ret-sync | debugging session | Reverse Engineering library
kandi X-RAY | ret-sync Summary
kandi X-RAY | ret-sync Summary
ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.
Support
Quality
Security
License
Reuse
Top functions reviewed by kandi - BETA
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of ret-sync
ret-sync Key Features
ret-sync Examples and Code Snippets
Community Discussions
Trending Discussions on ret-sync
QUESTION
I would like to use akv2k8s.io for adding key vault into kubernetes using helm chart.
...ANSWER
Answered 2021-Oct-28 at 18:25Funny, i also played this week with akv2k8s :)
Did you create a role assignment for the kubelet identity to your keyvault?
QUESTION
I have x64dbg and ghidra synchronized via ret-sync. I found an interesting point in ghidra:
...ANSWER
Answered 2021-Jan-19 at 09:06You said you wanted to go to 328b4
but your second snippet is at ...32B4
and looks like you ended up in the middle of an instruction. I would expect the correct address to be 0x00007FF8B2F81000 + 0x328b4 = 0x7ff8b2fb38b4.
I am not aware of ret-sync
supporting setting breakpoints, but you can do the address translation more easily by either getting the relative offset by hovering
Source: https://twitter.com/dev747368/status/1347360276476293125
and then adding the x64dbg
offset of 00007FF8B2F81000
to offset (2008h
in the screenshot, in your case 328b4h
)
Or you can script this by running currentAddress.subtract(currentProgram.imageBase)
in the shell to get the relative offset for the current address (again 328b4h
in your example) and then adding the x64dbg
offset. So the complete command would be: currentAddress.subtract(currentProgram.imageBase).add(0x00007FF8B2F81000)
Run this in the Python REPL and the correct x64dbg
address for the current address should result.
Community Discussions, Code Snippets contain sources that include Stack Exchange Network
Vulnerabilities
No vulnerabilities reported
Install ret-sync
C:\Program Files\IDA Pro 7.4\plugins
%APPDATA%\Hex-Rays\IDA Pro\plugins
~/.idapro/plugins
Either use the pre-built version from the ext_ghidra/dist folder or follow the instruction to build it. Each extension build only supports the version of Ghidra specified in the plugin's file name. E.g. ghidra_9.1_PUBLIC_20191104_retsync.zip is for Ghidra 9.1 Public.
Install Ghidra
Install gradle
Build extension for your Ghidra installation (replace $GHIDRA_DIR with your installation directory)
A status window is also available from Windows -> RetSyncPlugin. You generally want to drop it on the side to integrate it with the Ghidra environment windows.
From Ghidra projects manager: File -> Install Extensions..., click on the + sign and select the ext_ghidra/dist/ghidra_*_retsync.zip and click OK. This will effectively extract the retsync folder from the zip into $GHIDRA_DIR/Extensions/Ghidra/
Restart Ghidra as requested
After reloading Ghidra, open a module in CodeBrowser. It should tell you a new extension plugin has been detected. Select "yes" to configure it. Then tick "RetSyncPlugin" and click OK. The console should show something like:
From Ghidra CodeBrowser tool: use toolbar icons or shortcuts to enable (Alt+s)/disable (Alt+Shift+s)/restart (Alt+r) synchronization.
ret-sync is not yet distributed through the Binary Ninja's Plugin Manager; a manual installation is required. Simply copy that content of the ext_bn folder into Binary Ninja's plugins folder, for example:.
Either use pre-built binaries or use the Visual Studio 2017 solution provided in ext_windbg, (see https://docs.microsoft.com/en-us/visualstudio/releasenotes/vs2017-relnotes if needed). This will build the x64\release\sync.dll file.
You will need to copy the resulting sync.dll file into the appropriate Windbg extension path. For earlier versions of Windbg this is is something like this (be careful of x86/x64 flavours), for example. The folder for storing extension seems to be based on the PATH, so you need to put it one of the queried locations.
WinDbg Classic:
Windbg Preview
Note: If you get the following error, it is because you haven't copied the file to the right folder in the above steps. The error below usually means that Windbg tried to load the incorrect flavour of the extension, ex: x86 in place of the x64 sync.dll.
LLDB support is experimental, however:.
Load extension (can also be added in ~/.lldbinit)
OllyDbg 1.10 support is experimental, however:.
Build the plugin using the VS solution (optional, see pre-built binaries)
Copy the dll within OllyDbg's plugin directory
OllyDbg2 support is experimental, however:.
Build the plugin using the VS solution (optional, see pre-built binaries)
Copy the dll within OllyDbg2's plugin directory
Based on testplugin, https://github.com/x64dbg/testplugin. x64dbg support is experimental, however:.
Build the plugin using the VS solution (optional, see pre-built binaries). May you need a different version of the plugin sdk, a copy can be found in each release of x64dbg. Paste the "pluginsdk" directory into "ext_x64dbg\x64dbg_sync"
Copy the dll (extension is .d32 or .dp64) within x64dbg's plugin directory.
Support
Reuse Trending Solutions
Find, review, and download reusable Libraries, Code Snippets, Cloud APIs from over 650 million Knowledge Items
Find more librariesStay Updated
Subscribe to our newsletter for trending solutions and developer bootcamps
Share this Page