip install pyrrha-mapper
24-
```
25-
If you prefer using sources to install Pyrrha, do the following:
26-
```sh
27-
# Do not forget to activate your virtualenv
28-
pip install 'pyrrha @ git+https://github.com/quarkslab/pyrrha'
29-
```
30-
=== ":fontawesome-brands-docker: Docker Image"
31-
**Pyrrha** can be used with a docker. It provides **Pyrrha** with a backend (**Ghidra**), but you still need to install NumbatUI on your system as described in the [**NumbatUI** Installation](#numbatui-installation) section.
21+
Then you can install **Pyrrha** Python package in a virtual environment with `pip`.
22+
```sh
23+
# Do not forget to activate your virtualenv
24+
pip install pyrrha-mapper
25+
```
26+
If you prefer using sources to install Pyrrha, do the following:
27+
```sh
28+
# Do not forget to activate your virtualenv
29+
pip install 'pyrrha @ git+https://github.com/quarkslab/pyrrha'
30+
```
31+
=== ":fontawesome-brands-docker: Docker Image"
32+
**Pyrrha** can be used with a docker. It provides **Pyrrha** with a backend (**Ghidra**), but you still need to install NumbatUI on your system as described in the [**NumbatUI** Installation](#numbatui-installation) section.
3233

33-
The docker image is directly available from our [Github registry](https://github.com/orgs/quarkslab/packages/container/package/pyrrha).
34+
The docker image is directly available from our [Github registry](https://github.com/orgs/quarkslab/packages/container/package/pyrrha).
3435

3536

36-
```commandline
37-
cd ROOT_DIRECTORY/..
38-
docker run --rm -t -v $PWD:/tmp/pyrrha ghcr.io/quarkslab/pyrrha:latest MAPPER [OPTIONS] ROOT_DIRECTORY
39-
```
37+
```commandline
38+
cd ROOT_DIRECTORY/..
39+
docker run --rm -t -v $PWD:/tmp/pyrrha ghcr.io/quarkslab/pyrrha:latest MAPPER [OPTIONS] ROOT_DIRECTORY
40+
```
4041

41-
42+
4243

4344

4445
## Visualizer Installation
45-
=== "**Sourcetrail**"
46-
=== "Linux"
47-
```sh
48-
SOURCETRAIL_URL='https://github.com/CoatiSoftware/Sourcetrail/releases/download/2021.4.19/Sourcetrail_2021_4_19_Linux_64bit.tar.gz'
49-
CHECKSUM=""f65a401daad8e16f29f7b2ff062a559999b6a8d44606db36cdf803de0cd7816d
50-
EXTRACTION_DIR="/tmp/Sourcetrail_2021_4_19_Linux_64bit"
51-
DOWNLOAD_PATH="$EXTRACTION_PATH.tar.gz"
52-
53-
wget $SOURCETRAIL_URL -O $DOWNLOAD_PATH
54-
echo $CHECKSUM $DOWNLOAD_PATH | sha256sum -c
55-
56-
if [ $? == 0 ]; then
57-
echo '==== Install Sourcetrail'
58-
tar xf $DOWNLOAD_PATH -C $EXTRACTION_DIR
59-
sudo $EXTRACTION_DIR/Sourcetrail/install.sh
60-
rm -rf $DOWNLOAD_PATH $EXTRACTION_DIR
61-
fi
62-
```
63-
=== "Windows"
64-
65-
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), unzip it and run the `setup.exe`.
66-
67-
=== "MacOS"
68-
69-
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), and install it following [Sourcetrail documentation](https://github.com/CoatiSoftware/Sourcetrail/releases).
70-
71-
=== "**NumbatUI**"
72-
<a name="numbatui-installation"></a>**NumbatUI** should be compiled locally, as explained in its [README](https://github.com/quarkslab/NumbatUI/blob/main/README.md). For the moment it has only be tested on Ubuntu/Debian distributions.
73-
Here are the summarized compilation instructions:
