{"id":4418,"date":"2025-02-25T07:26:34","date_gmt":"2025-02-25T06:26:34","guid":{"rendered":"https:\/\/security.humanativaspa.it\/?p=4418"},"modified":"2026-07-17T15:07:29","modified_gmt":"2026-07-17T15:07:29","slug":"streamlining-vulnerability-research-with-ida-pro-and-rust","status":"publish","type":"post","link":"https:\/\/hnsecurity.it\/it\/blog\/streamlining-vulnerability-research-with-ida-pro-and-rust\/","title":{"rendered":"Streamlining vulnerability research with IDA Pro and Rust"},"content":{"rendered":"

“Rebels on the rise, we have sacrificed
\nBeen knocked down like a poltergeist
\nNocturnal by blood, in darkness we stand
\nWe will prevail in this Rustyland”
\n— Krowdexx, Nocturnal Rebellion (2024)<\/em><\/p><\/blockquote>\n

TL;DR<\/h3>\n

I’ve released some new tools<\/strong> to assist with reverse engineering and vulnerability research against binary targets<\/strong>, based on my previous work<\/a>:<\/p>\n

    \n
  • rhabdomancer<\/a>: IDA Pro headless plugin that locates calls to potentially insecure API functions<\/strong> in a binary file. Auditors can backtrace from these candidate points to find pathways allowing access from untrusted input.<\/li>\n
  • haruspex<\/a>: IDA Pro headless plugin that extracts pseudo-code<\/strong> generated by IDA Pro’s decompiler in a format suitable to be imported into an IDE or parsed by static analysis tools such as Semgrep<\/a>\u00a0or\u00a0weggli<\/a>.<\/li>\n
  • augur<\/a>: IDA Pro headless plugin that extracts strings and related pseudo-code<\/strong> from a binary file. It stores pseudo-code of functions that reference strings in an organized directory tree.<\/li>\n<\/ul>\n

    They’re written in Rust<\/strong> and leverage Hex-Rays’s IDA Pro 9 idalib<\/a> and Binarly’s idalib Rust bindings<\/a> for the IDA SDK<\/a>, to achieve a blazing fast, headless user experience<\/strong>. While working on these tools, I also contributed a number of new features<\/a> to idalib.<\/p>\n

    Once upon a time in Rustyland<\/h3>\n

    After approaching Rust and having explored some basic offensive<\/a> applications<\/a>, I decided it was time for my first serious Rust project<\/strong>. Last October, idalib v0.1.0<\/a> was announced, which gave me an idea: port to IDA Pro some of my Ghidra scripts<\/a> that aim to streamline vulnerability research<\/strong>, using Rust! \ud83e\udd80\ud83d\udca1<\/p>\n

    \n

    Our REsearch team is thrilled about the new IDA v9.0! #efiXplorer<\/a> is fully compatible with v9.0 and still supports IDA v8.4\ud83d\ude80
    \ud83d\udd2c    https:\/\/t.co\/WHYGifmjGS<\/a><\/p>\n

    We are thrilled to announce IDAlib \u2014 idiomatic Rust bindings for the IDA SDK \ud83c\udf89 Kudos to @xorpse<\/a>!
    \u2699\ufe0f    https:\/\/t.co\/PLoNkf8sQn<\/a> pic.twitter.com\/J1no6oFatO<\/a><\/p>\n

    — BINARLY\ud83d\udd2c (@binarly_io) October 1, 2024<\/a><\/p><\/blockquote>\n