You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+6-1Lines changed: 6 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,12 @@
16
16
</p>
17
17
18
18
19
-
Pyrrha is a filesystem cartography and correlation software focusing on visualization. It currently focuses on the relationship between executable files but aims at enabling anyone to map and visualize any relationship types. It uses the open-source code source
19
+
Pyrrha is a firmware cartography tool which provide three level of details:
20
+
- an overview of the import/export relationships between executables;
21
+
- a firmware-wide callgraph;
22
+
- a complete map of a given decompiled binary.
23
+
24
+
It uses the open-source code source
20
25
explorer [NumbatUI](https://github.com/quarkslab/NumbatUI) to provide users with an easy way to navigate through and search for
Copy file name to clipboardExpand all lines: docs/index.md
+18-34Lines changed: 18 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,3 +1,7 @@
1
+
---
2
+
title: Home
3
+
---
4
+
1
5
--8<-- "README.md:intro"
2
6
3
7
<divclass="grid cards"markdown>
@@ -10,7 +14,13 @@
10
14
## Installation
11
15
12
16
13
-
??? code "Install Visualisation Tool"
17
+
!!! note "Install Visualisation Tool"
18
+
19
+
=== "NumbatUI (Ubuntu/Debian)"
20
+
21
+
For Debian like distribution, download the [`.deb`](https://github.com/quarkslab/NumbatUI/releases) package and install it on your system (`sudo dpkg -i numbatui.deb`)
22
+
23
+
For other systems, you can also compile it manually or use a Docker, check [NumbatUI documentation](https://quarkslab.github.io/NumbatUI/installation/) for further details.
14
24
15
25
=== "Sourcetrail"
16
26
@@ -39,34 +49,8 @@
39
49
40
50
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), and install it following [Sourcetrail documentation](https://github.com/CoatiSoftware/Sourcetrail/releases).
41
51
42
-
43
-
=== "NumbatUI (Ubuntu/Debian)"
44
-
45
-
_Tested only for last Ubuntu/Debian._
46
-
47
-
Run the following script that will clone and build `NumbatUI` and install `Pyrrha`. `NumbatUI` executable will be in `numbatui/build/Release/app`.
cmake -DCMAKE_BUILD_TYPE="Release" -DBUILD_CXX_LANGUAGE_PACKAGE=ON -DBUILD_PYTHON_LANGUAGE_PACKAGE=ON ../.. && make NumbatUI -j $(nproc)
67
-
```
68
-
69
-
!!! code "Install Pyrrha"
52
+
53
+
!!! note "Install Pyrrha"
70
54
=== ":fontawesome-brands-python: Python Package"
71
55
Require a local installation of **IDA Pro 9.1+** and/or **Ghidra 12.0+** except for `fs` mapper.
72
56
```python
@@ -81,12 +65,12 @@
81
65
```
82
66
83
67
84
-
!!! note
68
+
!!! info
85
69
Detailed instructions can be found on the [dedicated documentation page](installation.md).
86
70
87
71
--8<-- "README.md:usage"
88
72
89
-
!!! code "Run Pyrrha"
73
+
!!! note "Run Pyrrha"
90
74
=== ":fontawesome-brands-python: Python Package"
91
75
If your backend is not on `PATH`, indicate its directory using the matching environment variable.
92
76
```sh
@@ -106,14 +90,14 @@
106
90
docker run --rm -t -v $PWD:/tmp/pyrrha ghcr.io/quarkslab/pyrrha:latest MAPPER [OPTIONS] ROOT_DIRECTORY
107
91
```
108
92
109
-
!!! code "Visualize results"
93
+
!!! note "Visualize results"
110
94
You should have a `*.srctrlprj` file corresponding to the project file and a `*.srctrldb` file for the DB.
111
95
Run `NumbatUI` or `Sourcetrail` on the project file. You can now navigate into the results.
112
96
113
97
The user interface is described in depth in the [NumbatUI documentation](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#user-interface).
114
98
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#custom-trail-dialog).
115
-
!!! note
116
-
The detailed documentation of each mapper is available in the [documentation](mappers/mappers.md).
99
+
!!! info
100
+
The detailed documentation of each mapper is available in the [documentation](mappers/index.md).
Copy file name to clipboardExpand all lines: docs/installation.md
+57-74Lines changed: 57 additions & 74 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,89 +10,72 @@ The installation is done in three parts:
10
10
11
11
## Pyrrha Installation
12
12
13
-
=== ":fontawesome-brands-python: Python Package"
14
-
**Pyrrha** relies on a backend (IDA or Ghidra) to generate its results, except for the light mapper `fs`. This installation is not covered here, we consider the following prerequisites:
13
+
!!! note ""
14
+
=== ":fontawesome-brands-python: Python Package"
15
+
**Pyrrha** relies on a backend (IDA or Ghidra) to generate its results, except for the light mapper `fs`. This installation is not covered here, we consider the following prerequisites:
15
16
16
-
- Python **≥ 3.10**.
17
-
- A local installation of **IDA Pro 9.1+** and/or **Ghidra 12.0+** —
18
-
required by the InterCG mapper.
17
+
- Python **≥ 3.10**.
18
+
- A local installation of **IDA Pro 9.1+** and/or **Ghidra 12.0+** —
19
+
required by the InterCG mapper.
19
20
20
-
Then you can install **Pyrrha** Python package in a virtual environment with `pip`.
21
-
```sh
22
-
# Do not forget to activate your virtualenv
23
-
pip install pyrrha-mapper
24
-
```
25
-
If you prefer using sources to install Pyrrha, do the following:
**Pyrrha** can be used with a docker. It provides **Pyrrha** with a backend (**Ghidra**), but you still need to install NumbatUI on your system as described in the [**NumbatUI** Installation](#numbatui-installation) section.
