404d/peutils

Binary Ninja plugin providing various niche utilities for working with PE binaries

Binary Ninja PE Utils

Bunch'a niche utilities for working with PE-based binaries.

Features

Resolve ordinal imports

Ordinal imports can be resolved to symbol names from external BNDBs. If you rename an exported function in the external BNDB, the name you defined will be used instead of the original export name.

Given an example import as shown below:

By loading a binary view for OLEAUT32.dll, we can update the import names for the target binary view with the real name behind the import:

Synchronize symbol names and types across binaries

Types defined in external BNDBs can be transferred to the current binary view in order to aid with reversing.

Continuing from the above example, we can rename the arg of the function SysStringLen from the external BNDB OLEAUT32.dll:

When synced, the IAT will be updated with the new argument:

We can also see that the new argument is exposed through other disassembly views, like MLIL:

As mentioned earlier, symbol names also get transferred between loaded BNDBs. Renaming the export from the external BNDB then resyncing, we can see that the changes is transferred to the target binary view:

peutils's Issues

Update Plugin for Plugin Manager 2.0

With the introduction of the Binary Ninja Plugin Manager 2.0 we will be releasing a installation UI for all plugins in the community repository. Please check https://binary.ninja/2019/07/04/plugin-manager-2.0.html for the latest information about how to submit your plugin. If you no longer want your plugin in the repository please disregard this issue

Actually check whether Python 3 works

Need to get a working binja+py3 setup for this flrst

RTTI parsing and traversal

https://www.blackhat.com/presentations/bh-dc-07/Sabanal_Yason/Paper/bh-dc-07-Sabanal_Yason-WP.pdf