MUI – A GUI Plugin For Binary Ninja To Easily Interact With And View The Progress Of Manticore

AVvXsEg2ezs221jpWWNUGVLxuK7bx jP RbT XsGXFPqIZCKBQTn 1lFXrsh5Jjg6cL8UmY S98aqFAqeLsUc42v3KHJqQ76xRZuftgQq1PBMi7AsYcH9aU9s2U4vhKysBt9a3Y4K 93ZwJ20pn2zFGS2EJSV5JzlH2EwilL5lsx0OM yZ2PEl09VAIzneysvw

With the Manticore User Interface (MUI) project, we provide a graphical user interface plugin for Binary Ninja to allow users to easily interact with and view progress of the Manticore symbolic execution engine for analysis of smart contracts and native binaries.

ATTENTION

This project is under active development and may be unstable or unusable. Please open an issue if you have any difficulties using the existing features. New feature development will be considered on a case by case basis.

Requirements

Aside from the Python requirements, we require the following:

  • Binary Ninja (latest development version) with GUI
  • git submodule update --init --recursive for Manticore submodule

Installation

MUI requires a copy of Binary Ninja with a GUI. Currently we are testing against the latest dev release(s) (2.4.2901-dev at time of writing).

Manticore only operates on native binaries within a Linux environment. EVM support has only been tested on Mac and Linux, and it requires the installation of ethersplay.

Python dependencies are currently managed using requirements.txt and requirements-dev.txt. You can run make init to set up a development environment.

  1. Make the project available to Binary Ninja by creating a symbolic link to the plugins directory. From within the root of this repo, run the following:

    # For Mac
    $ ln -s "$(pwd)/mui" "${HOME}/Library/Application Support/Binary Ninja/plugins/mui"

    # For Linux
    $ ln -s "$(pwd)/mui" "${HOME}/.binaryninja/plugins/mui"
  2. Make sure Binary Ninja knows about our Python virtual environment.

    1. Open Binary Ninja’s “Preferences” -> “Settings” -> “Python” and ensure the “Python Interpreter” is correctly set to the Python path associated with the current virtual environment. Reference venv/pyvenv.cfg to find the base path.
    2. Copy and paste the absolute path of the MUI project into Binary Ninja’s “Python Virtual Environment Site-Packages” and add the required /venv/lib/python3.<minor_version>/site-packages suffix for the site-packages path.
    3. Restart Binary Ninja if necessary.

Development

Installing currently listed dependencies:

$ make init
# For Mac (will be similar for Linux)
$ export PYTHONPATH="/Applications/Binary Ninja.app/Contents/Resources/python:/Applications/Binary Ninja.app/Contents/Resources/python3"

Activating the python virtual environment (do this before running other make commands):

$ . venv/bin/activate

Code style and linting can be followed by running the following:

$ make format
$ make lint

Tests for code without Binary Ninja interaction can be run if you have a headless version of binary ninja available, otherwise only non-Binary Ninja tests will be run:

$ make test

Adding a new dependency can be done by editing requirements.txt or requirements-dev.txt and then running the following in the virtual environment:

$ pip install -r requirements-dev.txt -r requirements.txt

Usage (Native)

All MUI features can be accessed through either the right-click context menu or the command palette. Common features include:

  • Find Path to This Instruction / Remove Instruction from Find List
  • Avoid This Instruction / Remove Instruction from Avoid List
  • Add/Edit Custom Hook
  • Solve With Manticore / Stop Manticore

And the following widgets are available:

  • State List Widget

    Shows all the Active/Waiting/Complete/Errored states during manticore execution. Double-clicking a certain state navigates you to the current instruction of that state and renders its provenance tree in the graph widget.