74-
75-
**Prerequisites**
76-
```sh
77-
apt-get update
78-
apt-get install -y \
79-
cmake \
80-
git \
81-
build-essential \
82-
libboost-filesystem-dev libboost-program-options-dev libboost-system-dev libboost-date-time-dev \
83-
qt6-svg-dev qt6-base-dev qt6-5compat-dev \
84-
unzip wget \
85-
libclang-17-dev clang-17
86-
```
87-
88-
**Compilation**
89-
```sh
90-
git clone https://github.com/quarkslab/NumbatUI.git numbatui
91-
cd numbatui
92-
mkdir -p build/Release
93-
cd build/Release
94-
cmake -DCMAKE_BUILD_TYPE="Release" -DBUILD_CXX_LANGUAGE_PACKAGE=ON -DBUILD_PYTHON_LANGUAGE_PACKAGE=ON ../.. && make NumbatUI -j $(nproc)
95-
```
46+
47+
!!! note ""
48+
=== "**NumbatUI**"
49+
<a name="numbatui-installation"></a>
50+
For Debian like distribution, download the [`.deb`](https://github.com/quarkslab/NumbatUI/releases) package and install it on your system (`sudo dpkg -i numbatui.deb`)
51+
52+
For other systems, you can also compile it manually or use a Docker, check [NumbatUI documentation](https://quarkslab.github.io/NumbatUI/installation/) for further details.
53+
54+
=== "**Sourcetrail**"
55+
=== "Linux"
56+
```sh
57+
SOURCETRAIL_URL='https://github.com/CoatiSoftware/Sourcetrail/releases/download/2021.4.19/Sourcetrail_2021_4_19_Linux_64bit.tar.gz'
58+
CHECKSUM=""f65a401daad8e16f29f7b2ff062a559999b6a8d44606db36cdf803de0cd7816d
59+
EXTRACTION_DIR="/tmp/Sourcetrail_2021_4_19_Linux_64bit"
60+
DOWNLOAD_PATH="$EXTRACTION_PATH.tar.gz"
61+
62+
wget $SOURCETRAIL_URL -O $DOWNLOAD_PATH
63+
echo $CHECKSUM $DOWNLOAD_PATH | sha256sum -c
64+
65+
if [ $? == 0 ]; then
66+
echo '==== Install Sourcetrail'
67+
tar xf $DOWNLOAD_PATH -C $EXTRACTION_DIR
68+
sudo $EXTRACTION_DIR/Sourcetrail/install.sh
69+
rm -rf $DOWNLOAD_PATH $EXTRACTION_DIR
70+
fi
71+
```
72+
=== "Windows"
73+
74+
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), unzip it and run the `setup.exe`.
75+
76+
=== "MacOS"
77+
78+
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), and install it following [Sourcetrail documentation](https://github.com/CoatiSoftware/Sourcetrail/releases).
9679

9780
## Documentation
9881

docs/mappers/exe-decomp.md

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,13 @@ the mapper will:
1111

1212
## Usage
1313

14+
!!! tip
15+
If your backend is not on `PATH`, indicate its directory using the matching environment variable.
16+
```sh
17+
export IDADIR=/opt/idapro
18+
export GHIDRA_INSTALL_DIR=/opt/ghidra_12.0.4_PUBLIC
19+
```
20+
1421
```commandline
1522
Usage: pyrrha decomp [OPTIONS] EXECUTABLE
1623
@@ -24,6 +31,9 @@ Options:
2431
-e, --export Create a JSON export of the resulting decompilation mapping.
2532
-h, --help Show this message and exit.
2633
```
34+
After firmware analysis, you can visualize and navigate into the results with `numbatui`. The user interface is described in depth in the [NumbatUI documentation](https://quarkslab.github.io/NumbatUI/interface/).
35+
36+
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://quarkslab.github.io/NumbatUI/interface/#custom-trail).
2737

2838
## JSON export
2939

@@ -38,18 +48,3 @@ for func in result.iter_functions():
3848
```
3949

