Package: kordesii
DC3-KordesiiChangelog|ReleasesDC3-Kordesii is a framework for decoding encoded strings and files in malware via IDA Pro IDAPython scripting.
One parser module is usually created per malware family.
It is designed to ease the burden of encoded string extraction by doing it in an automated,
static way as well as to provide a standard set of functionality and methodologies.
It supports both an analyst directed analysis and large-scale automated executing,
utilizing either the REST API, the CLI or by manually running decoders in IDA.DC3-Kordesii is authored by the Department of Defense Cyber Crime Center (DC3).InstallUsageCLI ToolREST APILoggingCPU EmulationIDA ProxyGuidesCPU EmulationDecoder DevelopmentDecoder InstallationDecoder TestingDependenciesDC3-Kordesii requires the following:Python 3.7+ (64 bit)IDA Pro 7.* (tested and developed with 7.4)(optional)Hex Ray's Decompiler for x86/x64 architectures(Used to improve accuracy of getting function arguments infunction_tracing)Install> pip install kordesiiAlternatively you can clone this repo and install locally.> git clone https://github.com/Defense-Cyber-Crime-Center/kordesii.git> pip install ./kordesiiFor a development mode use the-eflag to install in editable mode:> git clone https://github.com/Defense-Cyber-Crime-Center/kordesii.git> pip install -e ./kordesiiSetup IDA locationBy default kordesii assumes you are on Windows and have installed IDA under the default locationC:/Program Files/IDA Pro *.
If you have installed IDA at a different location or running on another operating system, please set theIDA_DIRenvironment
to point to where IDA has been installed.UsageDC3-Kordesii is designed to standardize automation of a task typically done by one-off scripts.
Most automated processing systems will use a condition, such as a YARA signature match,
to trigger execution of a particular DC3-Kordesii decoder.There are 2 options for integration of DC3-Kordesii:CLI:kordesiiREST API:kordesii serveCLI toolThekordesiitool provides functionality to run and test decoders on files:> kordesii parse Sample ./kordesii/decoders/tests/strings.exe[+] (kordesii): Parsing: ./kordesii/decoders/tests/strings.exe[+] (kordesii.core): IDA return code = 0----Decoded Strings----Hello World!Test string with key 0x02The quick brown fox jumps over the lazy dog.Oak is strong and also gives shade.Acid burns holes in wool cloth.Cats and dogs each hate the other.Open the crate but don't break the glass.There the flood mark is ten inches.1234567890CreateProcessAStrCatASP.NETkdjsfjf0j24r0j240r2j09j22232897412389471982470The past will look brighter tomorrow.Cars and busses stalled in sand drifts.The jacket hung on the back of the wide chair.32908741328907498134712304814879837483274809123748913251236598123056231895712----Debug----[+] IDA return code = 0> kordesii test SampleRunning test cases. May take a while...1/1 - kordesii:Sample strings.exe 8.9183sTest stats:Top 10 Slowest Test Cases:1. kordesii:Sample strings.exe 8.9183sTop 10 Fastest Test Cases:1. kordesii:Sample strings.exe 8.9183sMean Running Time: 8.9183sMedian Running Time: 8.9183sCumulative Running Time: 0:00:08.918259Total Running Time: 0:00:09.480942All Passed = Trueseekordesii -hfor full set of optionsREST APIThe REST API provides two commonly used functions:/run_decoder/<decoder>-- executes a decoder on uploaded file/descriptions-- provides list of available parsersTo use, first start the server by running:> kordesii serveThe following curl commands demonstrate how to use this web service:> curl --form data=@README.md http://localhost:8080/run_decoder/foo> curl http://localhost:8080/descriptionsA simple HTML interface is also available at the same address.
Individual samples can be submitted and results
saved as JSON, plain text, or ZIP archives.LoggingDC3-Kordesii uses Python's builtin inloggingmodule to log all messages.
By default, logging is configured using thelog_config.ymlconfiguration
file. Which is currently set to log all messages to the console and error messages to%LOCALAPPDATA%/kordesii/errors.log.
You can provide your own custom log configuration file by adding the path
to the environment variableKORDESII_LOG_CFG. (Please seePython's documentationfor more information on how to write your own configuration file.)You may also use the--verboseor--debugflags to adjust the logging level when using thekordesiitool.CPU EmulationDC3-Kordesii includes an experimental tracing utility calledfunction_tracingthat can be used to statically emulate
and trace instructions within a function.Please see theCPU Emulationdocumentation for more information.