AVvXsEg0yuYVzMf8llM 9a8oLf1FlR280 TAfSBZaIWOdh6gX9fUTZVxq0z8WZf7v2FPR0tMyLXbkA0JQ hVhj0M 3dEtuEN2PwkqyoWKJf0lfZYRO1tDRMAHtBUp coHdu6aT5CDA5WSkEUjcg72uGmdMNFiJmLHneHuU2firaNp1TXFI UUTBuc90fuVQ8rg=w640 h526

 

  • State Graph Widget

    Shows the provenance tree for a certain state selected in the list widget. Tab can be used to expand/collapse the graph and double-clicking any of the state nodes navigates you to the current instruction of that state.

AVvXsEhWZOaoxLchNS6QnYo 3AfltFXIogNe1yb11BRJQ7Hd1QXuPrERY2445nZboQiPVIjBidedQkCvD2qzi4saaS7FMTWqgCyXOiGQ2k8kpLzW9hQ sZQUryLquGii7NookJggoQw V3ZMXIHJYv1PFS5Na7Wrs6JraOZeFMHRgR0xY0CzufuJumbC9B40qw=w640 h396

  • Run Dialog

    The run dialog is shown when you invoke the Solve with Manticore command. It allows you to configure the various manticore options, and the changes will be saved to the bndb file. Some example configs include using a combination of LD_PRELOAD and LD_LIBRARY_PATH environment variables to run the binary with custom glibc.

AVvXsEjDeat3FYnidvrdwfuHZ5rWBG0EredkhMRhN05du4cZG1RsLIaMqsDFYaEPWwOcmuuLu24FAf0GOs5loRJRi pF VBXI97IpFTHAAYft6cuwc1E9htkNOsWDRxntmq gOmvP4l fEG3lI3umkUDYp6eeSnQM17uAWxzf7MfbY cYO6iHJtN8i4JP0Hxtw=w640 h420

 

  • Custom Hook Dialog

    The custom hook dialog can be accessed using the Add/Edit Custom Hook command. It allows you to define a custom manticore hook at the selected address. You also have full access to the Binary Ninja API which allows you to add highlighting, comments, and more. A defined hook can be removed by setting the code input field to blank.

AVvXsEgZvgkXjWJToyvTlHZhteMn1ximN vPy12o8k2TbzzOXq3TlnkRFV5pn9NBrGM f1PWYOeMeSw bp8bIPa 7eUBXUDvUut4enmaSOEDAsjhC7925jyUfqdL0DpLmrGMbzO2nD1ND2np3Y IfVVb Dkg60tLwB hnaQafcknkILcsNKm6wY2Lvg5 Qx Dg=w640 h356

Usage (EVM)

EVM support is currently a bit limited. MUI EVM only supports the same feature set as the Manticore CLI tool. Available commands include:

  • Load Ethereum Contract
  • Solve With Manticore / Stop Manticore

And the following views are implemented:

  • EVM Run Dialog

    The run dialog is shown when you invoke the Solve with Manticore command. It allows you to configure the various manticore options, and the changes will be saved to the bndb file.

AVvXsEj3smvjWLXOFv8Q2mPNboa B3ld36y3she1aVmymbUBavq46T0 z0s7MnKMYexWpPyX0RJ5eJFVygn5 4TNMCDz kYRwKx3IfI y59LiWrURbfGtfJ5jY6496vFhtBhPPjilQyKgXAGXRAkpHnnFTaNmPz4HmFtaVE1sPgxduMUn6gtOPCsZ4rDU0nxPw=w640 h466

  • Run Report

    The report page shows the result of a manticore execution. It displays all the files produced using the Binary Ninja UI.

AVvXsEhTEFkt1tuHBOduMURN2EJUK9R9 40vBjVHMFv2LLMyYpIrn424p1nnCxK hDOyYPByCOlL8 XIxIrujhacPsYIdEHkn9Qji3DE0dUqKyn1vp8j44I0rgGGnonCFMpJQcd4EzH Jj voZhm4sKsxA3WUvrL5ok5KKSqkFXQCu9HC74dxaaitGpsG9NPKA=w640 h419

 

click here to read full Article

Read More on Pentesting Tools

You may also like...

Leave a Reply

Your email address will not be published. Required fields are marked *