4050
An `ExportedDecompilation` stores the analysed binary identity (`path`, `id`, `name`) and its functions, keyed by their parser-space entry-point address. Each function is an `ExportedFunction` carrying its `Symbol`, its `FuncType`, the addresses it calls and is called by, its decompiled `source`, and the in-source locations of its declaration and call sites (`ExportedLocation`).
41-
42-
!!! note
43-
This mapper create the Quokka export of the binary as well as a cache version of all the decompiled function of the analyzed binary.. If these files already exist, it loads them without regenerate them. Like that it also allowed to use `pyrrha` in systems without Quokka and/or IDA.
44-
45-
46-
After firmware analysis, you can visualize and navigate into the results with `numbatui`. The user interface is described in depth in the [NumbatUI documentation](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#user-interface).
47-
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#custom-trail-dialog).
48-
49-
<!-- ## JumpTo Disassembler Feature
50-
51-
The mapper uses a NumbatUI feature to enable jumping from NumbatUI directly
52-
to the given function in a disassembler. This feature is useful if one need
53-
to perform more in-depth reverse-engineering of the given function. Such
54-
feature requires an IDA Pro plugin to be installed. It can be done by copying
55-
the ``numbatui_plugin.py`` in the IDA Pro plugin directory. -->

docs/mappers/fs-cg.md

Lines changed: 30 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ anyone can follow control-flow between programs.
1010

1111
The main drawback is that computing a program call graph requires disassembly
1212
and is thus more computationaly intensive. That task is currently done using
13-
the [Quokka exporter](https://github.com/quarkslab/quokka).
13+
either IDA Pro or Ghidra.
1414

1515

1616

@@ -21,27 +21,36 @@ The dump should be provided on the command line. The `ROOT_DIRECTORY` should con
2121
the whole filesystem to be indexed.
2222

2323
!!! tip
24-
You can use the environement variable `IDAPATH` to indicate in which directory `ida` binary is.
25-
26-
```commandline
27-
Usage: pyrrha fs-cg [OPTIONS] ROOT_DIRECTORY
28-
29-
Map a the Inter-Image Call Graph of a whole filesystem into a NumbatUI db.It disassembles executables using a
30-
disassembler and extract the call graph.It then results all call references across binaries.
31-
32-
Options:
33-
-d, --debug Set log level to DEBUG
34-
--db PATH NumbatUI DB file path (.srctrldb). [default: fs-cg.srctrldb]
35-
-j, --jobs INT Number of parallel jobs created (threads). [default: 1; 1<=x<=11]
36-
--ignore When resolving duplicate imports, ignore them
37-
--arbitrary When resolving duplicate imports, select the first one available
38-
--interactive When resolving duplicate imports, user manually select which one to use=
39-
-h, --help Show this message and exit.
24+
If your backend is not on `PATH`, indicate its directory using the matching environment variable.
25+
```sh
26+
export IDADIR=/opt/idapro
27+
export GHIDRA_INSTALL_DIR=/opt/ghidra_12.0.4_PUBLIC
28+
```
29+
30+
```bash
31+
Usage: pyrrha fs-cg [OPTIONS] ROOT_DIRECTORY
32+
33+
Map the inter-image call graph of a whole filesystem into a NumbatUI db. It disassembles executables, extracts the
34+
call graph, and resolves all call references across binaries.
35+
36+
╭─ Mapper Options ─────────────────────────────────────────────────────────────────────────────────────────────────────╮
37+
│ --backend -b [ida|ghidra] Backend to use. [default: 1] │
38+
│ --db PATH NumbatUI DB file path (.srctrldb). [default: fs-cg.srctrldb] │
39+
│ --jobs -j INT [1<=x<=11] Number of parallel jobs. [default: 1] │
40+
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
41+
╭─ Resolution ─────────────────────────────────────────────────────────────────────────────────────────────────────────╮
42+
│ When resolving duplicate imports: │
43+
│ --arbitrary Select the first one available. │
44+
│ --interactive User manually selects which one to use. │
45+
│ --ignore Ignore them. │
46+
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
47+
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────────────────────────╮
48+
│ --debug -d Set log level to DEBUG. │
49+
│ --help -h Show this message and exit. │
50+
╰──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────╯
4051
```
4152

42-
!!! note
43-
This mapper create the Quokka export of each binary nearby each executable file. If this file already exists, it loads it without regenerate it. Like that it also allowed to use `pyrrha` in systems without Quokka and/or IDA.
4453

54+
After firmware analysis, you can visualize and navigate into the results with `numbatui`. The user interface is described in depth in the [NumbatUI documentation](https://quarkslab.github.io/NumbatUI/interface/).
4555

46-
After firmware analysis, you can visualize and navigate into the results with `numbatui`. The user interface is described in depth in the [NumbatUI documentation](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#user-interface).
47-
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#custom-trail-dialog).
56+
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://quarkslab.github.io/NumbatUI/interface/#custom-trail).

0 commit comments

Comments
 (0)