grap: define and match graph patterns within binaries

https://github.com/QuoSecGmbH/grap

grap takes patterns and binary files, uses a Casptone-based disassembler to obtain the control flow graphs from the binaries, then matches the patterns against them.

Patterns are user-defined graphs with instruction conditions ("opcode is xor and arg1 is eax") and repetition conditions (3 identical instructions, basic blocks...).

grap is available as a standalone tool with a disassembler and python bindings, and as an IDA plugin which takes advantage of the disassembly done by IDA and the reverser.

Match quick pattern:

Match quick pattern

Match full pattern:

Match full pattern

Match on multiple files:

Match on multiple files

Create patterns interactively from IDA:

Create and match patterns directly from IDA

Installation

This document describes how to build and install grap on a Linux distribution.

You may also read:

Requirements

Besides compilers (build-essential), the following dependencies must be installed:

Thus on Ubuntu / Debian, this should work :

sudo apt-get install build-essential cmake bison flex libboost-regex-dev libboost-system-dev libboost-filesystem-dev libseccomp-dev python3-dev python3-pefile python3-pyelftools python3-capstone swig

Please note that those were tested for the latest Ubuntu LTS (18.04.3). Packages may differ depending on your distribution.

Build and install

The following commands will build and install the project:

SWIG might fail to find python3 if your default version is python2, this can be overcome by switching to python3 as default. For instance on Ubuntu:

sudo update-alternatives --install /usr/bin/python python /usr/bin/python3 10

Usage

The tool can be launched by using the following command:

$ grap [options] pattern test_paths

Below are a few examples of supported options:

One can let grap infer a pattern from a string. Only few options are supported but this is useful for prototyping:

Choose how the binaries are disassembled:

Control the verbosity of the output:

Choose where the disassembled file(s) (.grapcfg) are written; match multiple files against multiple patterns:

Pattern examples

The following pattern detects a decryption loop consisting of a xor followed by sub found in a Backspace sample:

digraph decryption_md5_4ee00c46da143ba70f7e6270960823be {
A [cond=true, repeat=3]
B [cond="opcode is xor and arg2 is 0x11"]
C [cond="opcode is sub and arg2 is 0x25"]
D [cond=true, repeat=3]
E [cond="opcode beginswith j and nchildren == 2"]

A -> B
B -> C
C -> D
D -> E
E -> A [childnumber=2]
}

Note that pattern files can contain multiple pattern graphs.

You may find additional pattern examples in two directories:

Python binding examples

Examples of python bindings usage:

Documentation

You will find more documentation in the doc/ folder:

The syntax of pattern and test graphs is detailed in the file grap_graphs.pdf within the release section.

License

grap is licensed under the MIT license. The full license text can be found in LICENSE.