Package: ofrak-angr
OFRAKOFRAK (Open Firmware Reverse Analysis Konsole) is a binary analysis and modification platform that combines the ability to unpack, analyze, modify, and repack binaries.Package: ofrak_angrOFRAK
└───ofrak
│   └───disassemblers
│       └───ofrak_angr  <-- //YOU ARE HERE//
│       |   └───components
│       |       └───blocks
│       |       |   └───unpackers.py
│       |       └───angr_analyzer.py
│       |       └───identifiers.py
│       └───ofrak_binary_ninja
│       └───ofrak_capstone
│       └───ofrak_ghidra
└───ofrak_type
└───ofrak_io
└───ofrak_patch_maker
└───ofrak_tutorialThis package contains OFRAK components utilizingangrto unpack Code Regions and Complex Blocks:AngrCodeRegionUnpackerfor unpackingCodeRegions into their constituentComplexBlockAngrComplexBlockUnpackerunpackingComplexBlocks into their constituentBasicBlocksAngrAnalyzerfor analyzing resources with angrAngrAnalysisIdentifierfor identifying resources which can be analyzed with angrNote that this package does not contain a component to unpackBasicBlocks intoInstructions; useofrak_angrin conjunction withofrak_capstoneif you want to unpack all the way down to the instruction level.After installing the package, it can be used in an OFRAK script by adding the following to the setup step:importofrak_angr...ofrak=OFRAK()...# Other setup stepsofrak.discover(ofrak_angr)It can be used from the CLI by adding the--backend angrflag to the OFRAK CLI command.TestingThe tests forofrak_angrrequire the tests to be installed for the core OFRAK module. These must
first be installed after downloading theOFRAK source code.Then, theofrak_angrtests can be run with:pytest--pyargsofrak_angr_testTestingThis package maintains 100% test coverage of functions.LicenseThe code in this repository comes with anOFRAK Community License, which is intended for educational uses, personal development, or just having fun.Users interested in using OFRAK for commercial purposes can request the Pro or Enterprise License. SeeOFRAK Licensingfor more information.DocumentationOFRAK has general documentation and API documentation, which can be viewed athttps://ofrak.com/docs.DescriptionOnce angr's CFG is processed into OFRAK, the hierarchy of the non-overlapping packing structure of an executable is expected to look like this:Code RegionsComplex BlocksBasic BlocksDataWordsOFRAK works on packing structures of data on real memory addresses. angr reflects memory addresses as it appears to a program running inside of it. As such, certain transformations have to be made from angr's analysis before exporting to OFRAK, including:Retrieving real memory addresses from the thumb-mode addresses returned by angr; andExpanding function ranges returned by angr to include literal pools, before exporting that as part of a Complex BlockCFG generator callback & Post-analysis hooksPost-analysis hooksangr scripts can be run right after angr generates the CFG (as 'cfg') of a resource. One can load an angr python script from a file instead of writing it directly on the exec string.config=AngrAnalyzerConfig(project.analyses.CFGFast,{"normalize":True},\'LOGGER.info("post_cfg_analysis_hook running cfg.do_full_xrefs()");\cfg.do_full_xrefs()')CFG generator callbackA different CFG analyzer may be requested, such as CFGEmulated. By default normalized CFGFast will be used.config=AngrAnalyzerConfig(project.analyses.CFGEmulated,{"normalize":True,"enable_function_hints":True})DockerThe following command will build an OFRAK with angr capabilities.python3build_image.py--configofrak-angr.yml--base--finish