13

Since now, when I am analyzing a binary, I'm using a "pen and paper" method to locate the different location of the function, the different type of obfuscations, and all my discoveries. It is quite inefficient and do not scale at all when I try to analyze big binaries.

I know that IDAPro is having a data-base to store comments and a memory zone, but, in case we do not want to use IDAPro, what techniques or (free) tools are you using to collect your notes and to display it properly ?

  • Nothing really satisfactory since now... I tried all solutions proposed here but it didn't convinced me at all (nothing that nail once for all the pen & paper method). – perror Jun 5 '13 at 7:37
9

radare2 does support projects. They are not as sophisticated as IDAs .idb format, but they do the trick if saving patches and comments is all that you want. (Just make sure to build it from git)

Taken from the Radare2 Github README:

Webserver

radare2 comes with an embedded webserver that serves a pure html/js interface that sends ajax queries to the core and aims to implement an usable UI for phones, tablets and desktops.

$ r2 -c=H /bin/ls

Radare2 Webserver vizualized on a mobile phone

  • can you elaborate a little how it supports it for people unfamiliar with it? – 0xC0000022L Apr 27 '13 at 13:56
  • @0xC0000022L: I was about to ask the exact same question! – perror Apr 27 '13 at 14:16
  • 1
    Every informations added by the user, like comments, flags, marks, patches, … can be saved as a radare2 project. – jvoisin Nov 29 '13 at 4:25
5

You know, there was talks before about coming up with some kind of standard to share RE notes on woodman forums, that would be nice. But I usually just try and stay as neat as possible using notepad, and for collaborative work, I use Google Docs as well. Lately I have taken up using Evernote for collaborative work too, only because using Google docs requires me to use the web interface for their document format.

  • Using Evernote as well - I like the idea of having everything available on virtually all platforms I am using (OSX, Win, iOS). But then again, this really is super close to pen- and paper. I know GoogleDocs should do that as well but somehow I keep preferring native tools. – Till Jun 5 '13 at 15:31
4

When I work on a really complex project where I need to make a lot of structured notes, I often use tiddly wiki. The nice thing about it is that you can easily backup the wiki since it simply writes to its own html file.

And of course Google Docs, which is especially useful if you're working collaboratively.

  • I used both too. – Ange Apr 27 '13 at 10:06
  • 1
    It is quite close to what I call the "pen and paper" method... I am surprised that there is no killer-app to do such a thing !!! – perror Apr 29 '13 at 9:04
  • @perror: makes sense though, pen(cil) & paper are way more flexible than what you'll see with a computer that has no stylus or something similar attached. – 0xC0000022L May 2 '13 at 13:54
1

If you can't/don't want to use IDAPro, perhaps you can/may want to use another automation tool. ScratchABit is an open-source, interactive, direct-manipulation(*) disassembler which stores all the information in simple text files, not a proprietary binary database. From these text files, the information can be easily extracted with simple scripts, or they can be stored in version control system to allow collaborative work, etc.

Full disclosure: I'm the author of ScratchABit and it is work-in-progress project.

(*) Direct manipulation means that you press a command key and immediately get a reaction, you don't need to type long commands with manually specified addresses and press Enter.

0

Currently I'm using TreeDBNotes, they have a free and pro version available. I haven't compared it to any of the methods mentioned in other answers, but find it quite useful for keeping track of my project notes/data.

http://www.mytreedb.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.