21
+
Then you can install **Pyrrha** Python package in a virtual environment with `pip`.
22
+
```sh
23
+
# Do not forget to activate your virtualenv
24
+
pip install pyrrha-mapper
25
+
```
26
+
If you prefer using sources to install Pyrrha, do the following:
**Pyrrha** can be used with a docker. It provides **Pyrrha** with a backend (**Ghidra**), but you still need to install NumbatUI on your system as described in the [**NumbatUI** Installation](#numbatui-installation) section.
32
33
33
-
The docker image is directly available from our [Github registry](https://github.com/orgs/quarkslab/packages/container/package/pyrrha).
34
+
The docker image is directly available from our [Github registry](https://github.com/orgs/quarkslab/packages/container/package/pyrrha).
34
35
35
36
36
-
```commandline
37
-
cd ROOT_DIRECTORY/..
38
-
docker run --rm -t -v $PWD:/tmp/pyrrha ghcr.io/quarkslab/pyrrha:latest MAPPER [OPTIONS] ROOT_DIRECTORY
39
-
```
37
+
```commandline
38
+
cd ROOT_DIRECTORY/..
39
+
docker run --rm -t -v $PWD:/tmp/pyrrha ghcr.io/quarkslab/pyrrha:latest MAPPER [OPTIONS] ROOT_DIRECTORY
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), unzip it and run the `setup.exe`.
66
-
67
-
=== "MacOS"
68
-
69
-
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), and install it following [Sourcetrail documentation](https://github.com/CoatiSoftware/Sourcetrail/releases).
70
-
71
-
=== "**NumbatUI**"
72
-
<aname="numbatui-installation"></a>**NumbatUI** should be compiled locally, as explained in its [README](https://github.com/quarkslab/NumbatUI/blob/main/README.md). For the moment it has only be tested on Ubuntu/Debian distributions.
cmake -DCMAKE_BUILD_TYPE="Release" -DBUILD_CXX_LANGUAGE_PACKAGE=ON -DBUILD_PYTHON_LANGUAGE_PACKAGE=ON ../.. && make NumbatUI -j $(nproc)
95
-
```
46
+
47
+
!!! note ""
48
+
=== "**NumbatUI**"
49
+
<aname="numbatui-installation"></a>
50
+
For Debian like distribution, download the [`.deb`](https://github.com/quarkslab/NumbatUI/releases) package and install it on your system (`sudo dpkg -i numbatui.deb`)
51
+
52
+
For other systems, you can also compile it manually or use a Docker, check [NumbatUI documentation](https://quarkslab.github.io/NumbatUI/installation/) for further details.
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), unzip it and run the `setup.exe`.
75
+
76
+
=== "MacOS"
77
+
78
+
Download last Sourcetrail [release](https://github.com/CoatiSoftware/Sourcetrail/releases), and install it following [Sourcetrail documentation](https://github.com/CoatiSoftware/Sourcetrail/releases).
-e, --export Create a JSON export of the resulting decompilation mapping.
25
32
-h, --help Show this message and exit.
26
33
```
34
+
After firmware analysis, you can visualize and navigate into the results with `numbatui`. The user interface is described in depth in the [NumbatUI documentation](https://quarkslab.github.io/NumbatUI/interface/).
35
+
36
+
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://quarkslab.github.io/NumbatUI/interface/#custom-trail).
27
37
28
38
## JSON export
29
39
@@ -38,18 +48,3 @@ for func in result.iter_functions():
38
48
```
39
49
40
50
An `ExportedDecompilation` stores the analysed binary identity (`path`, `id`, `name`) and its functions, keyed by their parser-space entry-point address. Each function is an `ExportedFunction` carrying its `Symbol`, its `FuncType`, the addresses it calls and is called by, its decompiled `source`, and the in-source locations of its declaration and call sites (`ExportedLocation`).
41
-
42
-
!!! note
43
-
This mapper create the Quokka export of the binary as well as a cache version of all the decompiled function of the analyzed binary.. If these files already exist, it loads them without regenerate them. Like that it also allowed to use `pyrrha` in systems without Quokka and/or IDA.
44
-
45
-
46
-
After firmware analysis, you can visualize and navigate into the results with `numbatui`. The user interface is described in depth in the [NumbatUI documentation](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#user-interface).
47
-
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#custom-trail-dialog).
48
-
49
-
<!-- ## JumpTo Disassembler Feature
50
-
51
-
The mapper uses a NumbatUI feature to enable jumping from NumbatUI directly
52
-
to the given function in a disassembler. This feature is useful if one need
53
-
to perform more in-depth reverse-engineering of the given function. Such
54
-
feature requires an IDA Pro plugin to be installed. It can be done by copying
55
-
the ``numbatui_plugin.py`` in the IDA Pro plugin directory. -->
This mapper create the Quokka export of each binary nearby each executable file. If this file already exists, it loads it without regenerate it. Like that it also allowed to use `pyrrha` in systems without Quokka and/or IDA.
44
53
54
+
After firmware analysis, you can visualize and navigate into the results with `numbatui`. The user interface is described in depth in the [NumbatUI documentation](https://quarkslab.github.io/NumbatUI/interface/).
45
55
46
-
After firmware analysis, you can visualize and navigate into the results with `numbatui`. The user interface is described in depth in the [NumbatUI documentation](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#user-interface).
47
-
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://github.com/quarkslab/NumbatUI/blob/main/DOCUMENTATION.md#custom-trail-dialog).
56
+
Do not hesitate to take a look at all the possibilities offered by NumbatUI, especially [Custom Trails](https://quarkslab.github.io/NumbatUI/interface/#custom-trail).
0 commit comments